Researcher shows AV signatures could exfiltrate secrets

A researcher reverse-engineered Kaspersky's macOS AV engine and demonstrated how its signature system could be subverted to detect and flag classified documents.

This research post explores whether an anti-virus engine could be covertly repurposed as an espionage collection tool, using Kaspersky Internet Security for macOS as a case study. The researcher reverse-engineered the kav daemon, identifying how encrypted signature updates are downloaded, decrypted, and dynamically linked into the running process as executable detection routines rather than simple static patterns. By locating an in-memory signature originally designed to detect a CVE-2010-3333 RTF exploit, the researcher was able to subvert it—first via a debugger and then via a remote process memory write using mach_vm_write()—to instead match classification markers such as 'TS/SCI' within documents, causing Kaspersky to flag and quarantine non-malicious files (e.g., a test copy of Winnie the Pooh) containing those markers.

The post further demonstrates patching the executable code of the signature detection routine itself (still without touching the core AV engine binary) to remove file-size and format constraints, broadening detection to any document containing classification markers. The author stops short of testing exfiltration/upload behavior, noting Kaspersky's cloud submission features (KSN) could plausibly upload flagged files, but disabled network access during testing to avoid triggering real uploads.

This is a technical research demonstration referencing prior allegations (unproven, and explicitly not endorsed by the author) that Kaspersky software was involved in exfiltration of classified NSA materials. The piece is intended to illustrate a conceptual security/trust risk inherent to any AV product's signature update mechanism—namely that a malicious insider or coerced vendor could weaponize legitimate scanning/collection infrastructure—rather than to report on any actual observed malicious campaign or exploited vulnerability in the wild.

Source reporting: https://objective-see.org/blog/blog_0x22.html