Is security software becoming a security risk?

Security researchers believe that file-parsing bugs in security software could become a big problem.

Russ Cooper, a senior scientist with Verizon Business, had some criticism for the work of n.runs. "The research almost appears to be goading criminals into 'getting better' at attacking vulnerabilities ... hardly helpful," he said via instant message. "There's no doubt that the list of vulnerabilities they have already published in security products looks daunting. However, historically, we have not seen this type of vulnerability exploited."

Though Cooper agrees that antivirus file parsing vulnerabilities do pose a risk, he said there are several reasons they have not yet been the focus of widespread criminal attacks. For one, criminals are already being effective enough with their current tactics, such as sending malicious e-mail attachments. A second reason is that security software tends to get more scrutiny, meaning that any vulnerability that was being exploited would be quickly patched, and that any criminal involved in an exploit would be more likely to be caught.

Security vendors have long known about vulnerabilities in their software, said Marc Maiffret, chief technology officer with eEye digital security. "Security software is just as vulnerable as any other software," he said via instant message. "We all hire the same developers that went to the same colleges as Microsoft and learned the same bad habits."

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

More about AppleeEye Digital SecurityHISMicrosoftVerizonVIA

Show Comments