Anti-Virus Effectiveness Down from Last Year 201
juct sends us Heise Security's summary of an article detailing the abilities of 17 current anti-virus solutions. German computer magazine c't has found that, compared to last year, the virus scanners are having a more difficult time recognizing malware. Quoting Heise:
"For real protection, however, in view of the flood of new malware, the way these programs cope with new and completely unfamiliar attacks is more important. And that's where almost all of the products performed significantly worse than just a year ago. The typical recognition rates of their heuristics fell from approximately 40-50 per cent in the last test - at the beginning of 2007 - to a pitiful 20-30 per cent."
yeah, but.. (Score:2, Insightful)
after the ffact (Score:4, Insightful)
running multiple antiviruses (Score:4, Insightful)
In Windows, if you wanna run more than one, you can only have the real time protection of a single anti-virus enabled or you get conflicts.
Meaning you rely on the on-demand protection of every other anti-virus and have to manually run them regularly OR set up schedules. What kind of user will do that?
Consider Application and Device White-listing (Score:1, Insightful)
AG
Antivirus is just bandaid. (Score:2, Insightful)
What i would like to see is Microsoft shipping a Windows version thats fairly secure out of the box. Then and only then Antivirus becomes something useful as a second added security layer. As it is now when it is the only security layer it doesnt work. Shipping Antivirus with Windows as Microsoft does is not a good solution but rather a recognition that they are not capable of delivering a fairly secure OS at all.
If users gets infected a lot by clicking the wrong things the sane thing would be to disable that function or atleast make it more safe. Like demand for example that a site that installs software is trusted by a third party.
where are all the Linux server exploits .. (Score:4, Insightful)
If that were true, where are all the Linux server exploits being actively being used it the wild. A Linux desktop logged in as standard user is safe from the numpties and is still usable. The dangers of screensavers wouldn't even apply here; even if a user managed to run some malware script it would most probably be confined to the users home dir, the core system would remain immune.
Re:yeah, but.. (Score:5, Interesting)
Re:where are all the Linux server exploits .. (Score:4, Insightful)
The other thing you have to look out for is web applications - which of course tend to be exploitable regardless of what OS is running the website. These are notorious for providing holes. If you're lucky, all that happens is your website is replaced with a single page which says "pwn3d! l053rz!".
If you're unlucky, you get to announce to the world that you've lost the credit card details of 20,000 people.
(This, by the way, is not drastically different from the current state of security in Windows Server. A careless administrator is probably the biggest security hole known to IT).
The kind of targets (Score:5, Insightful)
Malware is all about money these days, whether it's herding bots so you can sell spamming services, or getting paid to DDoS someone's competitor, sniffing credit card numbers to buy stuff, or sniffing personal details for identity theft. Remember that your attack isn't 100% reliable, so you want as many potential targets as possible, and you want to attack weak targets so as to get the highest possible success rate. All so you can make as much money as possible, of course.
And what's the best target? Home Windows PCs, of course. No vigilant sysadmin monitoring the system; average Joe user doesn't grasp the concept of locking his box down, let alone have the m4d skillz to do it; Joe doesn't install patches regularly because he sees the downloads and restarts as nothing more than an annoyance; Joe doesn't really understand his computer, so he doesn't know how to look for the telltale signs of malware; Joe doesn't understand that he has to keep his virus scanner's definitions up to date, and turned off the annoying prompts; Joe doesn't understand a firewall, so he just clicks "Allow" to get rid of the warning message; the list goes on forever...
Now that MacOSX is becoming more popular, we're seeing a bit of malware for it, too. Example, that thing that claimed to be a video codec, but was really a DNS redirector. Now this one is a very good example of how malware authors target uninformed users: in the standard OSX installer program, there is an option to show the files that will be installed; if you or I (as
Until Linux is popular in the hands of inexperienced, non-tech-savvy home users (as opposed to enterprise), it won't be an attractive target for malware authors, and we won't see its security put to the test. When it does become popular, I expect we will see Linux malware, and I expect it will be like OSX malware, in that it relies on failings of the user, rather than the system itself.
For the record, I use OSX and Solaris at home, and develop for whatever I'm paid to develop for at work (which was, until recently, Windows, Linux, Solaris and OSX - looks like it will be just Solaris soon).
Useless (Score:4, Insightful)
Imagine having a door man that has a list of everyone you hate and everyone on that list is not allowed in your house. An enemy is prevented access but a stranger can still walk away with your TV. Wouldn't it be better to give the door man a list of all your friends instead.
Blacklisting is a really bad way to prevent unwanted activity. Whitelisting is much better.
Re:where are all the Linux server exploits .. (Score:3, Insightful)
Of course effectiveness is falling... (Score:3, Insightful)
Time was a virus would either just pop up an annoying message or delete random data or reformat your PC. Effectively viruses and virus writers were hunters and once they had got the target they had no further interest.
Virus writers have now become 'civilised' farmers. They now get paid for their efforts.
The writers have a tame herd (of infected PCs). They will spend their time trying to make sure the AV software will not interfere (to them these things are the infection). They spend their time tending their herd and catching 'wild' examples - other peoples virii (?) so they cross-breed.
One consquence of this (if correct) is that viruses may well start to remove other infections, and generally tune up your PC. After all, if your PC is working just fine, why would you bother keeping the AV scanner up to date?
Re:There are just too many false positives (Score:3, Insightful)
In short, copy protection mechanisms share a fair lot of features with malware. It is often not easy to discriminate between them.
Now, it's likely that AVG didn't have access to NWN2 to ensure their routine won't find it. If anything, I'd complain about a program behaving like a trojan, not about an AV tool finding something they didn't know about.
Re:where are all the Linux server exploits .. (Score:4, Insightful)
It got up my nose slightly when I installed Ubuntu on my desktop and I needed to supply a password to perform admin tasks, and type "sudo" before admin commands in a terminal, but on the whole, it achieves the desired effect ; it makes you actually consider what you are doing before doing it.
I *do* habitually run Windows as Admin, because if you are a developer it's a pain in the arse not to. But I don't pick up malware of any kind because I don't download software from untrusted sources, use IE, or open unknown email attachments. Once in a while I install anti-malware and run it. And scan it from the Linux instance on the same box as well.
Will Linux newbie users infect their systems with huge amounts of malware? Well, I don't think so.
* As people noted, there isn't a huge amount of desktop malware around NOW because the Windows target is so much bigger.
* The vast majority of software installed on desktop distributions of Linux is done using a package manager. Any package manager worth it's salt will be operating out of a reputable source, with checksum verification.
* The vast majority of software that the average user uses has an equivalent in the official package repositories.
On the other hand, nothing is foolproof and there an awful lot of fools out there, like my sister in law who infected her machine with 427 nasties by believing things she saw in IE.
Re:The Real Reason (Score:3, Insightful)
Malware has turned into a business. It's no longer the 16 year old pimple-face that wants to prove he has the longest virtual dick. It's biz. Malware is being written in almost normal looking "companies", cranking out quite professional software, complete with versions, updates, CVS systems and other things you'd expect in a "normal" software company. Because it simply IS a normal software company, with the goal to make money from their software.
Their main reason why they target Windows isn't its inherent insecurity. It's simply that this is the main system used in the world. It would be not a bit different if the 90% market share system would be Linux or MacOS.
Now, I can already hear "but it's harder to infect a Linux machine". Bullcrap! To infect a fully patched Windows system is about as hard, at least if the user isn't a complete tool. And with a user that has the computer ability of a slightly moldy slice of toast, it does not matter how secure the machine itself may be. It will probably take a bit more social engineering, but people are stupid enough to click on everything, allow everything and hand any kind of crapware their root password when you promise them some nude pics, some crack for a piece of software or some make-money-fast software.
The reason why it doesn't happen is simply that it doesn't pay to go to those lengths. A Linux system run by a user who can't tell a floppy disk from a USB stick is still such a tiny, insignificant minority that it's simply not worth developing for him.
Re:smitFraud (Score:1, Insightful)
Re:after the ffact (Score:3, Insightful)
Both approaches are wrong. The best approach is for network client applications (web browsers, email readers, and maybe even removable media filesystem mounters) to make usage not dangerous. Clicking a link or viewing a page, should never(*) run external code; it shouldn't even ask the user "would you like to infect your system?" Just don't execute stuff that came from outside. And downloading a file (or mounting removable media) should never cause the newly acquired file(s) to have executable permission. Executing foreign code should always result from an active step, where the administrator goes out of his way to allow execution/infiltration.
This is the normal state of affairs on some operating systems, and it's the biggest (by far) reason that Malware is uncommon on Unix-like systems.
(*) The only exception to the above, should be with code that is run in very weak environments where dangerous capabilities are not available. This means stuff should run either very restrictive sandboxes (e.g. run binaries as a "nobody" who has very little I/O permission -- certainly not filesystem access beyond perhaps some ramdisk that is dedicated to that process), or arguably in contexts where the code doesn't have much expressive power to begin with (e.g. javascript in a web browser).
And even these exceptions are hard to get right, so they should be approached with extreme caution. For example, web browsers should probably disable Javascript by default, and only have controls to explicitly enable it, on a website-by-website basis. Current versions of Firefox get this wrong and that's a shame, because I know that years ago, I saw some Mozilla derivatives that got it right.