Defender, Avast, AVG? inform immediately

Ο Or Yair, ένας ερευνητής ασφάλειας στην SafeBreach, δημοσίευσε ένα (POC) που δείχνει πώς μπορείτε να εξαπατήσετε antivirus για να διαγράψουν οριστικά αβλαβή αρχεία στον υπολογιστή σας.

POC is called “Aikido” and is inspired by the Japanese martial art that to direct the aggressive movements of the opponents against themselves.

Our PoC shows without a doubt that the Aikido wiper works. Microsoft has already identified the exploit in Defender and patched the vulnerability.

But there were other software manufacturers ς όπως οι Avast, και TrendMicro που ήταν ευάλωτοι σε αυτό το exploit. Άλλες δημοφιλείς λύσεις όπως το McAfee και το BitDefender δεν επηρεάζονται.

Here is the full list of tested products.

aikido wiper 1

Yair mentions that Aikido wiper uses a vulnerability called time-of-check to time-of-use (TOCTOU).

It is an anti-virus solution that first detects and identifies a file as malicious and then deletes it.

Aikido using TOCTOU is used to insert an alternate path after malware detection that leads to deletion of normal files instead of malicious ones. Even system files could be permanently deleted.

In the case of Defender and Defender for Endpoint, Yair noticed that Defender didn't delete files, but folders. Microsoft listed the vulnerability ID as “CVE-2022-37971” and patched the vulnerability in the latest version 1.1.19700.2 of Microsoft Malware .

Meanwhile, TrendMicro, Avast and AVG also released updates to their products:

TrendMicro Apex One: Hotfix 23573 & Patch_b11136
Avast & AVG Antivirus: 22.10

More details about Akido Wiper and the exploit can be found on SafeBreach's official website here. The Akido Wiper POC was presented at the recent security conference Black Hat Europe 2022. So you can find more information here.

iGuRu.gr The Best Technology Site in Greecefgns

every publication, directly to your inbox

Join the 2.100 registrants.
Defender, Avast, AVG, Aikido wiper

Written by giorgos

George still wonders what he's doing here ...

Leave a reply

Your email address is not published. Required fields are mentioned with *

Your message will not be published if:
1. Contains insulting, defamatory, racist, offensive or inappropriate comments.
2. Causes harm to minors.
3. It interferes with the privacy and individual and social rights of other users.
4. Advertises products or services or websites.
5. Contains personal information (address, phone, etc.).