This issue was disclosed by Ormandy on January 21 and Comodo’s patch to fix the problem released yesterday. “and the update will go to all current Chromodo users as well.” “Comodo is releasing an update of Chromodo without the add-on, removing any issues,” Charles Zinkowski, Comodo director of corporate communications, told eWeek.

However, as reported by eWeek, this fault was not with the Comodo browser itself but a plug-in that shipped with the software. They also hijack DNS settings, among other shady practices.” Upon researching this behavior, Ormandy did not think highly of the software’s behavior saying, “all shortcuts are replaced with Chromodo links and all settings, cookies, etc are imported from Chrome. Comodo patching bad plug-in behavior in ChromodoĪs for Comodo’s Internet Security software and its Chromodo browser, Ormandy discovered that the new software replaced the users’ own Chrome installation-meaning that it would overwrite any security that had already been set up. The issue was disclosed by Omandy on Decemand Avast responded by patching the flaw yesterday, February 3. When looking into Avastium, the Chromim-based software from Avast, Ormandy discovered what he described as “complicated” but easily allowed attackers to “read any file on the filesystem by clicking a link.” To complete the attack a hacker would need to craft a complex Javascript website that would then circumvent Avastium’s built-in security.

Avast patches Javascript exploit out of Avastium The discovery of the “ Heartbleed” vulnerability in April 2014 became the inspiration to jump-start the efforts of the Project Zero team. The project was announced on Jalong with encouraging increased security across all of Google’s products and the use of SSL encryption. Project Zero is the name of a team of security analysts employed by Google who spend their time spelunking through code to discover zero-day exploits. It is used as the codebase for browsers released by other product vendors and in the case of Avast (from AVAST Software s.r.o.), Comodo (from Comodo Group, Inc.) and Malwarebytes (from Malwarebytes Corporation) it is the core for “secure” browser products. Each of these flaws either permits attackers to run code on the computers of unsuspecting users or opens customers up to being spied upon.Ĭhromium is an open-source browser project upon which Google Chrome is based, the intention of the project was to provide a minimalistic web-browser with high security and lightweight configuration. If you have any questions, please leave them in the comments below and I’ll do my best to answer them.Google Project Zero security researcher Tavis Ormandy has uncovered and disclosed flaws in anti-virus products based on Google’s Chromium browser offered by Avast, Comodo and Malwarebytes. There’s more information here for home users, and businesses can find out more on this page.Īnd we're doing a giveaway! Enter for a chance to win one of 10 Malwarebytes Anti-Exploit T-shirts or 10 licenses of Malwarebytes Anti-Exploit Premium on our Facebook page. The product has also performed very well against the numerous zero-day attacks we have thrown at it in testing. This is different to the traditional reactive approach, and means we can block known and unknown zero-day exploits.īut we wouldn’t expect you to just take our word for it! We asked renowned exploit blogger Kafeine to put Malwarebytes Anti-Exploit through its paces - testing it against all the exploit kits currently in the wild.

Malwarebytes Anti-Exploit wraps these applications in three layers of defense, monitoring them for suspicious activity and stopping it at source. Basically, these threats abuse vulnerabilities in everyday software applications such as browsers, office documents and PDFs and use these to download malware. Malwarebytes Anti-Exploit For Business is designed to protect companies of every size, with full visibility of all endpoints through a central console which can be remotely managed.įor those of you who are unfamiliar with exploits, we put together the video below. It’s available either as a Free version, which protects against browser and Java exploits, or a Premium version, which adds protection for PDF readers, Microsoft Office, media players and also allows people to create custom shields. We have spent the last year developing and testing the product, and I believe it is a great example of how we are always coming up with new ways to beat the bad guys.įor home users, a 3MB download provides quick and easy protection against exploits and runs quietly in the background. I’m delighted to announce the launch of Malwarebytes Anti-Exploit, following a year of beta.

Malwarebytes 2014