Club Benefits
You are now subscribed
Your newsletter sign-up was successful
Want to add more newsletters?
Daily (Mon-Sun)
Tom's Guide Daily
Sign up to get the latest updates on all of your favorite content! From cutting-edge tech news and the hottest streaming buzz to unbeatable deals on the best products and in-depth reviews, we’ve got you covered.
Weekly on Thursday
Tom's AI Guide
Be AI savvy with your weekly newsletter summing up all the biggest AI news you need to know. Plus, analysis from our AI editor and tips on how to use the latest AI tools!
Weekly on Friday
Tom's iGuide
Unlock the vast world of Apple news straight to your inbox. With coverage on everything from exciting product launches to essential software updates, this is your go-to source for the latest updates on all the best Apple content.
Weekly on Monday
Tom's Streaming Guide
Our weekly newsletter is expertly crafted to immerse you in the world of streaming. Stay updated on the latest releases and our top recommendations across your favorite streaming platforms.
Join the club
Get full access to premium articles, exclusive features and a growing list of member rewards.
Several flaws were recently discovered in the Sophos Antivirus client that now has Google security engineer Tavis Ormandy requesting that the software be kept away from high value information systems.
According to Ormandy, one exploit is for a flaw located in Sophos' on-access scanner. This exploit could be used to unleash a worm on a network by attaching it to an email via Outlook – it doesn't need to be read or opened to launch the payload. Even using a webmail client is enough, he claims, as an attacker can embed images using MIME cid: urls and trigger cache writes.
"[I]nstalling Sophos Antivirus exposes machines to considerable risk," he states in the report. "If Sophos do not urgently improve their security posture, their continued deployment causes significant risk to global networks and infrastructure."
The security firm reportedly received an early version of the paper on September 10, and commended Ormandy for his "responsible disclosure". Sophos and Ormandy previously clashed a few years back after he reported a Windows XP bug to Microsoft and then released the attack code five days later. Sophos called the disclosure "irresponsible" because there wasn't enough given time to fix the issue.
Sophos said on Tuesday that the bulk of the issues revealed in the report were fixed as of October 22, just 42 days later, followed by a second fix on November 5. A third patch is slated to arrive on November 28 that will address "malformed files which can cause the Sophos antivirus engine to halt," the security firm said.
"The work of Tavis Ormandy, and others like him in the research community, who choose to work alongside security companies, can significantly strengthen software products," Sophos said. "On behalf of its partners and customers, Sophos appreciates Tavis Ormandy's efforts and responsible approach."
Ormandy wasn't quite so flattering in his report, saying that Sophos originally wanted six months to fix the flaws. After negotiations, the security firm finally agreed to two months. "Sophos were able to convince me they were working with good intentions, but they were clearly ill-equipped to handle the output of one co-operative security researcher working in his spare time," he said.
Ormandy warns that Sophos products should be used on low-value non-critical systems and never deployed on networks or environments in the healthcare, government, finance and military sectors where a complete compromise by adversaries would be "inconvenient".
"As a security company, keeping customers safe is Sophos's primary responsibility," the security firm said. "As a result, Sophos experts investigate all vulnerability reports and implement the best course of action in the tightest time period possible."
