"mark lewis" 
news:00003009@net396.fidonet.org Tue, 02 Feb 2016 21:52:10 GMT in
alt.comp.anti-virus, wrote: 

> + User FidoNet address: 1:3634/12.73
> http://www.theregister.co.uk/2016/02/02/malwarebytes_0day/
> .. Juicy conversation takes 3 people. 2 talking and 1 to talk

    Malwarebytes updates are not signed or downloaded over a secure
    channel Malwarebytes uses incorrect ACLs allowing trivial
    privilege escalation TXTREPLACE rules are not context aware,
    allowing code inject ACTIONs can result in remote code execution


Tsk tsk. 

Lots of issues. 


    Malwarebytes updates are not signed or downloaded over a secure 
channel
    Malwarebytes uses incorrect ACLs allowing trivial privilege 
escalation
    TXTREPLACE rules are not context aware, allowing code inject
    ACTIONs can result in remote code execution


The apology letter is a '####, you got us, we better fix some of 
this' kind of thing. A slap in your face, basically. Marcin etc, 
crew, knew about ALL of these issues for years. They chose not to fix 
them, intentionally. It's NEVER been a priority or a concern of 
theirs until now. Just so you know.

I know this because I brought these issues, and, several others that 
I consider to be issues to their attention, many times, over the 
course of two years, way back when the company was getting off the 
ground;before they got 'famous' and so cocky with some of those who 
helped them get where they are now.

I was told to pound sand, every single time. Accept the apology if 
you want, I'll laugh as you do. I know it's horse #### intended as a 
PR stunt and nothing more. And, it's only because this has come to 
light and they're getting negative attention about it. They've known 
about these problems for a LONG LONG time. They didn't give a #### 
about it and WOULD NOT BE FIXING IT if it wasn't for some people with 
Project Zero writing about it. They muzzled all of us with NDA 
disclosures. I did mention the database not being protected, but, 
anyone who messed with it in any way was going to quickly discover 
that.. so it's not like I shared a big secret, there.

Point is though, I mentioned it, because it is a big deal. A security 
product shouldn't allow unauthorized database files to be used. It 
shouldn't have ever allowed it. It was brought to their attention, 
not some peon manager who never talked to them, but directly to 
Marcin and Bruce, years ago. NOTHING was done about it.

It's only being taken care of now because it's finally seen the light 
of day, and, some people can see MBAM for what it really is (and 
isn't) now. It's damage control, full swing.

And, Now you see why I don't use/recommend the program, won't 
use/recommend it and only discuss exactly what it is/what it isn't 
(within the confines of my muzzle). I'll have to check into my 
options now. I don't think I can be legally required to protect 
what's now considered to be public information? :)

Yes, I'm gloating, and, grinning like a chesire cat after having read 
that article. I know they could have fixed these problems years ago. 
for an absolute fact. Nothing in the article that's been disclosed 
(so far, hahaha) wasn't already known by anyone who's worked for the 
company outside of sales and 'tech support'. A few (very few, those 
who actually have a coding background, I'll put it that way) of us 
brought these issues to the big chiefs and his trusty side kick 
wannabe coder's attention, many times. 

We were told to pound sand. They had it all under control. Do they 
now? ROFL. I don't think so.

They aren't an Antivirus firm. Their research dept isn't able to deal 
with a real virus. It would have a field day with the poor 
'researcher' who got stuck with the task of trying to analyze it. 
You'd laugh your ####ing ass off, or cry, depending. if you knew what 
the actual 'research' process is for some people. I'll give you a big 
clue: It *doesn't* require a debugger, a disassembler, or, any 
programming knowledge. You can figure out what that leaves you with 
on your own, I suspect. :)

So in closing I've got one final question to those of you who've 
bought licenses to the program, and/or use the program, and, think 
it's uber fantastic, and, i've been pissing and moaning about their 
program without just cause for years? [g] 

Here's the question: 

Does it feel good knowing that you're just another ####ing sheep in 
the herd?


-- 
No officer, I don't know why you pulled me over...
I sure hope you do, though...
My loads late, and, the medication is wearing off.
--- NewsGate v1.0 gamma 2