Trend Micro imports browser passwords, lets websites upload them all

[fencepost]

The sheer level of incompetence described in the security report that this Hacker News thread is about is astonishing. (The original security report is here: https://code.google.com/p/google-security-research/issues/detail?id=693).

Basically, Trend Micro (apparently the consumer edition(s) not so much the business/enterprise ones) has a few minor security flaws. The first one to turn up was that they install a local webserver which can be used to launch any program - all a webpage has to do is send a request to it using 'localhost'. Of note: the sample exploit code that Tavis provided in post #13 on the bug report launches an excutable to.... Uninstall Trend Micro.

After that little issue turned up and more investigation ensued, it turns out they include a "Secure Browser" mode - it even says "Secure Browser" in the User-Agent of what they launch - which turns out to be a year-old version of Chromium (so minus a bunch of security fixes) that is explicitly launched with the command-line option "--disable-sandbox" thrown in just to remove an additional layer of security.

And the real winner: When you install, it offers to import all your browser-stored passwords into their Secure Password Storage (don't worry - if you decline to do that, any webpage you visit can force it later by calling one of those 'localhost' APIs). Once your passwords are in the Secure Password Storage, any website can generate a call to a 'localhost' API to extract the encrypted passwords, then use another to decrypt them, then POST them out to another website.

I'm horrified. And glad that I don't know anyone running consumer Trend Micro.

 

[glennd]

The sheer level of incompetence described in the security report that this Hacker News thread is about is astonishing. (The original security report is here: https://code.google.com/p/google-security-research/issues/detail?id=693).

Basically, Trend Micro (apparently the consumer edition(s) not so much the business/enterprise ones) has a few minor security flaws. The first one to turn up was that they install a local webserver which can be used to launch any program - all a webpage has to do is send a request to it using 'localhost'. Of note: the sample exploit code that Tavis provided in post #13 on the bug report launches an excutable to.... Uninstall Trend Micro.

After that little issue turned up and more investigation ensued, it turns out they include a "Secure Browser" mode - it even says "Secure Browser" in the User-Agent of what they launch - which turns out to be a year-old version of Chromium (so minus a bunch of security fixes) that is explicitly launched with the command-line option "--disable-sandbox" thrown in just to remove an additional layer of security.

And the real winner: When you install, it offers to import all your browser-stored passwords into their Secure Password Storage (don't worry - if you decline to do that, any webpage you visit can force it later by calling one of those 'localhost' APIs). Once your passwords are in the Secure Password Storage, any website can generate a call to a 'localhost' API to extract the encrypted passwords, then use another to decrypt them, then POST them out to another website.

I'm horrified. And glad that I don't know anyone running consumer Trend Micro.

That doesn't strike me as incompetent, it strikes me as malicious. Installing a local web server or using a year old browser with sandbox disabled is not the kind of thing you do accidentally. Stealing passwords and sending them to anyone that asks is not code that slips past QA, that is undeniably deliberate and malicious intent.

 

[HankArnold]

I'd probably put it in the "Lazy Programming" box.

 

[katz]

I don't get this behavior at all - what reason would Trend Micro have for doing this?

 

[ZenTree]

The scary thing about this is that its becoming the norm to see press releases like this. I think a lot of security vendors would just get complacent in the routine of getting the latest virus signatures and throwing them into the database. Hopefully the work being done forces people to invest more in auditing their code.

 

[JoeTech]

At some point in the process I'm sure there was a high ranking manager that used his authority to push it through and said "I don't care if this is the worst possible way to get this to work, it sounds fancy and it might make us some extra sales. Plus the consumer will never find out how bad it really is." Otherwise there incompetence is truly horrifying. it's getting harder and harder to trust companies these days.

 

[fencepost]

I don't get this behavior at all - what reason would Trend Micro have for doing this?

It was an easy way to develop the backend, and it let their developers play with the "new hotness." I actually do believe incompetence - I'll reserve my "bad actors" opinion for Juniper.