Joxean Koret
More info
- Country
- Spain
- Known for
- Diaphora, The Antivirus Hacker's Handbook (2015)
Spanish security researcher who showed that antivirus software, with its privileges and its file parsers, is often the most vulnerable thing on the machine.
An antivirus product has to open every file that passes by, in every format, preferably with system privileges. That is close to a textbook definition of attack surface. At SyScan 2014 Koret presented "Breaking Antivirus Software", with locally and remotely exploitable bugs in a long list of commercial engines. In 2015 came The Antivirus Hacker's Handbook, written with Elias Bachaalany. Around the same time Tavis Ormandy at Google started doing the same thing methodically, and the industry got no rest.
Koret also wrote Diaphora, a free IDA plugin for binary diffing: comparing two versions of a program to see exactly which functions a security update touched. It is the standard way to turn a patch into an exploit.