Tavis Ormandy of Google has recently discovered a critical TrendMicro design flaw identified in this bug report - TrendMicro node.js HTTP server listening on localhost can execute commands.
The bug report reads to me like a Stephen King novel of horrors of open ports, remote execution, password vault extraction, and self-signed certs. Travis asked for escalation using the comment "...This is trivially exploitable and discoverable in the default install, and obviously wormable - in my opinion, you should be paging people to get this fixed..."
My question is: in light of the extremely poor design of this fielded antivirus product is it not time to reconsider the value of giving such a product system level access considering the risk of such trust being misused as here? At the very least is it not time for independent certification for products like these?