Feeds

Microsoft AV advice may aid attackers, researcher warns

Better performance. But at what cost?

  • alert
  • submit to reddit

SANS - Survey on application security programs

A security researcher is taking Microsoft to task for advising customers to exclude certain files and folders from anti-virus scanning, arguing the practice could be exploited by pushers of malware.

Microsoft issued the recommendations in October, as a way of improving system performance. They suggested administrators exclude certain files used by Windows Update, Automatic Update, and security features in six different versions of the Windows operating system.

In a blog item posted Monday, David Sancho, a malware researcher at Trend Micro, warned the recommendations put users at risk.

"Following the recommendations does not pose a significant threat as of now, but it has a very big potential of being one," he wrote. "Cybercriminals may strategically drop or download a malicious file into one of the folders that are recommended to be excluded from scanning, or use a file extension that is also in the excluded list."

Microsoft's recommendations stem from the belief the scanning of certain files is unnecessary and detrimental to performance.

"These files are not at risk of infection," the October Microsoft article said. "If you scan these files, serious performance problems may occur because of file locking." The recommendations pertain to machines running Windows Server 2008, Windows Server 2003, Windows 2000, Windows XP, Windows Vista, or Windows 7. ®

Combat fraud and increase customer satisfaction

More from The Register

next story
Parent gabfest Mumsnet hit by SSL bug: My heart bleeds, grins hacker
Natter-board tells middle-class Britain to purée its passwords
Samsung Galaxy S5 fingerprint scanner hacked in just 4 DAYS
Sammy's newbie cooked slower than iPhone, also costs more to build
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Web data BLEEDOUT: Users to feel the pain as Heartbleed bug revealed
Vendors and ISPs have work to do updating firmware - if it's possible to fix this
Snowden-inspired crypto-email service Lavaboom launches
German service pays tribute to Lavabit
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Call of Duty 'fragged using OpenSSL's Heartbleed exploit'
So it begins ... or maybe not, says one analyst
NSA denies it knew about and USED Heartbleed encryption flaw for TWO YEARS
Agency forgets it exists to protect communications, not just spy on them
prev story

Whitepapers

Designing a defence for mobile apps
In this whitepaper learn the various considerations for defending mobile applications; from the mobile application architecture itself to the myriad testing technologies needed to properly assess mobile applications risk.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.