Antivirus Software Performs Poorly Against New Threats 183
Hugh Pickens writes "Nicole Perlroth reports in the NY Times that the antivirus industry has a dirty little secret: antivirus products are not very good at stopping new viruses. Researchers collected and analyzed 82 new computer viruses and put them up against more than 40 antivirus products, made by top companies like Microsoft, Symantec, McAfee and Kaspersky Lab and found that the initial detection rate was less than 5 percent (PDF). 'The bad guys are always trying to be a step ahead,' says Matthew D. Howard, who previously set up the security strategy at Cisco Systems. 'And it doesn't take a lot to be a step ahead.' Part of the problem is that antivirus products are inherently reactive. Just as medical researchers have to study a virus before they can create a vaccine, antivirus makers must capture a computer virus, take it apart and identify its 'signature' — unique signs in its code — before they can write a program that removes it. That process can take as little as a few hours or as long as several years. In May, researchers at Kaspersky Lab discovered Flame, a complex piece of malware that had been stealing data from computers for an estimated five years. 'The traditional signature-based method of detecting malware is not keeping up,' says Phil Hochmuth. Now the thinking goes that if it is no longer possible to block everything that is bad, then the security companies of the future will be the ones whose software can spot unusual behavior and clean up systems once they have been breached. 'The bad guys are getting worse,' says Howard. 'Antivirus helps filter down the problem, but the next big security company will be the one that offers a comprehensive solution.'"
so its like the human immune system? (Score:5, Interesting)
who would have thought?
Re: (Score:2)
If the virus would've been picked up by the virus scanners, then they wouldn't have spread around the world like a virus.
In other news, a tautology has been shown to be a tautology.
Re: (Score:3)
Re:so its like the human immune system? (Score:5, Informative)
Virus authors, on the other hand, can use virustotal.com to see who can detect their stuff and evolve as necessary to avoid detection.
Virus writers make their viruses evolve? Creationism, anyone? Computer viruses don't evolve, they are engineered/programmed. And viruses that attack animals (including humans) don't have to evolve features necessary to bind to our receptor sites, those features have already evolved. What they do is mutate so that the animal's immune system doesn't recognize it as a threat.
The animal immune system is nothing whatever like computer antivirus, and animal viruses are nothing like computer viruses. You guys are anthropomorphising WAY too much here.
Re:so its like the human immune system? (Score:5, Informative)
Virus writers make their viruses evolve?
In a sense, yes. Viruses have been created which "evolve" by changing their code around in order to prevent signature based detection. Viruses that do that are referred to as polymorphic [wikipedia.org] viruses.
Polymorphic viruses are doing basically the same thing as a biological species that evolves into a different coloring that helps it hide from predators. The ones that don't evolve better camouflage get eaten by predators/cleaned by virus scanners. The ones that do evolve better camouflage spread.
Re: (Score:3, Interesting)
Nope. Computer viruses are intelligent design, not evolution.
Re: (Score:2)
Re: (Score:2)
Computer viruses don't evolve, they are engineered/programmed.
Why not? Cant random bits be flipped in a virus (ie by cosmic radiation, or background noise) just as with an actual virus?
If I recall a virus genome is roughly the same size as a virus, too-- mimivirus for example has ~1million basepairs, which I guess would be about 125KB.
Re: (Score:2)
Why not? Cant random bits be flipped in a virus (ie by cosmic radiation, or background noise) just as with an actual virus?
Um, no. That's not how computer code works.
Re: (Score:2)
Computer code, like a dna strand, is binary data. One uses electrical states for 1s and 0s, the other uses base pairs (A-T, C-G). DNA mutations are changes in basepairs, sometimes caused by radiation, and computer code can likewise be altered (ones flipped to zeros) by cosmic / background EM radiation-- thats a good part of the reason servers use ECC RAM.
Re: (Score:3)
Mutation is a bad word here, it's got too many science-fiction-comic meanings.
Try "corruption" instead. Does random corruption of code seem like a good way to generate anything useful? Did hard disk corruption ever improve a computer program? How about a stick of bad RAM? Did that ever make your operating system run better?
Do NOT anthropomorphize Computer viruses (Score:5, Funny)
Do NOT anthropomorphize computer viruses! They HATE that.
Re: (Score:2)
Evolution applies to ANY imperfectly self-replicating structure whose fitness to replicate varies with that structure. It is not restricted to life. Self-modifying viruses would absolutely qualify as evolving, if that's what they're referring to here.
Re: (Score:2)
Virus writers make their viruses evolve? Creationism, anyone? Computer viruses don't evolve, they are engineered/programmed.
How the process of change is implemented is irrelevant to evolution. Evolution means that in response to challenges of the environment, lesser fit forms die off and fitter forms proliferate. By some process of change, the fittest forms continue to keep apace of environmental shifts. Nobody ever stipulated that the hand of change had to be random chance mutation in a particular sort o
Re: (Score:3)
If you want to get technical, a bio-hazardous virus (it's not an animal in any sense at all - debatable that it is even what you'd consider living matter) splices its RNA payload into a cell, which reprograms it to transcript more viruses and fewer organelles (destroying the cell in the process,) which then spread to inject their RNA into other cells ad infinitum.
A computer virus splices its code payload into another executable program that it finds, causing the program to do repeat the process in addition
Re: (Score:2)
It's not really like the immune system. The immune system works on several levels, but the main strategy is to start with a rough full coverage blacklist from which all the whitelist items have been removed. When you get in contact with antigens, there are instant matches with the blacklist but they aren't very powerful. You proceed by making variations around the matching blacklist items and upgrade the best matches till you get a good powerful response. This upgraded blacklist is then ready for a fast pow
Re: (Score:2)
More like the TSA than the Army....only good at detecting previous threats. Move the bomb from the shoes to the underpants and you'll sail through.
It's a matter of time, stupid! (Score:4, Insightful)
The antivirus company can only react to new virus technologies. So the time to reaction is the actual measurement we need first. Only later we need the accuracy.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
If you are the system administrator then I wholeheartedly agree..
Re: (Score:3)
You are confusing the tern secure and the phrase 100% in-penetrable. A bank vault is secure. A shoe box is not. Neither is 100% in-penetrable.
Re: (Score:3)
I'm not sure what "comprehensive solution" is being called for. Antivirus is an undecidable problem; the best we can ever do is check for what we know to date, and add some guesswork for finding future malware. But we will never have a perfect antivirus program.
The better solution has proven to be OS security locks. Like it or not, the walled-garden approach implemented by Apple in iOS--and more recently by Microsoft--has made it much more difficult for malware to actually do anything harmful to your dat
Re: (Score:2)
1) Use OpenBSD
2) Launch Rocket Propelled Grenades
3) ???
4) Prophet!
Re: (Score:3)
I thought I've seen some pattern detection stuff in AVs before, that was supposed to try to detect suspicious activity.
Problem is, there are a lot of legitimate things that look suspicious. Writing a predictive scanner is an even more difficult task than getting the base OS secure without losing too much performance, usability, or user friendliness.
Re:It's a matter of time, stupid! (Score:5, Insightful)
In many cases if you do things right (esp on servers), AV software is more likely to cause problems than viruses. Every now and then you hear of an AV software with a system crippling false positive or other big problem. So if you are sandboxing stuff, and not regularly adding 3rd party software to a server or browsing with it, installing AV software on servers is more likely to cause problems than it'll ever solve.
Re: (Score:2)
I thought I've seen some pattern detection stuff in AVs before, that was supposed to try to detect suspicious activity.
Problem is, there are a lot of legitimate things that look suspicious. Writing a predictive scanner is an even more difficult task than getting the base OS secure without losing too much performance, usability, or user friendliness.
Actually it seems like my scanner likes to just flag on stuff with packed payloads, like compression is a new thing. Or utils, like unlocker. And some cracked files. My Antivirus ever finding a virus? Nope. Malwarebytes Anti-Malware seems to find more stuff though, but I guess Malware isn't Viruses, though I want neither on my computer and requires 2 programs.
So I have an anti-virus program that doesn't nothing good, but has a "shield" and a Anti-Malware program that find scrap, but i have to run it
Law (Score:3)
We should just outlaw malware. Then we wouldn't have to worry about it anymore! >_>
Re: (Score:3)
We don't need a law, we just need to have wider adoption of RFC 3514 [ietf.org], "The Security Flag in the IPv4 Header".
Re: (Score:2)
We should just outlaw malware. Then we wouldn't have to worry about it anymore! >_>
Like outlawing guns?
Re: (Score:2)
Death penalty for virus writers? (Score:2)
> We should just outlaw malware. Then we wouldn't have to worry about it anymore!
Make virus-writing a felony punishable by the death penalty ..
What's the impact of those new viruses? (Score:5, Interesting)
In about 15 years I've seen (and fixed) about ten infections, all on computers from friends or colleagues. All those infections were with known viruses or rootkits. You might say that new viruses go unnoticed, but even if they have infected a computer, shouldn't an antivirus scanner detect it later? Yeah I know it "should", but will it? I never see anything about them. Anyway, how often do all these new viruses actually have an impact?
Re:What's the impact of those new viruses? (Score:5, Insightful)
The "best" malware are the ones designed to be undetectable for years. Some even go so far as to play the role of an anti-virus to keep other infections out of its host. Given that most users don't bother to make sure their AV product is up to date (if working at all), it's no surprise these infections are never detected because they're actually making the computer run better (from the user's perspective) just so they can continue their own agenda undisturbed. The most advanced malware is more akin to a semi-benign parasite than a biological virus or bacteria.
Re:What's the impact of those new viruses? (Score:4, Insightful)
I'm still finding systems with infected MBRs and hidden partitions loaded with TDSS.tdl4. How old is this rootkit now?
I think these AV companies need to figure out how to properly clean/repair a system that has already been compromised before trying to play the cat and mouse game with the malware developers. I find AV software far more useful if a late detection can be removed/repaired rather than have it sit on my system for years undetected.
Re: (Score:2)
Re: (Score:3)
Re: (Score:2)
Re: (Score:2)
Not really. On a windows system:
1) reboot into safe mode
2) plug in USB key with known good copy of malwarebytes on it and install
3) run malwarebytes and clean PC
4) reboot
5) update/install AV product of your choice and onto your next job
Re: (Score:2)
You might say that new viruses go unnoticed, but even if they have infected a computer, shouldn't an antivirus scanner detect it later?
Often enough, no. One of the things that malware will do is subvert the ability of AV to detect it. Sometimes they'll disable the antivirus entirely. Sometimes they'll just break it and make it so the AV software won't download updates. It's also common for malware to break Windows updates for similar reasons.
And part of what ends up being the problem is that it's very difficult to know for sure that you don't have a virus. It could be that you don't have a virus, or it could be that you have one that
Film at 11... (Score:5, Interesting)
Re: (Score:2)
Now the thinking goes that if it is no longer possible to block everything that is bad, then the security companies of the future will be the ones whose software can spot unusual behavior
That's still the thinking from the 1980s.
Whitelist is old news (Score:5, Interesting)
The article mentions whitelist technology as the next step beyond conventional signature-based blacklist systems. But that's what I used three years ago, with RegRun [greatis.com]. As soon as an executable is run that it doesn't recognize, RegRun pops up an alert asking you if it's legitimate. Of course, this is useful only for the technologically savvy.
But now instead of that, I employ the ultimate in virus recovery (albeit not virus control). Using the multi-boot software BootIt Bare Metal [terabyteunlimited.com] (like a commercial version of GRUB, GParted, and other utilities rolled into one), I keep a clean OS on a separate partition that I can copy over the main partition at any time. Of course, I keep data on fileservers instead of my local hard drive.
Re:Whitelist is old news (Score:5, Funny)
"Of course, this is useful only for the technologically savvy."
That's the one huge, gaping security hole in most modern OSes... the user. Damn hard to patch too, although I have had some success with a crowbar.
Re: (Score:2)
What makes you think that viruses can't live in data files?
Re: (Score:3)
It depends on what you call "data". You can hide a virus in a text file, but that virus will be harmless, as there's no way to execute it. But a Word file isn't just data, since you can insert a macro. IMO whoever thought of putting embedded macros in word processing documents was brain-dead stupid; a word processing document should NOT be able to infect a system. Even a spreadsheet should not be able to infect; there should be two files in a spreadsheet with macros, the data and the macros, just like a dat
Re:Whitelist is old news (Score:4, Informative)
Bzzt, wrong. MP3s have been the vectors for exploits too.
>Your MP3s are safe from viruses
http://www.exploit-db.com/exploits/14309/ [exploit-db.com]
http://www.gnucitizen.org/blog/backdooring-mp3-files/ [gnucitizen.org]
http://www.theregister.co.uk/2002/04/29/winamps_malicious_mp3_vuln/ [theregister.co.uk]
Any interpreter can be used to run an exploit if the interpreter has a flaw. The seemingly huge number of flaws in interpreters shows that it is either hard or people that write software make a lot of mistakes.
Re: (Score:2, Interesting)
I swear I saw a buffer-overrun attack (/ jailbreak) on an mp3 player using a maliciously malformed ID3 tag. Even "data" can be a vector for an attack as soon as it's read by a vulnerable application.
Re: (Score:3)
An ID3 tag attack was the method used initially to jailbreak the Kindle Touch:
http://yifan.lu/2011/12/10/kindle-touch-5-0-jailbreakroot-and-ssh/
For those who don't want to actually read the article, the interface for the Touch was largely created with HTML5 apps, using Javascript. Digging into things, the jailbreak designer found that a Javascript function had been put in on the system to allow arbitrary command lines to be passed to the underlying Linux-based OS. However, when being used as a web bro
Re: (Score:2)
Not only are you wrong, you subsequently point out how in direct contradiction to what you wrote:
All viruses take advantage of bugs or poor design in executing software, and the exploit is not necessarily the propagation vector. They can, and sometimes do live in non-executable data files. They can propagate via simple file copying.
Re: (Score:2)
Of the few reviews I read many years back, Vipre had in the upper 80% detection rates for unknown malware while all of the others were more in the 20%-30% ranges, and Vipre had the least
Re: (Score:3)
Way behind the times. Webroot took over the light factor by a huge margin (sub-MB total installer size anybody?). Instead of trying to make a spot heuristic decision about unknowns to figure if they are viruses or force them to run in a VM and not have any access to system resources (let's break legitimate stuff), or have access that is monitored and cut off, but the damage done is still there, it journals changes made by the unknown thing and if it's determined to be a problem, rolls it all back. If it
Re: (Score:2)
"Are you sure that SeeJustinsTinyWang.exe is legitimate? (Y/N)"
Re: (Score:2)
Even whitelisting isn't perfect-- some of these viruses that evaded detection for years did so by using digital signatures that made it look legit.
Industry Incentives (Score:4, Interesting)
While this is a classic arms-race (i.e. each has incentive to stay one step ahead) - I would argue that there is asymmetry in the incentives in the attackers (malware writers), and defenders (anti-virus, and computer security software writers). I believe the long-term outcome of this is that the window of exposure for popular platforms will continue to grow, despite advances in: patching hosts, general user education, availability of firewalls, etc
An illustration of the basic asymmetry is this:
A lone coder in an impoverished country has a lot more to gain by writing a single virus/piece of malware than does an anti-virus company to write detection for that single virus. Think: bread for your family vs. one more item crossed off in a list of tens (if not hundreds) of thousands.
Additionally, the virus only has to be active for a short time to make the labour worth it. Write a new one every month, by the time it gets to the a/v companies, cash is in the bank.
Multiply this by the number of coders that are out of work, in countries that have other things to worry about, and the increasing availability of tools and education for the job.
It is a losing battle, long term.
No Sh*t Sherlock (Score:2)
Heuristics are HARD, and if you spend 3 months developing a virus you test it against the major players to see if it actually does anything.
New viruses are designed to get past the current antiviruss. The only thing that a AV should guarantee is a minimal number of days until they have an update that will protect users.
Re: (Score:2)
The only thing that a AV should guarantee is a minimal number of days until they have an update that will protect users.
It's 2013, if we have to wait 'days' for an update the virus will have already done its work (and a new variant is coded up and ready to roll).
Cautionary tale (Score:3, Interesting)
I like to think of myself as being pretty good when it comes to security and AV protection. I've been using computers since the C64 era and I remember when Michelangelo was making waves, long before rootkits. I even wrote a small DOS virus in assember myself (never released it, just as a study). I don't run crap downloaded from torrent sites and all my software is licensed. I keep a Windows XP inside a VM for stuff I'm not sure about.
Last month I got infected. I got sloppy and I just run something from an unknown origin (not a crack or some crapware, a legitimate installer). Some alarm bells sounded right away in my brain (the installer should have been signed and I got a warning that Windows Security has been disabled). I spent the next 5 days running AV tests on the drive. I used Live CDs from Kaspersky and MS to boot clean. I pulled out the drive and scanned it on a clean computer. I run separate AV and Rootkit finders. They all said the system is clean but I still didn't feel right. Finally, I run Malwarebytes Anti-Rootkit and it found it! No false positive, it really was a trojan svchost.exe. Needless to say I nuked everything from orbit - repartitioned and reformatted the drive, installed everything fresh and restored my files from backup. I even changed all the passwords.
Re: (Score:2)
You went through all that trouble of finding it, only to nuke the OS anyway once you found something that actually picked it up?
Re:Cautionary tale (Score:4, Interesting)
He had an uneasy feeling and confirmed it. It's possible there was more to the infection that wasn't found. The only safe way to recover from a virus is a nuke from orbit and restore from backups.
Re: (Score:2)
Re: (Score:2)
So when a 'crime' happens around you, you just kill mankind and start over again?
Or, like a reasonable person do you investigate?
What is the nature of the exploit? Virus? Malware? Data file infector? Anti-virus disabler?
How did it get there? Will you reintroduce the risk by re-installing?
How long was it there?
How does it spread, did it infect any other computers on the network?
Did it capture and send off any data on the system?
Do your backups contain the virus?
Was the infection caused by you? Did it come ov
Re: (Score:2)
It seems that by taking five days, just to find an infected svchost and then nuke it, you've successfully answered zero of those questions that you didn't already know within the first hour or two. Granted, if MBAM passes the results to their servers, it may help a tiny bit for them to study, but not really.
Re: (Score:2)
So why didn't he just nuke it five days earlier like most people would do rather than wasting that much time if you're going to nuke it anyway?
Re: (Score:2)
Psychological comfort. Because it is nice to know that you weren't just being paranoid when you go to the trouble to reinstall everything.
Re: (Score:2)
I even wrote a small DOS virus in assember myself (never released it, just as a study).
I did an evening course in x86 assembler at a college in the UK many years ago. In our first lesson the tutor showed us how to write a boot sector virus for DOS - I thought it was quite an amusing way to motivate us!
This is asking the wrong questions (Score:4, Insightful)
The question is, how well do these products protect their users? This study doesn't really help in that regard. Sure, we can dig up samples that the product doesn't detect. This is inevitable as pretty much everyone acknowledges.
A couple thoughts though. Looking at the PDF, they are deliberately going after obscure and experimental samples of malware. Fair enough, this was the purpose of the study. If they wanted to establish that AV products won't detect obscure and experimental malware samples, so far so good. But how likely is it that any normal user is going to encounter one of these? Probably very unlikely.
The AV vendors have to prioritize their time, so they will focus more on malware that a user is likely to encounter, so as to provide better protection.
Yes, the underlying point is still valid. Any automated detection technology is going to lag behind, that's a problem we will have to live with. Even products from Imperva will suffer from this, malware authors will simply run their samples through VirusTotal and all the other tools and keep tweaking until they have an approach that evades the detection.
Internet Part II (Score:2)
Re: (Score:2)
Or it may be done by research institutions and governments.
http://en.wikipedia.org/wiki/Internet2 [wikipedia.org]
Re: (Score:2)
One Internet with all the lock down measures in place, and one with all the free rain and dangers that come with it.
Dangers of free rain? Like floods and tornados? Nice pun there; rain is indeed like open source, it's free as in freedom and free as in free of cost, and it's hard to live without.
Although I believe you meant "rein" (as in steering a horse).
Comodo malware protector? (Score:3)
What about Comodo's Defender? You can set it up to automatically sandbox any suspicious programs (unsigned for example) and any suspicious behaviours will be denied and reported. Certainly it is not a silver bullet but I have had good experience with it after it detected a malware hidden in my input method program (which wasn't detected by MSE). The developer site was breached and a modified version was uploaded, comodo alerts me that the program was trying to access the internet.
This shit again? (Score:3)
Seems like we had a story about this same shit a month ago. It is still basically just scare mongering.
Yes, virus scanners are not good at brand new threats. A threat must be identified, and an update sent out before it can be blocked. Virus scanners are not magic AI boxes that can evaluate code for its intent, nor is there an "evil bit" that is set in bad code.
However, it turns out not to matter since viruses spread like, well, viruses, and virus scanners are inoculation. It is a herd immunity thing. New threats aren't on any systems, they are put up in various places to try and infect systems. They start slowly spreading. They get identified and an update sent out, and their spread is limited as potential hosts are inoculated.
Virus scanners are NOT perfect, but then no defense is. Geeks need to stop living in this fantasy land where there is perfect security. There's not. Ever. There is only layers of defense, defense in depth, to try and keep threats out and eternal vigilance.
Virus scanners are a valuable tool to help strengthen a defense. For most people they'll catch most of the threats they are likly to encounter and that is not nothing.
No shit (Score:4, Insightful)
Back in 1997 I wrote a resident com/exe DOS infector, which couldn't be detected by F-Prot nor TBAV (remember those?), despite the infector not being encrypted, much less polymorphic.
I learned two valuable lessons back then:
1) If you're going to write an infector, make sure you write the cleaner first.
2) You are your own best AV on the PC. If you know what you're doing, the AV does nothing helpful, and if you get infected, it'll be by something that AV cannot detect.
So... (Score:2)
we have a human analogy as a starting point. If I wanted to keep something, human or otherwise, free of infection I would stick it in an hermetically sealed container. Personally, I think (and I am most certainly not a security expert) the problem we have is that users are, by and large, allowed too much freedom by default. They can wander, like horny 16 year olds, the boudoirs and dark alleys of the internet without any form of protection what so ever. The iPhone is a nice example of a locked down system w
Re: (Score:3, Informative)
This is exactly what Apple has done with gatekeeper in their current OSX. Users can choose 3 levels of software protection. The strictest is only to run software from the Apple store which all has a code signature key. After that level comes a restriction to run only software from trusted developers that have been issued a signature key by Apple. The final level is no restriction at all, were all software including Trojans and viruses are allowed. The default is the middle level. All iDevices from Apple are
Déjà Vu (Score:2)
Nicole Perlroth reports in the NY Times that the antivirus industry has a dirty little secret: antivirus products are not very good at stopping new viruses.
Why do I get the sense that I've known this all along, and that I have in fact heard this same thing over a decade ago? Oh yeah--because I have, and things don't just magically change.
Software can't just catch 100% of everything that it was not designed to detect in the first place. How is this news? Same shit, different year (or would that more appropriately be decade?).
Bigger problem than imagined. (Score:4, Insightful)
I run a local computer repair shop, and I can corroborate this story- modern AV does jack.
I haven't seen any really malicious malware in a while, but I see ransomware and scareware ones quite often, and every time the computer has up to date AV on it.
What's more, a lot of the time I've seen the virus in question several times, meaning it's been around for at least a fortnight, and still the AV guys haven't picked up on it.
I can appreciate that a social engineered drive-by exploit attack is difficult to defend from, when the customer asks me how to stop it happening again, it's a tough question to answer- but this doesn't change the fact that IMHO, all anti-virus is a waste of time and money at the moment.
I install MSE on customer laptops because I have to put SOMETHING there, but I have little faith that it will protect them.
Now I'm not fear-mongering here, I'm just being matter-of-fact. Three years ago when I stopped re-selling AVG, my account manager said 'Oh sorry to hear that, can I ask why?'
I said; 'Because it doesn't work. I am removing trojans and rootkits from computers every day, and many of them are running AVG, which has completely failed to save them.'
Make your anti-virus software work, and make it protect users from drive-by attacks on bad facebook links (without intrusive toolbars and link checkers please), and I will sell you hundreds of copies in my little shop alone.
Re:Bigger problem than imagined. (Score:4, Insightful)
Um, the viruses you see infecting systems will, pretty much by definition, be the ones that get past the AV software. You won't be asked to remove a virus that the AV software on the machine will catch, because the AV software will catch it.
Re: (Score:2)
That's true, but-
A: My point about a virus that's been in the wild for at least two or more weeks is still not covered stands. AV corps bang on about research and monitoring so much, why are they so slow to keep up, especially when a lot of modern viruses are relatively easy to remove?
B: AV loves to harp on about how well it's protecting you, yet you never see positive virus removals in the logs. By your suggestion, I should be seeing disinfections and removals in the AV logs on most computers. The only tim
Add sandboxing... (Score:3)
Only problem is that it's no use for regular users. You need to know what you're doing.
BufferZone Pro might just be the right alternative but I've not tested it much.
The article is behind the times... (Score:2)
The top AV vendors have been using methods beyond signatures (white listing, behavior monitoring) for a while now.
In other words.. (Score:2)
You can't fix a human behavior problem by throwing more technology at it. Depending on AV for prevention of computer malware is like telling someone to slice themselves up with razor blades then jump into raw sewage. We have antibiotics, after all.
Time to... (Score:4, Funny)
One more time (Score:2)
Anti-Virus - scamming people since day 1.... (Score:4, Interesting)
IMO, this is all to be expected, and hints at the true, underlying problem. The entire concept of anti-virus software developed under false pretenses.
If you read Wired magazine's lengthy story on John McAfee, for example, you learn that the guy was little more than a scammer, ever since his college years. He started out giving away "free" magazine subscriptions that he lied and told people they won, and then convinced them to pay him a "shipping and handling" charge to receive them.
He only got the idea to form his anti-virus company after reading a few news stories about the successful spreading of the first virus programs (which were really developed as an experiment to see how far they'd replicate -- not to do any damage to systems). He thought it was really scary stuff (which he claims is largely because he was beat as a child by his dad, and the idea of a computer virus suddenly attacking a machine for no known/good reason was similar in his mind).
His company only become really financially successful after he fear-mongered to the media at every turn, trumping up relatively small virus infections as "liable to wipe out entire corporations!" and so forth. (Remember, in the beginning, McAfee actually gave his product away for free - knowing home users would start recommending and/or installing the product where they worked too, and the real money was in getting companies to pay for licensing.) Obviously, others saw the flow of money and wanted a piece of that action, so they, too, started anti-virus or "computer security" companies with similar strategies.
Don't get me wrong. I'm sure there really are people in the computer security or anti-virus business with good intentions. Some people out there really DO think they've "built a better mousetrap" and aren't just trying to sell a bill of goods for easy money. But at best, this stuff is a rapidly moving target. In fact, the traditional virus is hardly even a problem anymore, since most malicious software writers have moved on to malware as more effective for their purposes. (Why try to make complicated code that secretly attaches to valid files and replicates itself at every turn when you can just trick a clueless user into voluntarily downloading and running your destructive application instead?)
Over the years, I've watched companies spend huge money on dedicated appliances that purported to be "advanced firewalls" and "intrusion prevention systems" and the like -- only to become pretty much obsolete when a new "security" company popped up and offered up a replacement solution that was more clever and relevant to the latest variations of threats. Meanwhile, how much money was REALLY saved by having any of this? That's the beauty of the scam, of course... there's no way to quantify it. You can make up all sorts of pretend statistics!
Virus too narrowly defined (Score:2)
Re: (Score:2)
If antiviruses really identified every piece of scamware or scareware, they'd have to flag themselves.
And the solution is ... (Score:2)
Run your OS off a read-only USB device
"Australian company Cybersource says it's currently talking to two domestic banks about providing Linux-based bootable CDs to consumers to ensure Internet banking security". link [zdnet.com]
"Accessing online banking from your home PC is unsafe, says CIO of CNL Bank", link [computerworld.com] link [washingtonpost.com]
Re: (Score:2)
Malwarebytes isn't much different than other anti-virus products... as far as I'm aware, it uses pretty much the same methods to detect and remove. Also, the free version is only much use once the system is already infected (at least that was the case last time I checked) - you have to pay for any sort of real-time monitoring.
File Blacklisting (Score:2)
It also uses file name/path blacklisting, something it seems most major AVs do not.
Re: (Score:3)
Re: (Score:2)
There are ways of mitigating that. Windows has typically been abysmal in this respect but even other operating systems could go a long way to improve things.
Re: (Score:2)
>No it doesn't. Viruses take advantage of a vulnerability to infect a system. Once it is on the system it doesn't use the vulnerability anymore.
That is almost always true, but not 100%. A very few use methods that do not persist over a reboot to avoid off-line detection. Fixing the vulnerability does remove the virus in these cases.
Re: (Score:3)
Part of the problem is that products that start off good and have a good reputation often lose their edge but people continue using them. I remember when Norton Utilities (or it competitor PC Tools from Central Point) was almost essential for 'power' users, and when McAfeee was amonst the best anti-virus toolkits.
Re: (Score:2)
Re: (Score:2)
...and the antivirus marketers have been telling us they've been adding behavioral detection for years, too.
How's that working out for anybody?
Re: (Score:2)
>> How is this news? This has been the case for years!
It's news to the AV makers ...
>> ...and the antivirus marketers have been telling us they've been adding behavioral detection for years, too.
> How's that working out for anybody?
It means the clients can sign up for certification and compliance ...
Re: (Score:2)
Re: (Score:2)
Fails logic smoke test.
Infinity times zero is zero.
Infinity times a fraction of a picopercent is infinity.
Re: (Score:2)
MOD ++10 ...