Antivirus software can be hijacked to wipe data

An abstract image of a magnifying glass over a digital cloud.
(Image credit: Shutterstock/Illus_man)

Many popular pieces of antivirus software such as Microsoft, SentinelOne, TrendMicro, Avast, and AVG can be exploited for their data deletion capabilities, a top cybersecurity researcher has claimed.

In a Proof-of-Concept document dubbed "Aikido", Or Yair, who works for cybersecurity firm SafeBreach, explained how the exploit works via what is known as a time-of-check to time-of-use (TOCTOU) vulnerability.

Notably, in martial arts, Aikido refers to a Japanese style where the practitioner looks to use the movement and force of the opponent against himself.

How does it work?

The vulnerability can be used to facilitate a variety of cyber-attacks known as "Wipers" according to Yair, which are commonly used in offensive war situations.

In cybersecurity, a wiper is a class of malware aimed at erasing the hard drive of the computer it infects, maliciously deleting data and programs.

According to the slide deck, the exploit redirects the "superpower" of endpoint detection software to "delete any file no matter the privileges".

The complete process outlined involved creating a malicious file in "C:\temp\Windows\System32\drivers\ndis.sys".

This is followed by holding its handle and forcing the "AV/EDR to postpone the deletion until after the next reboot".

This is followed by then deleting the "C:\temp directory" and "creating a junction in C:\temp --> C:\", followed by then rebooting the machine. 

Only some of the most popular antivirus brands were impacted, around 50% according to Yair.

According to a slide deck prepared by the researcher, Microsoft Defender, Defender for Endpoint, SentinelOne EDR, TrendMicro Apex One, Avast Antivirus, and AVG Antivirus were some of those affected by the vulnerability. 

Luckily for some, products such as Palo Alto, XDR, Cylance, CrowdStrike, McAfee, and BitDefender were unscathed. 

  • Interested in updating your cybersecurity tools? Check out our guide to the best malware removal tools 

Will McCurdy has been writing about technology for over five years. He has a wide range of specialities including cybersecurity, fintech, cryptocurrencies, blockchain, cloud computing, payments, artificial intelligence, retail technology, and venture capital investment. He has previously written for AltFi, FStech, Retail Systems, and National Technology News and is an experienced podcast and webinar host, as well as an avid long-form feature writer.