VULNERABILITY ALLOWS BYPASSING AND DISABLING ANY ANTIVIRUS AV SOFTWARE IN WINDOWS, MAC AND LINUX

Specialists in IT security risk assessment have revealed a new technique with which it is possible to exploit a vulnerability to disable almost any antivirus solution on Windows, macOS and Linux operating systems. While some antivirus tool vendors recently implemented substantial improvements, the flaw has proven to be highly functional against multiple deployments.

Antivirus tools are one of the main methods of anti malware protection, although there are multiple methods to bypass this barrier and compromise a system. Unlike other attack variants, the method presented by this group of specialists is especially stealthy and can help a threat actor to abuse a computer system with ease.

RACK911 Labs IT security risk assessment experts mention that when an unknown file is saved to disk, the antivirus installed by the user performs a “real-time scan”, which could take a few seconds or even minutes, depending on the antivirus tool. If a file is identified as suspicious, it is quarantined or deleted. Because antivirus tools run with high privileges on the system, threat actors can take advantage of this to exploit some known security flaws.

Continue Reading