Is security software becoming a security risk?

Is the software we're using to protect ourselves from online attacks becoming a liability? That's what Thierry Zoller believes. For the past two years, the security engineer for n.runs AG has taken a close look at the way antivirus software inspects e-mail traffic, and he thinks companies that try to improve security by checking data with more than one antivirus engine may actually be making things worse. Why? Because bugs in the "parser" software used to examine different file formats can easily be exploited by attackers, so increasing your use of antivirus software increases the chances that you could be successfully attacked.

Antivirus software must open and inspect data in hundreds, if not thousands, of file formats. One bug in the software that does this can lead to a serious security breach.

Zoller and his colleague Sergio Alvarez have been looking into this issue for the past two years, and they've found more than 80 parser bugs in antivirus software, most of which have not yet been patched.

The flaws they've found affect every major antivirus vendor, and many of them could allow attackers to run unauthorized code on a victim's system, Zoller said.

"People think that putting one AV engine after another is somehow defense in depth. They think that if one engine doesn't catch the worm, the other will catch it," he said. "You haven't decreased your attack surface; you've increased it because every AV engine has bugs"

Although attackers have exploited parsing bugs in browsers for years now with some success, Zoller believes that because antivirus software runs everywhere and often with greater administrative rights than the browser, these flaws could lead to even greater problems in the future.