Many Antivirus Tools Fail in LinuxWorld Test 234
talkinsecurity writes "In a public, side-by-side test conducted last night at LinuxWorld, ten antivirus products were confronted with 25 known viruses. The results were surprisingly disparate. Only three of the products caught all of the viruses; three only caught 61 percent, and one caught an abysmal 6 percent. The test, which wasn't particularly complicated, proves that there still are wide differences in the effectiveness of AV tools. A lot of people think all AV tools are the same — they're not!"
The winners: (Score:5, Informative)
Kaspersky, Symantec, and Clam AV: 100% caught
FProt and Sophos: 94%
McAfee: 89%
GlobalHauri, Fortinet, and SonicWall: 61%
WatchGuard's Linux AV: 6%
And a graph of the results plus links to some of the test viruses: http://virus.untangle.com/ [untangle.com]
Re:The winners: (Score:5, Interesting)
Re:The winners: (Score:4, Funny)
Re:The winners: (Score:4, Interesting)
Re:The winners: (Score:5, Insightful)
Re:The winners: (Score:5, Funny)
Re:The winners: *Direct* Quote (Score:5, Informative)
This number quoted by the original poster missed the section in bold, it was technically < 6%, which could mean either 0 or 1 virus (funny how everything always works out to binary in some way or another
Re: (Score:3, Funny)
24 or 25 out of 25?
Hmmm....
Does mean that *nix is finally ready for the desktop?..Just like Windows?
Uhmm..w00t!?!?
Disclaimer: coming to you from a Feisty Kubuntu PC that is running ClamAV.
Ugh, not binary (Score:2, Informative)
I couldn't ignore the anal-retentive troll inside of me.
which could mean either 0 or 1 virus (funny how everything always works out to binary in some way or another :).
That is not binary, but rather only could be binary, but could be any m-ary. True, it could be binary, if you assume two viruses would be represented by 01, three by 11, four by 001, and so forth. As it is, it's ambiguous, as are all numbers. 234 viruses could be decimal, hexadecimal, or a higher base, just as X amount of something does
Re: (Score:2, Insightful)
Re: (Score:2, Informative)
Re: (Score:3, Informative)
Because the test set was 18, and not 25 as reported. 100/18=5.555. Have a look at the test results [untangle.com].
-- Steve
Comment removed (Score:4, Informative)
Re:AVG (Score:5, Informative)
Kaspersky and Eset seem to be the two main up and comers, and they left one out!
Re: (Score:2, Funny)
Well, I haven't noticed a NOD32 for Linux... have you?
Re: (Score:3, Informative)
http://www.eset.com/products/linux.php [eset.com]
Re: (Score:3, Funny)
Well, my bad...
In that case, I have two things ro wonder about:
1. Why wasn't it included in the test? and
2. WTF was my original post moderated Funny for?
Re:AVG (Score:4, Informative)
Also, Bitdefender and Nod32 are also good for the Windows enviroment. I'm curious to how all these ranked in the Linux world.
Test them yourself. The virus samples they used are found here [untangle.com].
Re:AVG (Score:4, Informative)
Re:AVG (Score:4, Informative)
Re: (Score:2)
Same thing with Norton, etc. (Score:2)
The answer is usually to reboot in safe mode and scan from there.
PS: I use AVG. Norton is just too intrusive, bloated and causes too many problems with normal system operation.
Re: (Score:2)
Part of the problem (Score:3, Insightful)
If you want to use a tool like that for recovery, they way to do it is on an offline system. Either take the disk to another computer and set it up as a non-system disk, or build yourself a PE boot disc and cle
Re: (Score:3, Funny)
Re: (Score:2)
it0@home:/tmp/virus$ bdc all/*
BDC/Linux-Console v7.1 (build 2559) (i386) (Jul 6 2005 16:28:53)
Copyright (C) 1996-2004 SOFTWIN SRL. All rights reserved.
Six percent? (Score:2)
Re: (Score:2)
viruses on linux - a big deal anyway? (Score:3, Funny)
Re:viruses on linux - a big deal anyway? (Score:5, Informative)
Re:viruses on linux - a big deal anyway? (Score:5, Informative)
Re:viruses on linux - a big deal anyway? (Score:4, Informative)
Re: (Score:2)
Re:viruses on linux - a big deal anyway? (Score:5, Funny)
By the time you get the e-mail, the zero-day is expired.
Re:viruses on linux - a big deal anyway? (Score:5, Funny)
Actually, I remember an article about the lack of compatibility between Windows and WINE.
Of the four viruses thrown at it, WINE couldn't run one properly.
Truly, Wine Is Not an Emulator.
Don't include me in your "we know" (Score:2)
This 2001 Qnetic report for the UK gov.
http://www.govtalk.gov.uk/documents/QinetiQ_OSS_re p.pdf [govtalk.gov.uk]
Makes this claim : "There are about 60,000 viruses known for Windows, 40 or so for the Macintosh, about 5 for
commercial Unix versions and perhaps 40 for Linux."
But viruses, by definition, will always have a hard time in Lunix. People generally don't share executables. Which leaves auto-opening files such as image preview, pdf, html and openoffice docs etc.etc.
It generally easier to exploit internet facing services
I came to moderate! (Score:2)
The story could have shown a list of the tested viruses verses the AV software being tested. A simple table would have conveyed a great deal more information than the druel the fellow wrote. Yes I RTFA and as I said - it is not very informative.
Re:I came to moderate! (Score:4, Funny)
Is that a cross between drivel and drool? Maybe some gruel thrown in for flavor?
Re: (Score:3, Informative)
You RTFA and then sadly don't do any research. Why would they bother to list the tested viruses when provide the actual viruses [untangle.com] (see "Test Set")?
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
I then upzipped the file and Symantec still let 14 of the viruses through!!
Re:I came to moderate! (Score:4, Informative)
001_eicarcom2.zip
002_eicar_com.zip
003_eicar.rar
004_eicar.zip.bad_extension
005_eicar_big.zip
010_18_04_2005.exe
011_abuselist.zip
012_fullstory.exe
013_image.jpg.exe
014_message.pif
015_mntrup.exe
016_patch-6143.zip
017_photo.pif
018_q347558.exe
019_scan_check.jpg.exe
020_test.zip
021_The_taxation.zip
100_8.zip
101_scan.jpg
102_Syndony.zip
103_Update-KB8136
104_Attachement.scr
105_image.jpg.exe
106_Info.exe
107_Please-confirm-pay
108_virus_87
109_virus_88
110_vvzh.scr
111_xxx.com
112_untangle1.zip
113_untangle21.zip
114_untangle22.zip
115_untangle3.zip
116_untangle4.zip
math question (Score:2, Interesting)
Re: (Score:3, Insightful)
Re:math question (Score:4, Insightful)
It's also possible I'm wrong, but either way, the article is omitting some information we're supposed to know.
Re: (Score:2)
Re: (Score:2)
Which is fairly easy to test since it's just a string of characters that make a fully workable DOS program..
X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVI
Re:math question (Score:5, Informative)
They used 18 test cases, Watchguard got only one : 1/18 = 5.55%, rounded = 6%
All from the spreadsheet available at http://virus.untangle.com/ [untangle.com]
Re: (Score:2)
Odd numbers. (Score:5, Interesting)
Hmm... the Fight Club Website [untangle.com] lists 35 test cases, not 25. It's not clear if there is any overlap between the various test cases. In fact, there's not any discussion of the testing methodology (let alone what precisely was tested) at all. Just "here's our numbers - believe them or infect your own machine and find out for yourself".
Now, while I admire the 'do it yourself' hacker ethos as much as the next guy - this is taking it a bit too far.
Re:Odd numbers. (Score:5, Informative)
The summary was wrong, it's either 18 test case or 35 test case, depending of the section you're looking at...
Re: (Score:2)
Well, the average of 18 and 35 *is* 25 (within about 6%).
Re: (Score:2, Informative)
Look at the page: http://virus.untangle.com/ [untangle.com].
Online Scanners Considered... Bad? (Score:5, Interesting)
For fun I downloaded an application where I suspected the "keygen" was trojanized. I was correct; the real keygen had been bundled with some, as it would turn out, Off The Shelf trojan. However, I didn't know what trojan so I scanned with F-Secure's online-engine, which didn't detect anything (neither did my active AVG installation). So I sent in the exectuable as a sample, explained what little I had to say; where I found the file, that it was pecompact2'ed, that their online scan didn't detect it. The process of submitting a file req. you to attach the scanner log.
Got the reply that "The file you submitted was found to be malicious, and is already detected as Trojan-Downloader.Win32.Delf.asz using the latest virus definitions." and "Please update your virus definition databases to properly detect the file".
Remember, I had scanned it using their latest online scanner and provided the log where the trojan was NOT detected.
So, maybe an extra warning for online scanning engines.
PS.
Shortly after I had submitted the file to f-prot, AVG started detecting it.
Re: (Score:2, Funny)
"Thanks for your submission, we analyzed the file and it's a new variant of Trojan-Downloader.Win32.Delf.asz that we hadn't seen before. Do an update to verify it's being detected properly by the client."
Re: (Score:2)
Re: (Score:2)
Re: (Score:3, Funny)
ClamAV among top 3! (Score:3, Insightful)
(My other OS favourites include Audacity, CDex, The GIMP and OpenSolaris (you didn't expect that one coming, did you)).
Re: (Score:2)
Re: (Score:2)
Hmm, no Trend (Score:2)
Re: (Score:2)
That's not really true. Trend sells IMSS [trendmicro.com] for linux relays. I notice you said "client", but still, I would think IMSS should have been included.
Not surprising... (Score:4, Informative)
...considering that most of the antivirus programs were tricked when a new "variant" of one of the worms back around '99 or so. So kids- just insert random whitespace into your worms!
The change? The line endings in the VBS script changed. It probably wasn't even intentional- some broken mail server probably modified CR's into CRLF's. It sailed right past Trend Micro's email scanner and infected several dozen systems.
I was the first person to notice why it slipped by, and brought it to the attention of a big-name "security expert" who ran a mailing list which shall go unnamed. He thanked us for the research, passed along my findings to the list, and then promptly went around doing interviews with the press using the first person voice. "I discovered that...", blah blah was what I read the next day.
I run Linux because... (Score:5, Interesting)
Am I a bad citizen because I don't scan for Windows viruses on my Linux systems? It's almost like another Microsoft tax--you're expected to degrade your performance to prevent their victims, uh, customers (yeah, that's it) from infecting each other. Those folks need to be responsible for their own safety and not expect the rest of us to do it for them. They could start by holding Microsoft accountable and making other choices at purchasing time. To me, Windows isn't worth the hassle.
Re: (Score:3, Insightful)
What about infected files that don't originate on your systems but are passed through it? If you send out an infected file, the recipient won't care where you think you got it, or how much you feel that it isn't your problem, you're the one who infected them.
You can piss and moan about trash on the sidewalk or you can just pick it up.
Re: (Score:2)
Re: (Score:2, Interesting)
Re: (Score:2)
It only makes sense on mail gateways and possibly web proxies that have Microsoft machines behind them.
Re: (Score:2)
Interesting... (Score:2)
Rainbow Fonts (Score:2, Interesting)
Re: (Score:2)
I have to question the validity of this test... (Score:4, Informative)
I can't help but think that Untangle is trying to justify their own choice, rather than have a real test. With a testbed of only 25-35, it is possible to pick a group of malware that can put any AV on top. Even the user submitted malware is suspect, especially when that testset is also so low. ClamAV is great against virus outbreaks, with one of the fastest signature responses, but it has pretty atrocious trojan and zoo detection, since there is not enough man-power to collect and create signatures for less prevalent and non-replicating malware.
Excel Results upped to Zoho Viewer (Score:2, Informative)
All antivirus tools *are* the same (Score:2, Insightful)
All of them will have false negatives as well as false positives, most likely skewed to have fewer false positives to reduce the annoyance factor at the expense of missing real viruses - false negatives.
There are substantially better and computationally cheaper ways to protect your system than an anti-virus.
Abacus problem (Score:2)
Detected, not Caught (Score:2, Interesting)
If you "catch a virus", you're infected.
"where's geoff today?",
"oh, he caught the flu"
"he caught it! nice one geoff, you managed to destroy that pesky flu & not get infected - so he's out celebrating right?"
"erm... fk off weirdo"
six percent? (Score:2)
Watchguard is fine (Score:2, Funny)
Re: (Score:2)
Re:Onecare caught 0% (Score:4, Funny)
Re:Zombies (Score:5, Insightful)
You should get away from antivirus. Seriously. I'm going to sound like a salesman, but bear with me a bit.
Antivirus and anti-malware in general, on Windows machines, closes the barn door after every single horse has bolted. There is _no_ way to be sure your Windows computer is badware/zombieware free. To top this off, it often sucks up incredible amounts of cycles that turn the latest gamer machine into an XT.
There is something that computer labs and libraries swear by and not at: Faronics' DeepFreeze. What you do is establish a "ground state" for the machine by doing a bare metal install and then installing DeepFreeze. You then have certain areas for data that are unfrozen, but the rest is basically locked up tight.
Surf by an evil site and get a drive-by install? Laugh maniacally, and reboot. The evil bits are then...gone. The machine has returned to its ground state. To install software permanently, you must "unfreeze" the machine, install your software, and then refreeze. The refreezing can be automatic for the next reboot or specified for a certain number of reboots, like if you were doing a Windows update and have to suffer through the interminable reboots. So it also gives Windows "parental supervision" - even for the 9x machines that don't have the concept of an "administrator" account.
Evilware in the presence of DeepFreeze is about as sticky as snot to teflon. If you insist on staying with Windows, this will let you sleep at night.
I swear, Faronics should hire me.
--
BMO
Re:Zombies (Score:4, Interesting)
I actually do the same kind of thing. Whenever I get a new machine, I snaphot the HDD before I even boot it the first time. Then I run the auto updates from MS and snapshot it again. I then regularly wipe the machine by restoring a snapshot. (It also forces me to keep my data somewhere else that is safe.)
The only advantage of this over the DeepFreeze thing is that I can unfreeze to multiple prior states.
I think it should be a standard feature with these 100GB++ notebook drives.
Re:Zombies (Score:5, Informative)
Have you ever worked in a tech department that had to support frozen computers? It turns a project that would maybe take fifteen or twenty minutes per lab into something more like and hour long. The school district that I work for used Deep Freeze on most of the desktops at the high school up until about a year or two ago. Taking DF off made it a lot quicker to make minor changes to the computers during the year, and there hasn't been any significant problems. Students and teachers are also happier with it because it prevents stuff that people have saved in My Documents (yes, the kids are told over, and over again to save to their mapped home directories - but occasionally they don't) from being wiped out.
About the same time as that we also took students out of the Admin group (I'm not exactly sure why they were in there in the first place - no apps have had any problems with it), so that mitigated any significant problems as well. We also have McAfee managed AV and 8e6 web filtering, but AFAIK its fairly rare that any viruses or malware are found on the student computers. The laptops that the teachers have(and have admin rights on) are another story. But they would whine if they couldn't add weatherbug and have five different toolbars in IE. Deep Freeze is really just a crappy way of avoiding the problem instead of dealing with it and fixing it. Students/regular non-admin users should not be able to cause damage to the OS. In a well run environment there shouldn't be tons of problems with malware. Yeah, there is going to be an occasional piece of malware that exploits a security vulnerability that could screw up the system. But it is not that hard to lock down boxes properly, with group policy and using the default Windows groups.
Re:Zombies (Score:5, Funny)
A bit. It's a PITA, but for static setups that don't need touching and subject to "many hands" like in a library, it's not bad. Let's just say that students in a classroom are typically better behaved than many library patrons.
" Deep Freeze is really just a crappy way of avoiding the problem instead of dealing with it and fixing it."
Well, I think the problem with that lies elsewhere, probably in a place called Redmond. All this stuff is just patches upon patches to keep Windows from eating itself.
"But it is not that hard to lock down boxes properly, with group policy and using the default Windows groups."
Some would say that this should be the default, but "design and marketing decisions" prevent that.
"But they would whine if they couldn't add weatherbug and have five different toolbars in IE"
Nnnggghhh.... *puts on BOFH hat* "YOU GET THE POLICY OF DOOM! MUAHAHAHAHAHAH!!!!"
--
BMO
Re: (Score:2)
When I was at university I worked for one of the campus libraries as a support officer. That meant in addition to supporting staff(which was moderately tedious, though the fiddler rate in librarians isn't too high so they weren't too problematic) that meant supporting a lab of about 50 pc's.
Now at the university, some of the the text books came with software, which we had to let the students install on the machines, which meant that they had to have admin rights.
As a consultant or to replace all the users... (Score:2)
DeepFreeze is an excellent tool for administrators or powerusers. But certainly no silver bullet.
Re: (Score:2)
Re: (Score:2)
the IT dept at the local school district recently ditched it as they kept having problems where it wouldn't unfreeze properly to install updates and it would foul up their update schedules (they have it rigged so it's supposed to reboot to thawed, then check for and install updates for all the programs every day at 11pm or thereabouts, then reboot frozen), but sometimes for no appearent reason, it wouldn't thaw and all the updates would get fouled up and systems would go
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2, Insightful)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Compressed executables can render the virus invisible. Different compression schemes can alter scanning results. So it behooves one to test both an uncompressed executable, and the same virus in a variety of compressed formats.
Incidentally, this problem was why I stopped using McAfee's DOS scanner, back about 1994: Every time its engine was updated, I'd test it against my zoo.
Re: (Score:2)
These are all AV solutions running on *nix.
Yeah yeah, mod me down, but I had to do it