Antivirus software can be hijacked to wipe data

Many popular pieces of antivirus software such as Microsoft, SentinelOne, TrendMicro, Avast, and AVG can be exploited for their data deletion capabilities, a top cybersecurity researcher has claimed.

In a Proof-of-Concept document (opens in new tab) dubbed “Aikido”, Or Yair, who works for cybersecurity firm SafeBreach, explained how the exploit works via what is known as a time-of-check to time-of-use (TOCTOU) vulnerability.

Notably, in martial arts, Aikido refers to a Japanese style where the practitioner looks to use the movement and force of the opponent against himself.

How does it work?

The vulnerability can be used to facilitate a variety of cyber-attacks known as “Wipers” according to Yair, which are commonly used in offensive war situations.

In cybersecurity, a wiper is a class of malware aimed at erasing the hard drive of the computer it infects, maliciously deleting data and programs.

According to the slide deck, the exploit redirects the “superpower” of endpoint detection software to “delete any file no matter the privileges”.

The complete process outlined involved creating a malicious file in “C:\temp\Windows\System32\drivers\ndis.sys”.

This is followed by holding its handle and forcing the “AV/EDR to postpone the deletion until after the next reboot”.

This is followed by then deleting the “C:\temp directory” and “creating a junction in C:\temp –> C:\”, followed by then rebooting the machine. 

Only some of the most popular antivirus brands were impacted, around 50% according to Yair.

According to a slide deck prepared by the researcher, Microsoft Defender, Defender for Endpoint, SentinelOne EDR, TrendMicro Apex One, Avast Antivirus, and AVG Antivirus were some of those affected by the vulnerability. 

Luckily for some, products such as Palo Alto, XDR, Cylance, CrowdStrike, McAfee, and BitDefender were unscathed. 

• Interested in updating your cybersecurity tools? Check out our guide to the best malware removal tools