More than 200 vulnerabilities found in Trend Micro security products

Security researchers found and disclosed more than 200 vulnerabilities in Trend Micro security products since July 2016. Despite the severity of flaws experts don't foresee lasting damage to the company's brand.

Security researchers Roberto Liverani and Steven Seeley discovered and reported 223 flaws to Trend Micro since July 29, 2016. The vulnerabilities were found in 11 different Trend Micro security products and 194 would be considered critical, allowing remote code execution without user interaction. One issue in Trend Micro Data Loss Prevention could even lead to a full network compromise.

Jon Clay, global director of threat communications at Trend Micro, noted the vulnerabilities were not found in the company's endpoint or Deep Security products.

"Trend Micro takes every vulnerability found within our products seriously regardless of whether it is multiple submissions or a single submission," the company said in a statement. "We know there is a growing interest and level of activity in vulnerability research, and we are dedicated to rapidly addressing any issues that are uncovered by the research community."

Trend Micro told SearchSecurity that its Data Loss Prevention product has reached its official End of Support date and "customers have been advised to migrate to an alternate solution that is not affected."

"It is also important to note that there is no evidence that suggests that any of the proof of concept exploits reported to us were ever used publicly," a Trend Micro spokesperson said. "While vulnerabilities are an unfortunate reality of any software development, we are also working proactively with our R&D teams to address and improve areas in which our development process can be strengthened."

Seeley told Forbes that Trend Micro was quick to respond to the vulnerability disclosures but questioned the company's security audits and said one patch Trend Micro issued "completely failed."

Jon Miller, chief research officer at Cylance Inc., agreed that code reviews should have found the flaws in Trend Micro security products.

"The same methodology that is used to find these vulnerabilities by third parties needs to be completed by the authors before they release the product to consumers," Miller told SearchSecurity. "However it can only happen after the code has been written and normally the priority is to get the product to market."

Chris Eng, vice president of research at Veracode, said his advice to Trend Micro would be the same as he'd give to any software company.

"Security companies should incorporate security into all phases of the development process. That includes training developers on secure coding as well as ensuring security testing is conducted throughout development and certainly prior to release," Eng told SearchSecurity. "Security testing doesn't find 100% of issues, so they should also have processes for responding to vulnerability reports to ensure they communicate transparently with researchers around timeframes for patching."