Researcher shows AV signatures could exfiltrate secrets
A researcher reverse-engineered Kaspersky's macOS AV engine and demonstrated how its signature system could be subverted to detect and flag classified documents.
Sourceobjective-see.org — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2010-3333 as exploited in the wild.
- Date
- The source gives no publication date; the date shown is the day Vorant added the brief.
This research post explores whether an anti-virus engine could be covertly repurposed as an espionage collection tool, using Kaspersky Internet Security for macOS as a case study. The researcher reverse-engineered the kav daemon, identifying how encrypted signature updates are downloaded, decrypted, and dynamically linked into the running process as executable detection routines rather than simple static patterns. By locating an in-memory signature originally designed to detect a CVE-2010-3333 RTF exploit, the researcher was able to subvert it—first via a debugger and then via a remote process memory write using mach_vm_write()—to instead match classification markers such as 'TS/SCI' within documents, causing Kaspersky to flag and quarantine non-malicious files (e.g., a test copy of Winnie the Pooh) containing those markers.
The post further demonstrates patching the executable code of the signature detection routine itself (still without touching the core AV engine binary) to remove file-size and format constraints, broadening detection to any document containing classification markers. The author stops short of testing exfiltration/upload behavior, noting Kaspersky's cloud submission features (KSN) could plausibly upload flagged files, but disabled network access during testing to avoid triggering real uploads.
This is a technical research demonstration referencing prior allegations (unproven, and explicitly not endorsed by the author) that Kaspersky software was involved in exfiltration of classified NSA materials. The piece is intended to illustrate a conceptual security/trust risk inherent to any AV product's signature update mechanism—namely that a malicious insider or coerced vendor could weaponize legitimate scanning/collection infrastructure—rather than to report on any actual observed malicious campaign or exploited vulnerability in the wild.
Mentioned in this report
Detection guidance
1 detection for this report is in the app — an indicator rule with Sigma, Splunk SPL, Elastic, Microsoft Defender XDR KQL, and YARA. Free account, no card.
Source reporting: https://objective-see.org/blog/blog_0x22.html
Free public brief. The indicators and the detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs