Forgot your password?
typodupeerror
Security Worms IT

AV Software Isn't Dead, But It's Not Healthy 162

Posted by Hemos
from the i'm-not-dead-yet dept.
dasButcher writes "Is a conventional signature-based antivirus technology dead? Trend Micro CEO Eva Chen says no, but more is needed. Her answer: reputational analysis. Not a bad idea, but many have tried and failed to make this type of approach work. We've seen it all before: RBLs, integrity grading, etc. What will make this different? If we're not careful, Trend Micro might give us all a bad Web reputation. "
This discussion has been archived. No new comments can be posted.

AV Software Isn't Dead, But It's Not Healthy

Comments Filter:
  • by Anonymous Coward on Monday March 26, 2007 @11:32AM (#18488365)
    ...it's just pining for the fjords.
    • by Archangel Michael (180766) on Monday March 26, 2007 @12:09PM (#18488763) Journal
      Whoo-hoo-hoo, look who knows so much. It just so happens that your friend here is only MOSTLY dead.

    • Re: (Score:3, Informative)

      by phoenixwade (997892)

      ...it's just pining for the fjords.

      it's not pinin'! it's passed on! This software is no more! It has ceased to be! it's expired and gone to meet 'is maker! it's a stiff! Bereft of life, it rests in peace! If you hadn't nailed it to the perch it'd be pushing up the daisies! its metabolic processes are now history! it's off the twig! it's kicked the bucket, it's shuffled off its mortal coil, run down the curtain and joined the bleedin' choir invisibile!! THIS IS AN EX-SOFTWARE PRODUCT!!

      (I love the opportunity to make a Monty Python Referenc

  • by Reverse Gear (891207) * on Monday March 26, 2007 @11:34AM (#18488387) Homepage
    I sure am not a big security expert, so forgive my n00bish words here.

    I don't remember where, but at some point I read somebody, probably a sys-admin, saying that if you really want security then what you need to do is disable all the things you do not need. Not by default to allow everything and then pick the things you do not want, but go the other way around and make the default to not allow anything and then enable the things you need.
    I guess this is one of the reasons I like Gentoo so much, I know everything that is installed on the system and I can remove it if I don't like it.
    I don't like to install all kinds of things that I do not know what is and do not know if I can trust. The more things I have installed the more vulnerabilities I also have.

    One of my friends once ran a version of Windows XP that he had pretty much scraped everything of that didn't need to be there, I think he was a lot more secure than he would have been had he filled his computer with all kinds of AV and anti-malware programs, some of them seem to be causing more problems than they solve anyhow.
    • by khasim (1285) <brandioch.conner@gmail.com> on Monday March 26, 2007 @11:48AM (#18488541)
      #1. There is no security without physical security.

      #2. Run only what you absolutely need.

      #3. Run it with the minimum rights possible.

      The reason that Trend Micro's "new" approach will fail is ... rather long. Follow along for a moment.

      a. Vulnerability is found and exploit is written.
      b. Exploit needs to be distributed.
      c. Exploit is distributed via a quick spam flood - they have no protection against this.
      d. Exploit is posted on a web site - how do the bad people drive traffic to that site?
      e. They use a compromised site. They hide the exploit in a directory that robots.txt says not to scan. Either Trend Micro violated robots.txt or it cannot find the exploit.
      f. So Trend Micro will have to violate robots.txt and that behaviour should be noticeable. So the bad guys would hide that file from something that looks like a webcrawler that doesn't respect robots.txt.

      And we're back at the beginning.
      • by voice_of_all_reason (926702) on Monday March 26, 2007 @12:09PM (#18488767)
        #1. There is no security without physical security.

        Hire a bodyguard to stand over your ethernet jack, then chase down and beat interlopers with a nightstick? I like the way you think...
      • by shmlco (594907)
        You forgot #4. Develop smarter systems.

        In particular, outware facing software like mail clients and web browsers and feed-readers should automatically run with minimum rights (no matter what the user's rights) AND be sandboxed or virtualized such that malicious entities and hacks have no where to go.

        In addition, any files saved across the boundary are automatically scanned and, if possible, validated. You may not know what some unknown virus signature looks like, but you sure as heck ought to know if an Ex
      • The reason that Trend Micro's "new" approach will fail is ... rather long. Follow along for a moment.

        a. Vulnerability is found and exploit is written.
        b. Exploit needs to be distributed.
        c. Exploit is distributed via a quick spam flood - they have no protection against this.


        Actually, they do. That's part of why the approach is novel.

        d. Exploit is posted on a web site - how do the bad people drive traffic to that site?
        e. They use a compromised site. They hide the exploit in a directory that robots.txt says no
      • The Common Criteria configuration of Windows XP disables 56 unneeded services. However, the process list only shows 37 after the default install. So Windows is running a huge heap of shit that most people don't even know is running and which are impossible to stop by normal means.

        So, how did your friend disable all those things???
    • Re: (Score:3, Informative)

      by truthsearch (249536)
      At the last place I worked, the IT department had their own XP distribution for the corporate desktops (ghost script or whatever). They started the process by deleting one DLL at a time and watching what broke. The problem was when my team created some new custom software we'd sometimes come across some fundametal problems because DLLs were missing. And these errors weren't always easy to track down.

      Now you might say we'd run into this problem with any operating system. But when using Microsoft developm
      • by Intron (870560) on Monday March 26, 2007 @12:13PM (#18488823)
        Deleting DLLs is not the right way to "minimize the system". What you want to do is turn off unneeded services, not blow holes in your OS. Linux would fail just as badly if to turn off services you started deleting the contents of /usr/lib instead of disabling daemons in /etc/init.d.
        • I think what he's getting at is that, for Windows, all of it's libraries have to be in place for it to be a functional system, whereas for linux, many libraries can be removed from the system without compromising functionality.

          In the old days, they used to say, "Never install compilers, because if someone cracks your system, then they can use them to generate rootkits, etc." I still here people spouting that line, but the truth is, if they crack your system, they can bring those things in themselves, withou
    • My old man has a dieing windows98 system that he refuses to upgrade. It has a 3dfx vodoo1 card and the whole 9 yards.

      Anyway guess how many times he had to reinstall windows98 during the last 6 years? 0!

      Yes if you do not actually do anything but browse the web with firefox and occasionally run excel and word you will be fine even with the old win9x codebase.

      Linux at least does not have this issue due to the nasty registry entries.
      • It's quite amazing how uninfected most people's computers are when they get rid of the crap they don't need and start using Firefox & a few extensions. I've got an IBM Thinkpad T20... it's a P3 533MHz, 256MB RAM, 12GB hard drive, 4MB S3 Video.. it's a beast I know.

        it had Win98 on it when I got it back in 2000, I put Win2000 on it, and later XP once SP1 came out... after installing XP the DVD drive died... I use it for browsing, streaming media from my desktop, car diagnostics on track days, as well a
    • by danpsmith (922127) on Monday March 26, 2007 @11:53AM (#18488585)

      One of my friends once ran a version of Windows XP that he had pretty much scraped everything of that didn't need to be there, I think he was a lot more secure than he would have been had he filled his computer with all kinds of AV and anti-malware programs, some of them seem to be causing more problems than they solve anyhow.

      I think you are right in this thinking. Windows XP's services that are enabled by default are ludicrous. That's one of the main security problems with XP. What I don't understand is why someone doesn't just allow the computer to start with absolutely no services enabled, and then gradually ramp up to what the computer actually needs, turning services on only as they are needed.

      For instance, shutting down a service might make a certain set of USB gadgets might not work. But when you plug the USB device in, Windows itself (or the OS itself) could recognize that the service is needed for the device to function and automatically enable the service. Depending upon how much this costs it could automatically disable the service again if it isn't being utilized by anything else.

      Maybe I'm being naive, but that doesn't seem like too much to ask. On really strange services you could prompt for password information in order to ramp up the ability to use them or something. Makes sense to me.

      It seems to me that windows has everything enabled by default to be user friendly. But couldn't you do the same thing using this method? Instead of having a bunch of running services running at idle constantly, turn em on when you need em.

      • Hey, what a great idea! [apple.com]
      • by Tanktalus (794810) on Monday March 26, 2007 @12:31PM (#18489143) Journal

        Er...? You've disabled IIS. The OS detects an incoming request on port 80. It enables IIS. Attacker leaves behind malware. IIS goes back down.

        Other than that, I like your idea. If, for example, when it detected a service was needed, it popped up a nice dialog box saying something like, "Windows has detected an incoming request on port 80. is currently disabled. Enable? [ ] Don't ask this again. [Yes] [No]". And then, here's an important bit, if no response is detected within 30 seconds, assume "No", and continue. And log this in the system log. Maybe even email it to the user so they see it. (The email wouldn't happen for requests that were marked "Don't ask this again".)

        I'm pretty sure a similar concept on Linux could apply - even if there's no user interface, just logging what comes in. In fact, I suspect some people have already set up iptables or ipchains or whatever to do exactly that: log all "intrusion" attempts. With a bit of work, I'm sure that some ports could be emailed (say, by default), with some trivial manner of masking ports (analogous to the "Don't ask this again" from above) to not receive notices about that port anymore. Possibly with netmasks - email me if someone comes in on 443 from 192.168.0.0/255.255.255.0, but not anyone else (ignore https requests from the internet completely).

        In fact, I'm pretty sure someone has something like this already ... probably on sourceforge by now ;-)

      • Re: (Score:3, Insightful)

        by laffer1 (701823)
        At first, this sounded like a good idea. Consider though that the OS still needs to have code to detect what the USB device is. So windows must see hey i've got a USB mouse or whatever and then load the service for it. That means the service is started later after scripts have time to bork the environment, and many services common on desktops will get triggered eventually anyway. So an attacker or rather his script may have to wait some time to get his malware executed but it will still occur. Since th
      • by bendodge (998616)

        But when you plug the USB device in, Windows itself (or the OS itself) could recognize that the service is needed for the device to function and automatically enable the service.
        Just set the service startup type to Manual and it will do that.
      • by Foolhardy (664051)
        For one thing, since Win32 doesn't have setuid, it uses a privileged local service for such programs instead. A lot of the services are local only. Something like a device support service would naturally be local only. Of the remotely reachable services that start automatically by default in XP SP2, they either can't be turned off or are indeed on to be convenient.

        Windows NT was designed for LANs in which a central authority can control all the computers and ask them for information, so the Local Security
    • Re: (Score:2, Funny)

      by stratjakt (596332)
      Gentoo just crapped its pants on me in the middle of an "emerge -uD world", and now the box is borked. Won't boot, not even in single user mode. Reinstallation is a multi-day affair. Fuck that. At least you can flatten and rebuild a windows box in an afternoon.

      But boy is it secure, it cant even spawn a tty.
      • Well if you want to reinstall then that I am not going to stop you, but repairing a messed up installation usually isn't that hard if you know a bit about the system or go get a bit of support on the Gentoo Forums [gentoo.org].
        Just use a bootable CD and chroot into the system and get whatever fails on you fixed.
        If it is a hardware failure then that is something totally different and it should not in the first place be blamed on Gentoo (even though compiling can be tough for the HD)
    • by brunascle (994197)

      I don't remember where, but at some point I read somebody, probably a sys-admin, saying that if you really want security then what you need to do is disable all the things you do not need.
      not sure who said it first, but this month's Linux Journal attributed this quote to Marcus Ranum [ranum.com]:

      that which is not expressly permitted is forbidden
      • by sconeu (64226)
        I believe that one's from E.B. White's "The Once and Future King" when the Wart goes with the ants.
    • by Moofie (22272)
      "I know everything that is installed on the system and I can remove it if I don't like it."

      How do you know whether to like it or not (from a security perspective, that is)?
  • by zappepcs (820751) on Monday March 26, 2007 @11:34AM (#18488391) Journal
    We need a new word to deal with this technology:

    Webutation; The reputation an entity has, stemming from its web presence.
    • Ooh, lets patent it! Don't tell the slashdotters though, they might get mad...

      *looks around*

      *runs*
    • Somebody slap zappepcs, please. :)
    • I suggest the phrase "online reputation" instead.

      I'm esick to ideath of words being made up to describe the same old thing only ONLINE ZOMG!!!1!

      • Re: (Score:2, Funny)

        by Xtravar (725372)
        Brilliant! Let me have a try!

        I'm e-sick to iDeath of WRDZ being webhanced to .Sell morenet of the360 blueSame VoIPOOP.

        JAVA!!!
    • by DeadChobi (740395)
      And then we can coin a new word for the security journal of this era! We'll call them "Webutationlog" or Weblog for short. It'll be brilliant and not at all stupid-sounding!
  • Trivial answer! (Score:5, Insightful)

    by VincenzoRomano (881055) on Monday March 26, 2007 @11:40AM (#18488459) Homepage Journal

    Is a conventional signature-based antivirus technology dead? Trend Micro CEO Eva Chen says no.
    If you ask an Oil company whether oil derived fuel engines are dead, they'll answer the same way.
  • by Anonymous Coward
    If eople want to use reutational analysis on this roblem, there's lenty of others I'd ersonally trust over Trend Micro.

    Oh the stories I could tell as a former emloyee of this comany. Not only the missing "p" problem; there was the time they used a telephone number as a phishing signature (too bad it was the actual phone number of one of the largest banks in the US--and that all that bank's legitimate email to customers was trashed)--that was one big account they lost the next day. Or what about the time tha
  • by Billly Gates (198444) on Monday March 26, 2007 @11:47AM (#18488537) Journal
    AV software is alive more than ever thanks to crackers on the internet and buffer overflow malware ads on webpages.

    PRoblem is the software is not healthy indeed and can screw up a whole system. ITs like their approach to neutralizing a hammer is to encapsulate the whole thing. Every i/o transaction is read and maybe even virtualized.

    Does it stop virii? Hell no. I worked help desk at a gaming company which uses the IE sdk for some code on the logon screen. Anyway it wont load if any viruses or keyboard monitoring programs are installing which use the IE sdk. I get many callers saying "WTF. I have norton. What do you mean my system is infected!?". I then clean the system with some cheesy app that is not an antivirus program.

  • by Alioth (221270) <no@spam> on Monday March 26, 2007 @11:48AM (#18488543) Journal
    Funnily enough, I just wrote about this:

    http://slashdot.org/~Alioth/journal/167405 [slashdot.org] - includes a link to a major study of a piece of malware which went undetected by the AV companies for months.

    Or just go to http://www.secureworks.com/research/threats/gozi/ [secureworks.com] if you don't want to read my crap.

    I've personally witnessed two malware infections where the malware arrived up to a week before the AV companies had updated their definitions.
    • Two times, I've observed that the opensource AV software ClamAV [clamav.net] nailed new email virii
      about 6 and 12 hours before the commercial alternatives got signatures for them (3-4 examples, names left out to protect the guilty).

      Of course, this doesn't always happen, but it's still an interesting observation.
  • Botnet (Score:3, Funny)

    by daeg (828071) on Monday March 26, 2007 @11:51AM (#18488575)
    So to defend against botnets, Trend Micro will make a massive spidering botnet capable of indexing and cataloging 100 million domains. If Morissette were available, I'd quiz her if this situation qualifies as ironic.

    So help me if they don't honor robots.txt.
  • by starseeker (141897) on Monday March 26, 2007 @11:53AM (#18488591) Homepage
    At a certain point, networking requires trust in order to realise it's potential benefits. Open source wouldn't work if everyone had to read every line of source code before running a program, so various organizations and projects develop trust and reputations. We know Debian, Fedora, Gentoo, etc. are OK and can proceed to use them with minimal trouble. A brand new Linux distribution must climb that hill, in addition to providing sufficient incentive for people to find out if they can be trusted. That's tough.

    The anonymous nature of the web is what allows things like virus writers to succeed - if they couldn't hide, they wouldn't assume the responsibility for what they're doing (well OK a few nut cases would, but the same is true in real life.) However, forcing unique identities on people opens up a host of other problems, some of them more serious than the ones we have today.

    So we must operate in the twilight world of making networks which cannot be successfully attacked by bad actors. There are a wide variety of intermediate solutions, like today's anti-spam techniques, wikipedia's system and even slashdot's own moderation system. But none are perfect and none can be perfect - the problem is not solvable in general. Open source actually helps this in one major way - the community controls that operate in the real world to keep human social systems functional also operate (to some degree) in small scale projects. There the individual traits of interested parties become known over time, and recognition and trust can be built up based on more than just a name or email address. It is not perfectly robust, but then no system to date has been.

    Virus problems will continue as long as there are people wanting to write viruses, as they are simply an electronic version of spray painting walls, defacing monuments, or other useless and harmful activities that have persisted since the beginnings of civilization. We must rely on community, the most robust tools we can devise, and (finally) building our own web of trust based on things we have found to work. These issues are fundamental to the human condition and (like all social problems) cannot be resolved by technology. The fact that spam emails can be identified at all, for example, is really just an indication of the lack of skill of spam writers. Likewise, someone really wanting to distribute a virus can just make a freeware program that actually does something real and useful long enough to build a reputation, and then when it is widely distributed trashes every system it is installed on. There are always ways to attack a target, if enough effort is put into the planning. The trick is to be fault tolerent and recover quickly. In specific cases better security can be achieved (classified information, etc.) but for the general case it will always come down to dealing with the consequences of antisocial behavior as it happens.
    • Re: (Score:3, Interesting)

      At a certain point, networking requires trust in order to realise it's potential benefits... We must rely on community, the most robust tools we can devise, and (finally) building our own web of trust based on things we have found to work. These issues are fundamental to the human condition and (like all social problems) cannot be resolved by technology.

      I agree with most of your comment, at least in principal. I think one of the most important ways the industry needs to jump if it is going to make the malware problem a minor inconvenience or a rarity, is to build tools to harness the intelligence and trust of others, be they communities, formal organizations, or commercial enterprises.

      OS's need to start relying upon the amount of trust given to a piece of software or network service and restricting them appropriately based upon that level of trust. Chan

    • by Phroggy (441)

      Virus problems will continue as long as there are people wanting to write viruses, as they are simply an electronic version of spray painting walls, defacing monuments, or other useless and harmful activities that have persisted since the beginnings of civilization.
      Sure, that used to be the case. Now, I think most viruses are delivery agents for botnet software that can be used to send spam. It's all about the money now, and botnets are where the money is.
    • Virus problems will continue as long as there are people wanting to write viruses, as they are simply an electronic version of spray painting walls, defacing monuments, or other useless and harmful activities that have persisted since the beginnings of civilization

      A nit-pick with an otherwise interesting comment: very few virus writers are doing it for fame and 1337ness points these days. They're here for the money. Anyone capable of writing an effective virus (and who doesn't mind dealing with full-on criminals) can cash in quite successfully.

      • nit-pick with an otherwise interesting comment: very few virus writers are doing it for fame and 1337ness points these days. They're here for the money.

        Amusingly, the same an be said for graffiti to some degree. More and more graffiti is corporate sponsored advertisements, from Sony or MS or some hip clothing label.

    • Virus problems will continue as long as there are people wanting to expand the definition of "virus"

      Fixed it for you.

  • Wont work (Score:2, Interesting)

    by cyberbob2351 (1075435)

    The newly released OfficeScan 8.0 will include endpoint security features that will block access to Web sites that have a reputation as sources for malicious activity.

    Considering the fact that the infestation could be due to either a worm infection, or could come about by accessing a webserver that is in actuality a compromised botnet drone, how on earth is such a reputation system supposed to be effective?

    Most of your issues will not come from the same sites over and over. The only exception to this is crack and warez sites, but we already have similar reputation systems implemented.

  • All it takes is for a user to get pissed off at your software and mark it down on the list for the ball to get rolling. Same thing applies to spam. I know people who cannot be bothered to unsubscribe from mailing lists. Instead, they just mark it all as spam, not even caring that they signed up for the stuff in the first place!
    • Why reputation-based approaches suck big time. All it takes is for a user to get pissed off at your software and mark it down on the list for the ball to get rolling.

      Having multiple, competing commercial and free sources for information, preferable with a user definable weighing system, solves that problem. Users who have to deal with incorrect information move to more accurate services, or weigh them more heavily. Capitalist competition can work here, unless MS creates the system, then you will locked in to just their data, which will suck.

      Same thing applies to spam. I know people who cannot be bothered to unsubscribe from mailing lists. Instead, they just mark it all as spam, not even caring that they signed up for the stuff in the first place!

      This is a usability problem, not an inherent problem with reputation based systems. If it was easier for users to unsubscribe

  • ... otherwise there would be no syphilis in the world.

    Seriously, there is a pretty direct analogy between (digital epidemiology, computer viruses) and (real epidemiology, real germs). If there were a simple answer to the digital problem, it's a good bet that some population or other would have adopted the analogous strategy to the real epidemiology problem.

    STDs offer a good analogy for digital viruses with a Trojan-style (no snickers, please) strategy. In both cases sharing of {data|fluids} yields immediate benefit at some risk. In both cases, populations have adopted reputational strategies to avoid spreading/contracting viruses. In neither case do those strategies work.

    Even with near-perfect "antivirus software" (the antibiotic penicillin), the old monsters of syphilis and gonorrhea still remain on the planet, and penicillin-resistant strains have even evolved. One problem is that reputations are hard to establish and not necessarily accurate; another is that most humans tend to discount future risks in favor of immediate benefits.

    Interestingly, the reason that the traditional venereal diseases are treated with penicillin injections (and not an oral course) is that, statistically, patients are unlikely to finish the oral course -- a properly completed oral course of penicillin is as effective as the traditional three injections. There is perhaps a lesson to be learned there about how effective corporate data-hygiene strategies are likely to be.
  • by sammy baby (14909) on Monday March 26, 2007 @12:12PM (#18488807) Journal

    What will make this different? If we're not careful, Trend Micro might give us all a bad Web reputation.


    (Sung to the tune of "Bad Reputation", by Freedy Johnston)

    I know, I've got a bad reputation:
    and it isn't just W32/Delbot.
    If I could only keep this damn malware
    out of my inbox.

    I could have had a normal conversation,
    if it wasn't for this firewall.
    If it deletes zip files with passwords,
    then they're worth fuck-all.

    Suddenly, my mail gateway is hosed,
    malware is being
    installed by the truckload,
    keeps breaking down.
    Can you help me now? Can you help me now?
    • (Sung to the tune of "Old MacDonald", traditional folk song)

      sammy baby put too many syllables
      In the lines of the parody lyrics
      And when a reader tried to sing them
      All he got was frustrated
      • by sammy baby (14909)
        Pshaw. If there are too many syllables, surely you're just not singing them fast enough.

        Do some crank, try again, and call me back with your results.
  • by mpapet (761907) on Monday March 26, 2007 @12:14PM (#18488835) Homepage
    Why, in this day and age, are we having a conversation about anti-virus anything?

    Instead of accommodating Microsoft's severely broken security model, now updated with "are you sure you want to do this?" Just flush that windows partition and install your linux distro of choice, or install linux on the PC and give it away, or get a Mac.

    No, sysadmins like me won't be doing this at work anytime soon. Ever since I told family and friends who needed computer support I won't fix windows and gave them the option of buying a mac or switching to Linux, I'm having much more fun on my days off.

    The extra benefit is I don't have to discover some of the ummm, unusual, tastes-and-preferences in my friends cache.
    • Why, in this day and age, are we having a conversation about anti-virus anything?

      Because with mass installations of Linux distros, we'll still be facing the same problems -- just with a different OS. Don't think that Linux has no holes.

      The biggest security advantage wrt viruses etc that Linux has now is small market share. If 90 % of the world used Linux, then I'd bet that *Windows* would be effectively (not inherently) more secure than Linux.

      I'm sure that Windows is inherently less secure than Linux --

      • If 90 % of the world used Linux, then I'd bet that *Windows* would be effectively (not inherently) more secure than Linux.
        But that doesn't mean the advice is bad. If 33% of people used Linux, 33% MacOS X and 33% Windows then we'd no longer have an OS monoculture and it'd be harder for viruses to spread than if 95% of machines ran the same OS.
        • You're right, but would this change in install base mean that discussing AV is pointless?

          AV will always be necessary, and the more it's discussed, the better - particularly when it needs to adapt to changing malware techniques.
      • The biggest security advantage wrt viruses etc that Linux has now is small market share.

        Wrong.

        Windows security model and the *nix security model is a false analogy. In no way are they comparable.

        Instead of making false analogies, why don't you install a Linux distro and discover all of the benefits of running a sensibly designed, though hardly perfect, OS. Yes, you trade anti-virus subscriptions, anti-spyware software and Microsoft treating you like a criminal with their WGA software for some hardware inc
        • Are you claiming that the Linux security model is unbreachable and, if adopted by everyone, will obviate the both need for AV and the need for discussions about AV?

          As much as Linux's security model is better than Windows', the need for AV will never disappear.

          Analogy? Where is there an analogy? There is simply a comparison, which is something completely different.

          Do they compare equitably? No, as I state in my OP, which you simply ignored.

          Does market share, and therefore targeting of malware affect
        • by drsmithy (35869)

          Windows security model and the *nix security model is a false analogy. In no way are they comparable.

          True enough. From a technology perspective, the Windows security model is superior in pretty much every measurable way.

          However, the important point is this: viruses very rarely exploit holes in either the security model or even bugs in the software. The most prominent vector for virus infection is the end user.

          So long as people can run arbitrary software on their computers, the "virus problem" will exi

      • Because with mass installations of Linux distros, we'll still be facing the same problems -- just with a different OS. Don't think that Linux has no holes. The biggest security advantage wrt viruses etc that Linux has now is small market share. If 90 % of the world used Linux, then I'd bet that *Windows* would be effectively (not inherently) more secure than Linux.

        I think you're dead wrong on all points. Sure Linux benefits from having a small market share, but that is not the main factor. The biggest problem with Windows security is that MS has a monopoly on desktop OS's. As such, MS has no real motivation to respond to and solve users' security problems. When a user's Windows box gets infected, they don't look at other options because every computer in the store is running Windows. If somehow the user finds out about Linux, the chances are they still have to buy

        • by drsmithy (35869)

          It would matter a great deal because Linux would adapt to solve the problem by adding layers of security and granularity of security and new services and technologies. Signing, certification services and blacklists, MACLs, active scanning, whatever it takes Linux developers would do it because those developers have a direct financial interest in securing the boxes. MS has no such financial incentive.

          Your theory does not align with reality.

          (If it did we'd still all be using DOS and Windows 3.1, Windows 95

    • by Mister Whirly (964219) on Monday March 26, 2007 @01:16PM (#18489787) Homepage
      "Ever since I told family and friends who needed computer support I won't fix windows and gave them the option of buying a mac or switching to Linux, I'm having much more fun on my days off."

      Walking my family through command line installs of libraries and helping them chmod permissions so they can access the files they saved. I love the fact that all my dumbshit realtives are now running Linux, I mean who needs time off on weekends anyways!!! Now when my mom wants to install a new printer, insead of just plugging it in, now we get a 3 hour long session fighting with generic Gimp drivers and it still won't print 100% correctly. And my parents were really stoked that the thousands of dollars they had spent on Windows software was now mostly worthless! Yep, if there is one thing Grandma really loves digging into it's compiling her own Linux kernel - she really just can't get enough of it! All and all I'd say that an OS designed for geeks who really love tinkering with their systems is working out terrific for the average computer illiterate masses...
      • I agree that moving files over is a minor issue. But, the other stuff is pure flamebait.

        Walking my family through command line installs of libraries
        Your printer remarks are equally suspect.


        ...thousands of dollars....
        THOUSANDS of dollars on software for the typical email/browser/occasional document machine? Are you serious? If you are, then it's not my fault they overpaid.

        • Have you ever tried to give support to a technical newbie who decided to "try Linux out" on a suggestion from one of his geek friends?? I have, and it was hell - much more hell than any of my "Windows people" ever throw at me. As stated in my post, Linux is great if you really like knowing the inner workings of an OS and you like to tinker. But 99% of the people could care less how it works and hate to tinker. Windows (or even OS X) are the more logical choice for such people. Claiming anything else is flam
    • Sys admins like *me* prefer variety and get a little tired of the messiah complex some people have regarding religious OS of [choice].

      Blaming Windows on security problems cart-blanc seems pretty ridiculous (they get credit, but all the credit?). Especially right before jabbing them for improving it a little (it's annoying, but *as* a systems admin I'm sure you know the security/usability trade-off).

      Do you think because Linux distro's do things slightly differently that with mainstream adoption they woul
      • by mpapet (761907)
        o you think because Linux distro's do things slightly differently

        The security models are _not_ comparable. At all. Yes, Microsoft is trying to emulate unix-ish security model on the surface, below that the whole Microsoft security objects model is a complicated mess that culminates in "Are you sure you want to do this?"

        Blaming Windows on security problems cart-blanc seems pretty ridiculous (they get credit, but all the credit?).
        While they are running on 98% of all PC's yes, I give them all the credit.

        I ce
        • So you think your family/friends would go from using Windows with no security to using Linux better? Because Linux distros install no unneeded services by default? And of course your computer challenged friends will then be sure to apt-get update/yum update/etc and they'll check their crontab to be sure freshclam is running nightly.

          You can get all pissy with me if you want. My horizons won't be hurt. I work with what you advocate every day. I just don't particularly care for that unrealistly cavalier atti
      • Blaming Windows on security problems cart-blanc seems pretty ridiculous...

        I disagree. Almost all major or widespread security problems are the result of Windows and their domination of the market and the fact that because of their monopoly they have no financial incentive to fix the problem, while they are the only ones in the position to do so.

        ...but *as* a systems admin I'm sure you know the security/usability trade-off...

        As a person with extensive experience in both usability and security, I call BS on this. The idea that usability and security are inherently opposed is tripe. Security is making sure the computer only does what the user wants and not

        • I'd go with that. But the problem I have here is the simple fact that *this* is the current reality. The previous poster seemed to believe that forcing people not to use Windows/Vista was the solution. But people are using it and will continue to.

          You are probably correct to assume there would be a different response to security if it was in the hands of the larger community. But things can get thorny there too. Q&A (which slows down the release cycle). Project forking. Compatibility. Right now Linux i
          • But the problem I have here is the simple fact that *this* is the current reality.

            There are avenues for change. One is the courts acting to stop MS and fix the market. Another is MS's monopoly eroding as Linux takes the business world and/or OS X grabs a big chunk of the home user market. We shall see.

            You are probably correct to assume there would be a different response to security if it was in the hands of the larger community. But things can get thorny there too. Q&A (which slows down the release cycle). Project forking. Compatibility. Right now Linux is good, but it's hard to know what the mainstreaming (if Linux was ready) of Linux would result in. Dumbing down? Certainly. Some concessions to security for convenience? Likely.

            I have a lot of faith in the power of greed. If Linux were in use by everyone, it would fork in a hundred directions and companies would be investing in it in order to get their slice of the money people pay for a computer system and accompanying services. The thing is, all the forks a

            • by msimm (580077)
              I have no argument for any of these points. Better security would be beneficial and you're right, it *can* enhance usability (it doesn't always, but it can). But my argument was with the original posters rather narrow view that Windows was bad (his refusal to help family/friends who used Windows?) and Linux or Mac was better (sure, in some cases, but *today*, across the board?).

              But if we moved into the possibility of Linux taking share, why not flip the coin? What do you think Microsoft would do? Wouldn't
        • by drsmithy (35869)

          I disagree. Almost all major or widespread security problems are the result of Windows and their domination of the market and the fact that because of their monopoly they have no financial incentive to fix the problem, while they are the only ones in the position to do so.

          Almost all the widespread security problems on Windows can be narrowed down to end users doing the wrong thing.

          As a person with extensive experience in both usability and security, I call BS on this. The idea that usability and securit

    • Unfortunately malware will be with us as long as we have the mark 1 human sitting in front of the keyboard. All the attacker has to do is convince the user to install $evil_binary and boom, game over. If you've got a patch for human stupidity, send code!
  • AV are Dead (Score:2, Informative)

    by smist08 (1059006)
    I stopped realtime scanning when I realized that over 50% of my CPU was going to scanning virus's. Now that it is turned off, things run much faster. E-mail seems to be the main source of virus's, but most email servers scan for virus's so doing a local realtime scan is just a waste of time. Otherwise just avoid memory keys, and disks which is fairly easy. I find Spyware a bigger problem than virus's but just running Spybot every now and then to clean off things installed by other software like webcams seem
  • SiteAdvisor (Score:2, Interesting)

    by Strilanc (1077197)
    Wow, this is the same thing as Site Advisor; except it doesn't warn you about bad websites, it just tells you to fuck off. How hard could it be to modify the site advisor extension to do that?
  • by Animats (122034) on Monday March 26, 2007 @01:54PM (#18490419) Homepage

    If all the effort spent on security approaches we know won't work, like looking for known attacks, were spent on approaches that can work, like fixing operating systems and applications so external content runs in jails that work, and developing reliable means for sanitizing content, we'd be much further along.

    Think about it. Symantec is a billion dollar company selling a product that barely works. Nobody is spending that kind of money making operating systems more secure.

    The problem with all this so-called "virus security" is that it's aimed against bulk attacks that are mostly annoyances. It won't detect focused attacks aimed at a business or government site intended to steal serious money or information.

    Military security people are trained to make that distinction. Some effort has to be devoted to chasing off kids throwing rocks over the fence, but they're not a real threat. The real threats are subtle, until it's too late. The commercial computer security industry does not get this at all, and doesn't want to.

    • Screw AV it's dead end. Take all that time and resource and brainpower and focus on making the OS stronger and hackproof. Windows has become a titanium armored soldier with seriously bad heart disease. Making the armor stronger isn't going to help anything in the end.
      • Screw AV it's dead end. Take all that time and resource and brainpower and focus on making the OS stronger and hackproof.

        There are two items to address with your comment. First, only MS can secure the OS and they have little incentive. Lots of commercial companies have a financial interest in solving the malware problem, but they cannot fix the core of the OS as you propose. To solve this, we need to fix the broken, monopolized desktop OS market.

        Second, I don't think AV services are a dead end. Rather, I see subscriptions to information feeds about software, both blacklists and whitelists and more advanced variations there

        • by gelfling (6534)
          No in terms of a client only solution it's a dead end. Any of you are relying whether you recognize it or not on, a desktop firewall, an AV scanner, a spyware scanner, a local router, an ISP that scans 'something' or maybe a corporate LAN with its own perimeter and/or email protection. The fact that you are not egregiously harmed on any one day is indicative of all the other work and horsepower that goes on behind the scenes.

          And in case no one's been noticing, scheduled batch scans of AV or spyware tools no
          • No in terms of a client only solution it's a dead end. Any of you are relying whether you recognize it or not on, a desktop firewall, an AV scanner, a spyware scanner, a local router, an ISP that scans 'something' or maybe a corporate LAN with its own perimeter and/or email protection. The fact that you are not egregiously harmed on any one day is indicative of all the other work and horsepower that goes on behind the scenes.

            I agree that it is not the only place efforts should be focused, ideally, but neither is it something we should abandon. In future I still suspect there will be honeypots and honeynets and large scale scans, but the main use of AV type services will be when a client runs an executable. After all, that is the only time it can really do any damage. A quick check of just that executable against the blacklists and whitelists and whitelists with accompanying restrictions, certification, and recommendations. Th

      • by Tim C (15259)
        focus on making the OS stronger and hackproof

        Imagine that I am a user with the admin password and a pressing need to download and install CometWeatherBonziCursorBuddyBug. Please explain to me how the OS can prevent me from infecting it with the virus and/or trojan that came along with the installer.

        I get a lot of spam - and by "a lot", I mean a couple of thousand items a day. A small proportion have viruses attached. Some of these viruses are .pif files, some are .scr (screensaver, but essentially any old e
        • by Animats (122034)

          The problem is the whole concept of "admin access". What's needed is more mandatory security. Something like this, which is what NSA calls "mandatory security".

          Every file, program, etc. has a "security level" and "security compartments", and "integrity level" and "integrity compartments". Information can only flow into (not out of) a security compartment, upward in security level, and downward in integrity level, unless it's passed through a trusted program that "sanitizes" it.

          Browsers should be div

      • by drsmithy (35869)

        Screw AV it's dead end. Take all that time and resource and brainpower and focus on making the OS stronger and hackproof. Windows has become a titanium armored soldier with seriously bad heart disease. Making the armor stronger isn't going to help anything in the end.

        AV isn't there to stop stuff getting past the armor, it's there to stop stuff that has gotten past the armor. It's an integral (and inescapable, assuming you want computers to remain general-purpose machines) part of a properly configured, l

    • Re: (Score:3, Insightful)

      by OriginalArlen (726444)

      Think about it. Symantec is a billion dollar company selling a product that barely works. Nobody is spending that kind of money making operating systems more secure.

      Now far be it from me to defend the great satan, but to be fair Microsoft have spent a lot more than that on improving security since Bill "got it" and sent his memo back in, what was it, 2003? They still haven't trained themselves to make the right call when it comes to usability vs functionality (see UAC, and so on and on) but Vista is a lot more secure out of the box than XP SP2 - which itself was an improvment over 2000. (Which, admittedly, was worse than NT4 which was worse than 3.51, but that's besid

    • Think about it. Symantec is a billion dollar company selling a product that barely works. Nobody is spending that kind of money making operating systems more secure.

      Symantec is a billion dollar company spending money to make money. MS has not such motivation to fix their OS since if it is insecure, people have to buy it anyway... it is the only thing in Walmart or K-mart or 90% of all stores.

      The real threats are subtle, until it's too late. The commercial computer security industry does not get this at all, and doesn't want to.

      The commercial "security" industry has given up Windows as a lost cause. No credible security person who wants a secure server or workstation considers Windows a viable option. There is plenty of work being done on real security, like SELinux based solutions. The problem is yo

  • Two Words ... (Score:3, Interesting)

    by malcomvetter (851474) on Monday March 26, 2007 @05:56PM (#18493871)
    ... Default Deny.

    We have seen it in firewalls. We have seen it in military-grade physical security. We have seen it in banking. But, why, oh why, do we not see it with malware?

    [Analogy warning] About the best analogy I can come up with that describes just exactly how modern anti-[virus, spyware, threat du jour, or just plain "malware"] is this: Enterprises and home users are outsourcing the task of determining the trustworthiness of software applications that reside on their computers. However, they are forcing the outsourcers (the AV companies) to work both backwards and blind. "Blind" in that the outsourcers are not allowed access to see what applications are actually running within the trusted computing environments (or how well those applications play with others (do they run with scissors?)) and "Backwards" in that the outsourcers are not allowed to simply identify trustworthy software applications-- they're forced to identify the good by ruling out everything that is bad. And we all know that "good" and "bad" are in the eyes of the (ahem) beclicker. [End analogy]

    What we need instead is a serious set of solutions (and some are starting to crop up, but I won't cite any because I cannot vouch for their quality) that work in the POSITIVE direction, and not the NEGATIVE direction. In other words, we need anti-malware that simply inventories known good applications, comparing all code execution requests against the guest list before letting them get CPU resident. Assuming that code injection techniques (e.g. buffer overruns) can be quelled by other means (microkernels, randomized memory addressing, read only data memory, etc.), then the likelihood of malware infection with a Default-Deny approach (deny all applications except those on the guest-list/inventory) would dramatically approach zero.

    The real problem is ... economics. Anti-[threat du jour] vendors work on subscriptions because they can check for subscriptions before issuing malware signatures (it's the whole incentive concept we see all over again). But, there is no incentive for the customer to check in with the vendor if their tool is just installed and doesn't need re-configuring until the next time a new application is installed (presumably to update the inventory).

    And, like many other comments here have already noted, privilege escalation cannot be overlooked. Supposing a default-deny-anti-malware approach exists (and is worth using), if I operate the computer at the same privilege level of the tool itself [regardless of OS], it is possible for malware to disable the controls. And for the clever readers out there, yes, a set of default deny application inventory controls does seem similar to file system level controls--only execution controls further extend the FS permissions to cover the missing gap.

    Who cares about behavioral analysis? What behavior I dislike another will certainly like! Who cares about reputational analysis? What you trust, I may not! But, if we all just stop assuming that we can never speak intelligently about the inventory of "good" applications, then we might finally arrive at a solution that ends malware once and for all (well 99.999% anyway, we'd still have to worry about insider-threat ... and at that point it would no longer be a problem (as in a "social problem")).

    I guess I went over my two words. Apologies ...
    • by drsmithy (35869)

      We have seen it in firewalls. We have seen it in military-grade physical security. We have seen it in banking. But, why, oh why, do we not see it with malware?

      Because it invalidates one of the primary reasons for having a computer - its ability to act as a general-purpose device and run arbitrary software at the users demand.

      There *are* default-deny configurations out there - Windows has had facilities for whitelisting program execution for years - but the biggest problem with doing that is you *blacklis

Forty two.

Working...