Slashdot Mirror
Microsoft's Vista AV Fails Certification
An anonymous reader writes "Microsoft's much-hyped anti-virus solution, Live OneCare and three other Vista AV products failed to achieve the Virus Bulletin's VB100 certification. The other products are McAfee's VirusScan Enterprise, G DATA's AntiVirusKit 2007, and Norman's VirusControl. All failed to pass a series of tests that are required to display the VB100 badge. 'With the number of delays that we've seen in Vista's release, there's no excuse for security vendors not to have got their products right by now,' said John Hawes, technical consultant at Virus Bulletin."
What about "We didn't have access to Vista's internals until two months ago?"
That would be a good excuse for most security vendors...
Maybe the ClamAV people ought to submit their program for testing.
"[Regarding the 'cloud,'] ownership was what made America different than Russia." -- Woz
A VB100 badge means little or nothing to these companies, much less their consumers.
This has nothing to do with Vista, and everything to do with crappy anti-virus products. Neither OneCare or McAfee for XP have ever tested well, so why would anybody think that they would test well on Vista?
If you read the entire article, you'll notice a little blurb at the end that several vendors passed the test, one of which was Kaspersky. Another excellent vendor for Vista is AVG.
Kaspersky consistantly beats all the other major anti-virus vendors, but I guess the story wouldn't be quite as Slashdot-worthy if it ready "Kaspersky Anti-Virus on Vista Works Great!".
I heard they also didn't earn the WTF200 or the LOL500. Based on failing to get the three of these certifcations and seeing how all three of them are as equally popular..this software will surely be going no where.
For obvious reasons I will leave it to the reader to decide if they want to go and have a look, no links will be provided.
Now, if you're excuse me, I need to get back to setting up my Linkskey router...
They rang the fucking bell days ago. Salivate, dammit.
Sent from the iPad I found in your car.
---I hate to say it, but Microsoft were right for once in their earlier VISTA policy of locking down the practice of hooking into the kernel.
Locking down along with no source code is simply security by obscurity. There WILL be bugs found, and those bugs will have kernel rights. Do you think that is good? Guess what, I dont.
Vista will only reassure that bug releasers should not publish bugs, but rather sit on them. BTW, how do you clean out a kernel-infected Windows machine?
---It's that feature in XP that allows malware to flourish.
Is there an executable preventer on Linux? Nosiree, there's nothing preventing a user from affecting his own dataspace. What do you think is bad: Trashing the whole system, or trashing your ~ ? A system can be reinstalled, but most people dont back up their data.
Now, why dont Linux malwares work? They do, if the user lets them. It's just that much harder to make a program run from a browser window or from bad servers on various ports. Linux machines are usually more locked down to prevent evil stuff on the outside.
Well, how many people run AV on their linux/BSD boxes?
Now, since Vista is securebydesign, it too no longer needs any anti-viruses!
Obama likes poor people so much, he wants to make more of them.
"With the number of delays that we've seen in Vista's release, there's no excuse for security vendors not to have got their products right by now..."
Security vendors. They're all alike. They say they come to help...to save us from all things dark, but in their black hearts, they all want the same thing. They all want to RULE the earth!
Hello,
I shared my thoughts on this over here on Neowin.Net's forums, so I really don't just want to do a cut-and-paste job and post what I wrote in verbatim here.
This is one of the first of a series of comparisons to include Microsoft Windows Live OneCare that Virus Bulletin Magazine has been doing for many years. While I suspect it is more frustrating than embarrassing at this point for the team responsible for Microsoft's Windows Live OneCare, this is really Microsoft's first attempt at providing their own comprehensive anti-malware solution—MSAV, the product which shipped with DOS does not count, it was licensed from Central Point Software (who was later acquired by Symantec) who, in turn, had licensed the software from Carmel Software—and it is going to take some time and lots of signature release cycles in order to get their detection rate fine-tuned.
I don't expect this first Virus Bulletin product comparison to be the last, and the question really isn't how Microsoft did this time: It is how their product does over the next year or two that matters. If it gets worse or stays the same, they are just another competitor in the space (albeit the one with the deepest products). If, however, their detection rate improves, it is going to make it just that much more difficult for their competitors to compete against them.
As a disclaimer of sorts, I should mention that happen I work for one of the computer security companies that Microsoft competes against with this products, so this dicussion is far from academic for me. Frankly, though, I'm not expecting Microsoft's entry into this space to have any effect on my employer—we are good at what we do and have a very loyal customer base. Also, we tend to compete against other, similarly-sized companies in the field. What I do worry about, though, is how some of my friends and colleagues at the largest companies are going to handle Microsoft's entrance as they are going to be competing head-to-head against Microsoft for marketshare.
Regards,
Aryeh Goretsky
Dexter is a good dog.
Has anyone bothered to do some fact/typo checking before posting this stuff?
Microsoft's offering was one of four suites which failed to detect all malware. The others were G-Data AntiVirusKit 2007 v.17.0.6353, McAfee VirusScan Enterprise 8.1i and Norman Virus Control 5.90.
See, I run McAfee VirusScan Enterprise on Desktops and Servers here without problems. The latest version in the 8.0 line is 8.0i patch 15. The Vista-compatible version is 8.5i which also works on Windows XP. There is no version 8.1i that I know of. Obviously this doesn't change the message that McAfee didn't earn the seal but I've never had problems with the VirusScan Enterprise line. To be frank, I've never encountered a single infection or uncontrolled virus problem on our network.
Plus, who honestly uses just *one* virus scanner on the perimeter of their Microsoft Server-system based network? I certainly don't. For example, Exchange 2003 server on the perimeter runs software from GFI which has three separate virus scanning engines. This coupled with application executable hash-based protection offered in BlackICE takes care of the rest of the problems at the desktop/server level. It's the price we pay for using MS software.
Prevention may be better than cure, but did you know that, contrary to the popular adage, an ounce of prevention is actually worth much less than a pound of cure? Its simply the law of supply and demand. Most people lack the foresight to use prevention, so they run for cure when the shit hits the fan. This leaves large quantities of prevention just sitting in warehouses, collecting dust. They even buried a few tons of it next to those E.T. games for the 2600. Due to this oversupply, and the huge demand for cure, the cure-prevention exchange rate is one ounce of cure is now worth 5.78 pounds of prevention.
This may be tough on my karma, but I have to get it out: goddammit what's with the worthless tagging? I know the feature's beta, but if I see "haha" or "yes" followed by "no" one more time ... (ok I have no recourse). But seriously guys this feature is supposed to, as far as I can tell, eventually provide a useful augmentation or even replacement for search. Please try not to screw it up.
Who cares which lib they used? glib, libc, etc, etc.
emt 377 emt 4
If we talking about trashing the system instead of trashing ~, you would be right in the case of a single user system.
However, we are talking about trashing everything, against trashing just ~. Obviously just ~ is better.
In the case of a multi-user system, trashing one users ~ is much better than trashing everything. Most home PCs are multi users. Office PCs are invariably single user, but they should get backed up.
It is much easier to back up a single user's directory than an entire system.
Finally, limited access to the system makes it harder for viruses to propagate. How is it going to run again after a log out? Most people do not regularly run executables from their own directories: the executables they do run will not be infected. Certainly something like bash_profile or an autostart directory, but cleaning these up should be trivial. Am I missing anything here?
... Symantec and McAffee to get their shit together and make an antivirus that doesn't suck.
I'm not sure such a thing is even possible anymore. The usefulness of AV software has always been pretty questionable, and they never seem to have gotten over the threat model of months or years-old viruses being passed from floppy to floppy. Most threats are one-off now, like social engineering spam, one-day long trojan horse attacks, adware, and exploiting OS vulnerabilities to run spam zombies. As far as I can tell, my resource-hogging, system-destabilizing virus scanner does effectively nothing against any of those and there's no reason to believe it can be changed to do so.
As far as I can tell, my resource-hogging, system-destabilizing virus scanner does effectively nothing against any of those and there's no reason to believe it can be changed to do so.
ABSOLUTELY. I gave up on AV programs some time ago. A good firewall, firewall-like execution protection such as Process Guard, not using the most popular email programs or web browsers, and severely restricting web-based application execution (i.e., boycott ActiveX and hamstring Java and Javascript) are far more effective techniques for tripping up a virus as such attacks will almost always try to 1) exploit networking applications most common to the OS, 2) try to run some kind of executable that you haven't run before, and/or 3) attempt some kind of network operation in order to propagate itself. Trying to recognize virus signatures is a lousy use of CPU resources, and has not been seen to be very effective.
AV software companies are addicted to the subscription model that signature-based AV provides, and consequently are in a serious conflict-of-interest with regards to best security practices. Symantec in particular seems to be short of ideas for an alternative business model, and have opted instead to whine like a six-year-old who's mommy won't let them buy candy at the checkstand.