Vendor malware: detection limits and mitigation