Slashdot Mirror
Consumer Reports Creates Viruses to Test Software
Maximum Prophet writes to mention an MSNBC article about a Consumer Reports plan to test anti-virus software by creating viruses. Security companies are objecting, on the grounds that it's a generally accepted practice not to create viruses for any reason. From the article: "Consumer Reports didn't create thousands of new viruses from scratch. Rather, it took a handful of existing viruses and created hundreds of slight variants, changing the malicious programs just enough to evade detection by an antivirus program with a list of known threats. That's a common trick in the virus writing world; it's standard for a successful virus to inspire dozens of variants. "
You know you're in trouble when Consumer Reports is pointing out that your software is worthless. As just about every /.er knows, pattern / signature based detection is all too easily circumvented. Unfortunately it's pretty much all we have. It has been my experience that enabling Heuristic based detection (in Symantec Corporate AV) at any level other than the default just leads to too many false positives.
Consumer Reports destructively tests many things. Why should it matter what they do to their own computers? As long as they don't release these viruses into the wild, there is no problem.
Security companies are objecting, on the grounds that they do not want the gaping holes in their software revealed to the public by Consumer Reports.
Track and chart data from your bike computer.
1) Virus writers will write exactly the same code, unless the boys at Consumer Reports are dedicated enough to come up with truly innovative virus variations. So there's no fear that someone out there will "get ideas."
2) Why not vet your software against somebody else's test suite? If CR wants to function as an extension of Symantec's R&D, let 'em. It's a win-win.
Human being (n.): A genetically human, genetically distinct, functioning organism.
No wonder the AV companies are up in arms - its a standard industry requirement to make sure that there is a PR rep assigned to each engineer to "interpret" results, whenever doing tests that shows how well the software actually works!
That is exactly what virusscanner sellers do. They create new virusses, mutate them and test them out. Of course they don't do that in a internet or network-connected environment. In all cases this should be in a lab environment completely closed off from the exterior world.
What's the big deal here? A bunch of Windows computer with antivirus software running in a closed off network as to benchmark some programs. Happens with games, office software etc... nothing to see here, please move along.
Of course this way you also get stories (hoax, urban legends) like the one about Symantec releasing virusses to sell their software...
Custom electronics and digital signage for your business: www.evcircuits.com
This is a very good idea, IMO. I mean, for years the major security companies have been using fear tactics to push their software. For an almost equal amount of time, security-concious geeks have been critical of this software. Having a trusted, disinterested third-party like Consumer Reports put it to the test sounds like the perfect solution to this situation.
Its been a long time since someone outside of Norton has talked about how good a Norton product is, but they've been in the game for such a long time that they are trusted by the general public to do their job. I wonder how many would uninstall if Consumer Reports said that their product was utter crap? Or rather, how many would try to uninstall only to find that the uninstaller is broken too?
There is no mod option "-1: Disagree" for a reason. "Overrated" is not an acceptable substitute. Post something instead.
I'll take a stab at that first example of attempting to break into [a] home, since that's the only one that's comparable to what it seems they are doing. If CR wants to setup a test home in which to practice breaking in that's fine, it's their property and they can do with it what they want. It's a test scenario... saying they'd go out and break into consumer homes is not a good parallel. Consumer Reports is (hopefully) not going to create any public security risk in their process if it really is self contained. As long as it stays within their little "sandbox" I don't see what the problem is. The second two examples deal with people instead of objects so it obviously doesn't make for an easy expendable test case.
Fear is the mind killer.
As a CR subscriber, I am utterly amazed that they even had the IDEA to construct a test like that, much less actually find capable programmers and do it. Perhaps that security company cold-called them and suggested it?
CR's technology reviews are often wrong in ways that would be laughable if they weren't so influential. Off the top of my head:
Has anyone here heard of this "Independent Security Evaluators" biz? I wonder how many of the viruses were still functional (not just infectious) after twiddling.
If this helps wake people up to the fact that anti-virus programs simply don't work, all the better. For example, at one time or another, nearly every antivirus package has declared applications with NSIS installers as malware. I remember having a McAfee trial on my computer, that would regularly make up infections. Yet, when a slightly updated version of a worm comes out, you're unprotected.
I'm scared of numbers that can't be written as a fraction. It's an irrational fear.
This is what real engineering is all about. It takes real software engineers, not code monkeys, to expost the vulnerability of a product, and report it to the consumers.
It's the duty of every engineer (those that can rightfully call themseleves engineers) to protect the public.
Clearly, classical antivirus software is not protecting us. Kudos to these folks for pointing out what should be the painfully obvious.
If they can guarantee containment
How hard is it to unplug a network cable in your world? Don't use a machine with a WiFi card. Low level wipe the drives from a bootable CD when you're done. Not really rocket science.
Coding with assembly is like playing with Legos. Coding an application in assembly is like building a car with Legos.
Soon they'll propose testing car safety by doing test crashes! Or testing fire retardants by trying to set them on fire. Damn those Consumer Reports fools!
It is by the juice of the coffee bean that thoughts acquire speed, the teeth acquire stains. The stains become a warning
So, we had a general routine to write a !boot (an autoexec-on-read-the-media) file, and hadn't considered the sequence of events of:
So, even though we knew exactly what it was capable of, we hadn't considered the actions of one of those infected, and *that* caused us problems. It's not the capabilities that changed, it's the environment. You don't tend to find that out until you've hit the problem, or you would have dealt with it in the source code - that's all I'm saying...
Oh, and I'm sure they'll take a more-responsible attitude than we had, we *were* 1st-year students...
Simon.
Physicists get Hadrons!
I casually perused CR here and there, but I'd never really known much about them until a relative gifted me with a subscription. Here are a few things I like about them:
/.ers care about, like RFID and general privacy protection; taking strong pro-consumer stances that you don't see in other national publications.
1. They pay their own way. They purchase *all* of the products that they test and destroy, since cozying up to get sample products would tarnish their credibility.
2. They don't accept any advertising dollars within their magazine, since that might bias their reporting and tarnish their credibility.
3. They take a strong stand on protecting consumers beyond just good product recommendations. They do editorials and special reports on subjects that
When my gift subscription runs out, I plan on purchasing my own. Not only because I find the product articles useful and interesting; but because the Consumer's Union does other good things with my money.
Why are you letting these clowns ruin our country?
Even though rated as funny, I think these items are a red-herring. The items you list affect people. The viruses would (hopefully) only affect the computers in limited network created by Consumer Reports, it will not affect people at all.
However, I think that CR is stretching a bit and their testing criteria and conclusions could be off. If none of the AV software can catch their viruses, it doesn't mean that they are worthless. If all of the AV software can catch their viruses, they can't conclude that the AV software is going to catch other viruses. Is some works and some done, they also can't conclude that one is better than the other in catching viruses, except in their particular testing scenario (their created viruses). The testing realm is almost infinite. You can't even use statistics to say which AV software is more likely to catch a virus, because of the multitude of possible ways to create a virus.
Consumers Reports is the most trusted amoung consumers. They put products through their paces and ensure they work well. With that said, yes Consumer Reports create viruses. They already have done so for testing lastest virus programs. Consumer Reports September 2006 issue has said this. They have rated Bit Defender as the best. The issue specifically said they created new viruses to test how well they did against new viruses not already in the signature lists.
People like Igor Muttik are just scared their crappy anti-virus software sucks. Mcafee ranked #6 in the Sept 2006 issue. And even if a CR virus got loose, CR can release the viruses details to venders immediately. The virus wouldn't last more than couple days.
\
Bitdefender doesn't catch all new viruses, updates are still important, it's just very good at finding new variants. That's what CR is testing here. Say a virus comes out that your software knows about but a variant comes along that it doesn't yet: Can it catch that? For some (like Sophos) the answer is no never, they check against a database and if it's not there you are SOL. For some like Bitdefender the answer is usually. They have a heuristic checking that works pretty well.
There's no magic bullet, there's no "buy this once and be secure forever" kind of solution, but there are better and worse ones out there. Bitdefender and AVG (probably others those are just the two I know) are reasonably good at stopping new, unknown variants. Synametc, well not so good.