Anti-Virus Effectiveness Down from Last Year 201
juct sends us Heise Security's summary of an article detailing the abilities of 17 current anti-virus solutions. German computer magazine c't has found that, compared to last year, the virus scanners are having a more difficult time recognizing malware. Quoting Heise:
"For real protection, however, in view of the flood of new malware, the way these programs cope with new and completely unfamiliar attacks is more important. And that's where almost all of the products performed significantly worse than just a year ago. The typical recognition rates of their heuristics fell from approximately 40-50 per cent in the last test - at the beginning of 2007 - to a pitiful 20-30 per cent."
yeah, but.. (Score:2, Insightful)
Re:yeah, but.. (Score:5, Informative)
Re:yeah, but.. (Score:5, Interesting)
Pro Linux, as I am, I still do not feel that we can afford to be complacent about the malware issue. The reason that Linux is largely unaffected is that it is not very widely used, especially by the sort of numpties that get tempted by exciting new screensavers baring trojans.
If/when we succeed in bringing Linux to the masses, this layer of protection will be torn away. I hope and believe that Linux is more secure by design and the same is probably true of many of the apps that are popular in Linux distros - you won't find ActiveX cheerfully opeing the door to anyone. However nobody should be ignoring malware with the excuse that Linux is immune.
where are all the Linux server exploits .. (Score:4, Insightful)
If that were true, where are all the Linux server exploits being actively being used it the wild. A Linux desktop logged in as standard user is safe from the numpties and is still usable. The dangers of screensavers wouldn't even apply here; even if a user managed to run some malware script it would most probably be confined to the users home dir, the core system would remain immune.
Re:yeah, but.. (Score:5, Interesting)
Re: (Score:3, Informative)
Re: (Score:2)
If the user doesnt log in, then the malware cannot run.
yes it can (Score:2, Informative)
Re:where are all the Linux server exploits .. (Score:4, Insightful)
The other thing you have to look out for is web applications - which of course tend to be exploitable regardless of what OS is running the website. These are notorious for providing holes. If you're lucky, all that happens is your website is replaced with a single page which says "pwn3d! l053rz!".
If you're unlucky, you get to announce to the world that you've lost the credit card details of 20,000 people.
(This, by the way, is not drastically different from the current state of security in Windows Server. A careless administrator is probably the biggest security hole known to IT).
Re:where are all the Linux server exploits .. (Score:5, Informative)
Linux server exploits _are_ being actively used in the wild. If you don't keep your server patched up then you stand a pretty good chance of being rootkitted. However, Linux distros tend to be pretty hot on security updates, meaning that a fully up to date system has very few known security holes. I suspect there are also more "idiot" server admins in charge of Windows servers than Linux servers (that is not to say that Windows admins are idiots, I just suspect there is a higher proportion of clued up admins in the Linux world).
However, the server world is very different from the desktop world - in the server world you can be relatively trustful that the admin won't go and install some random shiny new screensaver, etc. whereas on the desktop most people are not (and do not have access to) qualified admins.
A Linux desktop logged in as standard user is safe from the numpties and is still usable. The dangers of screensavers wouldn't even apply here; even if a user managed to run some malware script it would most probably be confined to the users home dir, the core system would remain immune.
There are a couple of important points here though:
1. Your average home user does _not_ have a dedicated sysadmin. When they want to install a package they (generally) need to become root to do it - that means that the numpties are equally capable of installing screensavers^Wmalware under Linux as they are under Windows. The thing the privilege separation gets you is that you can't _accidentally_ install something as root (e.g. via an exploit in your browser / mail client / whatever).
2. Even without root, a user still usually has plenty of permissions to do some evil things. They can't do some particularly bad things like SYN floods but they can still send out millions of emails and compromise other hosts.
3. Is the protection of the "core system" actually that important when you have a single user machine and so all the important data is owned by that user? The only thing this really gets you is the knowledge that your system binaries are probably safe (so you can trust that ps, netstat, etc are giving you accurate results rather than hiding the malware that is running).
There may be some merit in mounting all the filesystems the normal user can write to as "noexec" so that malware can't just install itself and run as the normal user. But this may place too much of a limit on usability and most distros certainly don't do this by default today.
Re:where are all the Linux server exploits .. (Score:5, Interesting)
On my defualt, fully security patched Mandriva workstation:
- I have full read write execute permission to my home directory.
- I can run wget to download anything, and put it as an executable anywhere in my home directory.
- I can use perl, awk, whois, grep, sed, whatever, to craft some pretty nasty scripts.
- I can use telnet and I could write an expect script to send spam with telnet.
- Or, I could just download a precrafted elf binary to run as a mini-mail server in my home directory.
- It's not to hard to imagine that I could pop something in
- I could fire off a fork bomb that will crash the system instantly.
I does not take to much imagination to figure out some suitably bad stuff that you could do as any old user.
Of course, hiding yourself on the system and ensuring your survival could be difficult. It would be easy to find all the nasty services running as said user, since top, ps, etc.. would not have been compromised.
Re: (Score:3, Insightful)
Re: (Score:2)
Re: (Score:2)
You've really got no excuse for not doing backups, it's going to cost you a heck of alot more to recover that data if you don't have the backup.
Re:where are all the Linux server exploits .. (Score:4, Insightful)
It got up my nose slightly when I installed Ubuntu on my desktop and I needed to supply a password to perform admin tasks, and type "sudo" before admin commands in a terminal, but on the whole, it achieves the desired effect ; it makes you actually consider what you are doing before doing it.
I *do* habitually run Windows as Admin, because if you are a developer it's a pain in the arse not to. But I don't pick up malware of any kind because I don't download software from untrusted sources, use IE, or open unknown email attachments. Once in a while I install anti-malware and run it. And scan it from the Linux instance on the same box as well.
Will Linux newbie users infect their systems with huge amounts of malware? Well, I don't think so.
* As people noted, there isn't a huge amount of desktop malware around NOW because the Windows target is so much bigger.
* The vast majority of software installed on desktop distributions of Linux is done using a package manager. Any package manager worth it's salt will be operating out of a reputable source, with checksum verification.
* The vast majority of software that the average user uses has an equivalent in the official package repositories.
On the other hand, nothing is foolproof and there an awful lot of fools out there, like my sister in law who infected her machine with 427 nasties by believing things she saw in IE.
The kind of targets (Score:5, Insightful)
Malware is all about money these days, whether it's herding bots so you can sell spamming services, or getting paid to DDoS someone's competitor, sniffing credit card numbers to buy stuff, or sniffing personal details for identity theft. Remember that your attack isn't 100% reliable, so you want as many potential targets as possible, and you want to attack weak targets so as to get the highest possible success rate. All so you can make as much money as possible, of course.
And what's the best target? Home Windows PCs, of course. No vigilant sysadmin monitoring the system; average Joe user doesn't grasp the concept of locking his box down, let alone have the m4d skillz to do it; Joe doesn't install patches regularly because he sees the downloads and restarts as nothing more than an annoyance; Joe doesn't really understand his computer, so he doesn't know how to look for the telltale signs of malware; Joe doesn't understand that he has to keep his virus scanner's definitions up to date, and turned off the annoying prompts; Joe doesn't understand a firewall, so he just clicks "Allow" to get rid of the warning message; the list goes on forever...
Now that MacOSX is becoming more popular, we're seeing a bit of malware for it, too. Example, that thing that claimed to be a video codec, but was really a DNS redirector. Now this one is a very good example of how malware authors target uninformed users: in the standard OSX installer program, there is an option to show the files that will be installed; if you or I (as
Until Linux is popular in the hands of inexperienced, non-tech-savvy home users (as opposed to enterprise), it won't be an attractive target for malware authors, and we won't see its security put to the test. When it does become popular, I expect we will see Linux malware, and I expect it will be like OSX malware, in that it relies on failings of the user, rather than the system itself.
For the record, I use OSX and Solaris at home, and develop for whatever I'm paid to develop for at work (which was, until recently, Windows, Linux, Solaris and OSX - looks like it will be just Solaris soon).
Re: (Score:2)
Most users, will give the password if prompted. We mitigate these user failings here by not letting them know the administrator password. Then if they want to install something that asks for this, they are stuck. This works poorly for Windows because there are still many legit programs that will not work unless the user has admin rights over the whole system.
Mac users have no real reason to know the system password for e
Re: (Score:3, Informative)
Surely the weakest part is between the chair and the keybord.
A search on secunia [secunia.com] tells a story of an old Linux virus (or rather, a piece of malware). The virus comes from a phishing mail in C sourcecode. Unless the luser has root privilege and is nuts, nothing could happen at all.
Consider one day M$ is dead and every luser in the corner of the world runs a Linux desktop. Then the luser happily su and make install, without even a single glance at the sourcecode.
Re: (Score:2)
smitFraud (Score:5, Interesting)
I've had a lot of people bring me infected PC's with smitFraud, that the big AV's have not even recognised or been able to properly remove, they have been pretty angry that the $90 or so they paid for a complete Internet Security product was not able to protect them.
It causes windows to pretty much choak and die as it just consumes so many resources and provides so much irritation, but major products like Trend or Symantec have not been able to successfully protect or remove them, I have had to use custom written tools that you get off the net for free. They really dropped the ball with that one.
Re: (Score:2)
Re:smitFraud (Score:4, Interesting)
I usually tell customers this, and tell them they have two choices:
1 we can try smittfraud fix and who knows, it might be lucky, but if they have to bring it back in a month we will charge them again.
2 we can backup all their data, format, reinstall and remove any executable files from their backup.
The second always works, have never had a re-infection (well, have, but that is usually thanks to someone surfing porn regularly, proven to the customer by showing them the browse history) with it.
Best protection for it, firefox + no-script, which I tell the customer and offer to install for no extra cost of course
Only problem is, my boss kinda hates me, we don't get the same people bringing their machines in every 2 months anymore needing a software clean done
Re: (Score:2)
The diagnosis is quick and obvious, the machine literally screams at you that it's infected. The disinfection tools are readily available, quick and effective. All things considered it's relatively painless to disinfect one of these machines.
But I'm really surprised that commercial antivirus software isn't picking
after the ffact (Score:4, Insightful)
Re: (Score:2)
Yes.
``That is, educating users not to click haphazerdly at anything that they feel like''
No [ranum.com].
Because, as you yourself point out,
``and that is a heck of a challenge. most users do not understand what can happen and many likely do not really care''
Re: (Score:2)
Now, if the OS takes good care of security, a lot of things that can actually be a security risk or a feature won't be possible anymore. Certain tools require you to be able to tap into another processes memory or network traffic to be useful. Also, plugins and the like (the dreaded BHO security hole in IE, which is actually meant as a
Re: (Score:3, Interesting)
There's this not-too-recent development in Antivirus programs where they actually scan executables before and as you execute them, preventing the infection.
Of course it's not perfect, but it's probably the reason most peop
Re: (Score:2)
The problem is that you have to know a virus to detect it. Welcome to the arms race! That's why heuristics have been the way to go for a while now, because that way you can at least flag something as suspicious if you don't know it. But
Re: (Score:2)
Re: (Score:2)
While it makes sense to scan everything, not only PE32/64 executables (ya know, exploits and macros), it does NOT make sense to spend an evening scanning your correspondence. It is actually fairly easy to detect an exploit (they have to be done in very, very specific ways to work, obviously), and macro malware doesn't
Re: (Score:2)
Generally speaking, the antivirus that we sell and install is a preventative measure. Sure, educating users is the best way to go...but even then you've got mistakes and mis-clicks. And some folks just don't learn. Goo
Re: (Score:2)
yes, eventually thi is true but malware does a fine job of speeding up the process by a good 10 fold or more. winboxes will work for a pretty long time if they are not constantly installing and uninstalling software- the old compaq still has win95 on it and works fine- it just wasn't constantly burdened by a bunch of garbage accumulating over time. if a winbox like that is taken care of it
Re: (Score:2)
I'm not saying that it can't happen, but it most definitely is not inevitable.
Re: (Score:2)
Re: (Score:2)
I don't even want to give MS the blame here. When you load your machine with drivers that hog more system resources tha
Re: (Score:3, Insightful)
Both approaches are wrong. The best approach is for network client applications (web browsers, email readers, and maybe even removable media filesystem mounters) to make usage not dangerou
My expectations are not that high... (Score:5, Informative)
Re: (Score:3, Interesting)
I work for an AV company. Our focus lies on "local threats". Not necessarily the local scriptkiddy community, more the phishing and ID fraud thing.
For about a year now, those things have been "localized". I'm not joking when I say that, depending on the country you're in, you get different versions of a certain trojan, targeting exactly YOUR banks, YOUR finance services, YOUR online stores. They actually go to the lengths of recreating the loc
Re: (Score:2)
running multiple antiviruses (Score:4, Insightful)
In Windows, if you wanna run more than one, you can only have the real time protection of a single anti-virus enabled or you get conflicts.
Meaning you rely on the on-demand protection of every other anti-virus and have to manually run them regularly OR set up schedules. What kind of user will do that?
Re: (Score:2)
Re: (Score:3, Funny)
You should look on the bright side: Since everybody has to buy high-end hardware, it also becomes much cheaper for people who need it for more interesting stuff.
(I would for instance very much like to see the next main-stream OS requiring 16 cores or more to run a simple email client on a desktop machine...)
Re: (Score:2)
User friendlyness is the worst idea since the mouse.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
What the hell it's doing even hooking into it is beyond me.. it's just feature creep.. it should be checking opened files only.
Standard advice? Ouch. (Score:2)
Re: (Score:2)
I think it's more because a "mildly irritating" virus will be removed, leaving the host to get infected again. An "extremely vicious" virus will take out the host and whatever replaces it will be better protected. Enough of this goes on and the number of available hosts drops s
Re: (Score:2)
In a P2P virus network there's no reason the virus couldn't update itself with new plugins for exploiting new vulnerabilities allowing it to spread yet further. If the virus could also update anti-anti-virus techniques it could potentially be very hard to wipe out whilst still fulfilling the same purposes as e
Just dont do it... (Score:4, Interesting)
Re: (Score:2)
It doesn't work in an office full of people, and it doesn't work with the average
Re: (Score:2)
Re: (Score:2)
You might not need an AV tool. You don't click every stupid button, open every attachment labeled "important info from your bank" or "last reminder", but you'd be amazed how many do.
Re: (Score:2)
FREE ENTERPRISE-GRADE ANTIVIRUS SCAN
1.) go to Trend Micro's download page [trendmicro.com]
2.) lower right side, click "Damage Cleanup Engine", and download sysclean.com:
"If you are not a Trend Micro customer please download the following file.
Sysclean Package 3.2MB
MD5 checksum: 4cb85b5a3c097fcb494dceed216b8d9e"
3.) go back to the download page, lower right side, click "Trend Micro pattern files"
4.) download the latest official or controled (beta) virus defs.
5.) stick these on a usb key, reboot in safe mode, copy to t
Re: (Score:2)
That works fine for cautious and educated users... But it relies on the user not being stupid,
Virus? (Score:2)
Re:Virus? (Score:4, Informative)
Re: (Score:2)
Re: (Score:2)
Antivirus is just bandaid. (Score:2, Insightful)
What i would like to see is Microsoft shipping a Windows version thats fairly secure out of the box. Then and only then Antivirus becomes something useful as a second added sec
read Ranum on enumerating badness .. (Score:4, Informative)
"if I were to simply track the 30 pieces of Goodness on my machine, and allow nothing else to run, I would have simultaneously solved [ranum.com] the following problems":
* Spyware
* Viruses
* Remote Control Trojans
* Exploits that involve executing pre-installed code that you don't use regularly
Re: (Score:2)
Re: (Score:2)
In theory it works, but it's not practically employable. Most mainstream distros install binary packages. Even if source packages are available, did you check each and every changed line after each and every security update? Simple answer: Either you don't or your software's very outdated and thus probably vulnerable.
Even given the benefit of the doubt (imagining you've got a whole team of peop
Re:read Ranum on enumerating badness .. (Score:4, Informative)
solution for real protection .. (Score:2)
Yes, I know what you're going to say, there aren't any Linux viruses because there aren't many Linux desktops out there. But where are all the server exploits out there being actively used in the wild. I'm talking about commercial servers being hacked not some msging board
Re: (Score:2)
The trade in zero day exploits is alive and well.. the only difference between today and 10 years ago is that the sale of zero day exploits has become slightly more legitimized. i.e., the "good guys" will now buy an zero day exploit off anyone selling, not just the "bad guys".
But getting back to the topic, you don't need exploits to write a virus. What you need is an infection vector, the use
Re: (Score:2)
Can I have some real world examples, not some home box, but commercial servers being hacked and customer records stolen, like the TJ Maxx [bbc.co.uk] case
Re: (Score:2)
Re: (Score:2)
In other words no, you can't produce any real word examples, dude
Re: (Score:2)
* An execution white- or blacklist can be created with hashes or executable file names. Obviously don't use the latter possibility.
Re: (Score:2)
It happens all the time. Usually through unpatched software, or misconfigured apache servers. The security team responsible for the DMZ network and firewall rules usually has no power over the guys who administer and program the syste
Heuristics in "easily defeated" shock (Score:2)
Good luck convincing your boss that AV software is snake-oil
Re: (Score:2)
Could you first of all please inform us what has been whitelisted? Aside of copy protection mechanisms (which should be classified malware, but guess what: PEOPLE WANT TO BE ABLE TO PLAY THEIR GAMES!), I'm not aware of any whitelisting taking place. At least in the more reputable companies in the biz.
Second, yes, with networking it's easy to distribute malware quickly. But the other way around is true too, AV vendors get new samples much m
Re: (Score:2)
Yes, I understand that attempts at education aren't working either. Most people are screwed either way. I deal with it by not supporting anybody who won't take the time and effort to learn how to properl
Re: (Score:2)
If they could only trash their own machine, then I'd find me another (most likely better paying) job, maybe as a security guy with one of our online casinos. You trashed your computer due to your own stupidity? Good! Means you're off the net and, hell, let Darwin be right, who's not fit to live will die, who's too stupid for a computer doesn't deserve one.
T
There are just too many false positives (Score:3, Interesting)
Sure, it is partly because of the inane copy protection, but AVG should make some tests before issuing such a crap.
Luckily the 'infected exe' is recoverable, and after disabling the resident shield it will run. But then, why do you have AV in the first place?
Re: (Score:3, Insightful)
In short, copy protection mechanisms share a fair lot of features with malware. It is often not easy to discriminate between them.
Now, it's likely that AVG didn't have access to NWN2 to ensure their r
Last years was better? (Score:2)
Re: (Score:2)
Re: (Score:2)
Useless (Score:4, Insightful)
Imagine having a door man that has a list of everyone you hate and everyone on that list is not allowed in your house. An enemy is prevented access but a stranger can still walk away with your TV. Wouldn't it be better to give the door man a list of all your friends instead.
Blacklisting is a really bad way to prevent unwanted activity. Whitelisting is much better.
Re:Useless (Score:4, Informative)
AV is good only as a system check. It is no good as a frontline defence. It can't spot viruses until they are either already in memory or sitting on your disk. Some of the time it will spot them before they get executed but most of the time not. When I used to use Windows at home (I only use it on school networks now, I work as a tech in schools) the one way to "tell" that you had something dodgy going on was when Zonealarm went ape. Even the integrated Zonealarm Security Suite, AVG etc. didn't detect the stuff that I was testing. But when something starts asking for Internet access out-of-turn, you know something's wrong. And when your AV is less use than a freeware firewall that bothered to ask you, you know it's a waste of time.
AV-scanning-proxies : excellent idea
AV scans of networks: good idea
AV scans of home machines: pointless and doesn't tell you what you can't find out in ten seconds of using the machine as an IT professional.
AV "real-time scanners": Well, yes, if you must, have CPU to spare and ignorant users using the machine. Otherwise, they're pointless.
Re: (Score:2)
A firewall only cares about programs that try to create connections to the outside world. And even though it doesn't really seem that way, those programs are a tiny minority of the things running in your machine. Still, if you ever used some firewall software, you'll quickly notice that as soon as some part of your OS gets updated, it starts to puke, scream and pop up every few secon
AV software causes more problems then it solves (Score:3, Interesting)
This isn't the biggest problem though. AV software is actively harmful. Aside from dramatically slowing down EVERYTHING, it can flat out break stuff. Norton in particular is notorious for screwing things up, to the point that if someone asks me about a problem with their computer now, my first answer is always "uninstall Norton."
Running the gambit from games being intolerably slow to programs crashing to drivers inexplicably failing to install (even after turning Norton off), to date "uninstall Norton" has never failed to fix the problem.
(Really, Norton and the virus makers themselves aren't much different, in that both of them prey on the computer illiterate.)
Re: (Score:3, Interesting)
It's a bit like saying webcams crash your system because you had one from Logitec (whose driver actually does just that). Or like saying OSs suck because you've seen what Vista is like.
There are decent AV companies about who do take care that the footprint they leave in the system is small, and that their drivers (which have to be quite invasive, unfortunately) don't ruin
Of course effectiveness is falling... (Score:3, Insightful)
Time was a virus would either just pop up an annoying message or delete random data or reformat your PC. Effectively viruses and virus writers were hunters and once they had got the target they had no further interest.
Virus writers have now become 'civilised' farmers. They now get paid for their efforts.
The writers have a tame herd (of infected PCs). They will spend their time trying to make sure the AV software will not interfere (to them these things are the infection). They spend their time tending their herd and catching 'wild' examples - other peoples virii (?) so they cross-breed.
One consquence of this (if correct) is that viruses may well start to remove other infections, and generally tune up your PC. After all, if your PC is working just fine, why would you bother keeping the AV scanner up to date?
Re: (Score:2)
I like it.
There is a better strategy (Score:2)
No single virus for all these years.
and if you do really need something try
http://www.virustotal.com/en/indexx.html [virustotal.com]
Viruses are a 'stupid user' issue (Score:4, Informative)
Tools and their uses:
- Firewalls: block stuff you shouldn't be listening for anyway, also help to mitigate against attacks against stuff you do listen for.
- Service Lockdown (difficult on windoze, see "Firewalls" above): You can't exploit something that's not there
- Proper configuration of what you do need listening: default stuff on that linksys router, for example
- Patches: Deal with worms (not viruses)
- AV software: tries to correct user stupidity. Not exactly a winning battle, as can be seen by the existence of this article.
- IDS: Never for an end user. How are they to know how to tune it, and what the messages mean, etc?
My experience has been that AV software gets in the way, causes system instability, and provides a false sense of security. None of this provides a significant benefit for a user who already practices good hygiene on their computer.
Why the drugs don't work anymore (Score:4, Interesting)
The malware-antimalware war ain't a static one. Both sides are engaging in a quite impressive arms race. They start creating morphing trojans, we create ways to detect them, they create global trojan floods, we employ detection networks to catch them, they switch from mail distribution to infected webpages, we start sending out spiders, they start using targeted spam, we create fake personalities to be "interesting" for them, they
It's just the same with the detection and elimination routines. They use certain API calls, we start listening to those calls carefully, they switch the calls, we follow, they start using executable packers, we develop exec unpackers, we discover that malware PE headers have a certain format, they change the format and create "filler" sections to look normal...
It's just a chapter in that arms race. Give us 2 months and we're back on par.
Skewed (Score:2, Interesting)
Re: (Score:3, Funny)
That's 'cause you got arrogant and didn't properly firewall your hand before connecting it to the net.
welcome to the modern ages ... (Score:2)
Re: (Score:2)
Re:AV's??? (Score:4, Informative)
True story:
A customer call. Quite irate person, yelling and screaming at our poor techie, telling him in no uncertain terms that he finally uninstalled our piece of junk and installed $competitor_software, because our piece of electron crap kept popping up and nagging him with some "virus found" junk and cutting into his productivity while $competitor_software doesn't.
So. Now question for 500: What the heck do you tell him?
Re: (Score:2)
Mostly because the heuristics in his tool really sucked to begin with.
Re: (Score:2)
Re: (Score:3, Insightful)
Malware has turned into a business. It's no longer the 16 year old pimple-face that wants to prove he has the longest virtual dick. It's biz. Malware is being written in almost normal looking "companies", cranking out quite professional software, complete with versions, updates, CVS systems and other things you'd expect in a "normal" software company.