Google’s Project Zero is at it again, this time outing Malwarebytes for a security vulnerability that opens the anti-malware software to man in the middle attacks. A fix is on the way, according to Malwarebytes.
The problem? Updates for Malwarebytes are downloaded sans encryption, meaning a would-be attacker with network access could potentially replace them with arbitrary code.
“MalwareBytes fetches their signature updates over HTTP, permitting a man in the middle attack,” wrote Project Zero researcher Tavis Ormandy. “Although the YAML files include an MD5 checksum, as it’s served over HTTP and not signed, an attacker can simply replace it.”
The post detailing the issue, made public today, goes on to outline a couple more issues that could allow arbitrary code execution. It also, like every Project Zero post, outlined a deadline.
“This bug is subject to a 90 day disclosure deadline,” the report states clearly, in bold text. “If 90 days elapse without a broadly available patch, then the bug report will automatically become visible to the public.”
Malwarebytes missed the deadline. To its credit, though, the company put out a statement saying a fix is on the way, while also saying there’s nothing to panic about.
“Within days, we were able to fix several of the vulnerabilities server-side and are now internally testing a new version (2.2.1) to release in the next 3-4 weeks to patch the additional client-side vulnerabilities,” wrote Malwarebytes’ Marcin Kleczynski in a blog post about the issue.
The post also offered a short term fix. Users concerned about threat should “enable self-protection under settings to mitigate all of the reported vulnerabilities,” according to Kleczynski.
The post, which also offered an apology for the problems, was well-recieved by users in the comments — bar the one who asked for a refund for the three months the issue went unsolved. We’re sure everyone will be happier when the problems are fully patched.
Google Zero is a group within Google that tracks down previously unknown security problems, commonly referred to as zero day attacks, before would-be attackers can take advantage of them. The problems are reported to the company responsible for the software, and if nothing is done about them within 90 days, the report is released to the public.
Mozilla is giving Firefox’s Smart Window two new tricks. If you haven’t tried it yet, Smart Window is an optional AI mode in Firefox with a built-in chat that helps you get things done while you browse. With this update, it can fill out online forms using details from your tabs and keep an eye on websites for you.
Tired of typing the same details into every form?
The absolutely absurd idea of putting a touchscreen display on a mouse isn't exactly new. Turtle Beach already did it with its Command Series MC7, which features a 2.25-inch control screen. But apparently, even that wasn't ridiculous enough for Arctic Fox Technologies. Its new Super Mouse looks like someone took the chunky old Atari ST mouse, slapped a touchscreen and scroll wheel on it, and called it an upgrade.
The result is a rather unusual-looking mouse that is now on Kickstarter, starting at $199. And as ridiculous as it looks, some of its features are genuinely intriguing.
Apple is less than a day away from launching its highly anticipated OLED MacBook Pro with a touch-sensitive screen. But it appears that the upgrade is going to cost a pretty penny. According to a report by Bloomberg, Apple is reportedly eyeing a starting price of $2,899 for the 14-inch MacBook Pro, while the 16-inch version could start at $3,399 in the US.
"At $2,899, the 14-inch model would mark the highest starting price for a new MacBook Pro model, surpassing the $2,799 Apple charged for a 17-inch version introduced in 2006," says the report. The report claims that Apple is targeting a minimum price hike of $400 for its upcoming redesigned 14-inch and 16-inch MacBook Pro models.