Russ Cooper, a senior scientist with Verizon Business, had some criticism for the work of n.runs. "The research almost appears to be goading criminals into 'getting better' at attacking vulnerabilities ... hardly helpful," he said via instant message. "There's no doubt that the list of vulnerabilities they have already published in security products looks daunting. However, historically, we have not seen this type of vulnerability exploited."
Though Cooper agrees that antivirus file parsing vulnerabilities do pose a risk, he said there are several reasons they have not yet been the focus of widespread criminal attacks. For one, criminals are already being effective enough with their current tactics, such as sending malicious e-mail attachments. A second reason is that security software tends to get more scrutiny, meaning that any vulnerability that was being exploited would be quickly patched, and that any criminal involved in an exploit would be more likely to be caught.
Security vendors have long known about vulnerabilities in their software, said Marc Maiffret, chief technology officer with eEye digital security. "Security software is just as vulnerable as any other software," he said via instant message. "We all hire the same developers that went to the same colleges as Microsoft and learned the same bad habits."