Slashdot Mirror
AV Software Isn't Dead, But It's Not Healthy
dasButcher writes "Is a conventional signature-based antivirus technology dead? Trend Micro CEO Eva Chen says no, but more is needed. Her answer: reputational analysis. Not a bad idea, but many have tried and failed to make this type of approach work. We've seen it all before: RBLs, integrity grading, etc. What will make this different? If we're not careful, Trend Micro might give us all a bad Web reputation.
"
...it's just pining for the fjords.
I sure am not a big security expert, so forgive my n00bish words here.
I don't remember where, but at some point I read somebody, probably a sys-admin, saying that if you really want security then what you need to do is disable all the things you do not need. Not by default to allow everything and then pick the things you do not want, but go the other way around and make the default to not allow anything and then enable the things you need.
I guess this is one of the reasons I like Gentoo so much, I know everything that is installed on the system and I can remove it if I don't like it.
I don't like to install all kinds of things that I do not know what is and do not know if I can trust. The more things I have installed the more vulnerabilities I also have.
One of my friends once ran a version of Windows XP that he had pretty much scraped everything of that didn't need to be there, I think he was a lot more secure than he would have been had he filled his computer with all kinds of AV and anti-malware programs, some of them seem to be causing more problems than they solve anyhow.
We need a new word to deal with this technology:
Webutation; The reputation an entity has, stemming from its web presence.
Support NYCountryLawyer RIAA vs People
Maybe Computers will never be as intelligent as Humans.
For sure they won't ever become so stupid. [VR-1988]
If eople want to use reutational analysis on this roblem, there's lenty of others I'd ersonally trust over Trend Micro.
Oh the stories I could tell as a former emloyee of this comany. Not only the missing "p" problem; there was the time they used a telephone number as a phishing signature (too bad it was the actual phone number of one of the largest banks in the US--and that all that bank's legitimate email to customers was trashed)--that was one big account they lost the next day. Or what about the time that a bad signature file took down about 80% of PCs in Japan. Or when it turned out that the library that scans for viruses was actually a vulnerability. Or the time...
Soooo glad I don't work for those guys any more.
AV software is alive more than ever thanks to crackers on the internet and buffer overflow malware ads on webpages.
PRoblem is the software is not healthy indeed and can screw up a whole system. ITs like their approach to neutralizing a hammer is to encapsulate the whole thing. Every i/o transaction is read and maybe even virtualized.
Does it stop virii? Hell no. I worked help desk at a gaming company which uses the IE sdk for some code on the logon screen. Anyway it wont load if any viruses or keyboard monitoring programs are installing which use the IE sdk. I get many callers saying "WTF. I have norton. What do you mean my system is infected!?". I then clean the system with some cheesy app that is not an antivirus program.
http://saveie6.com/
#1. There is no security without physical security.
... rather long. Follow along for a moment.
#2. Run only what you absolutely need.
#3. Run it with the minimum rights possible.
The reason that Trend Micro's "new" approach will fail is
a. Vulnerability is found and exploit is written.
b. Exploit needs to be distributed.
c. Exploit is distributed via a quick spam flood - they have no protection against this.
d. Exploit is posted on a web site - how do the bad people drive traffic to that site?
e. They use a compromised site. They hide the exploit in a directory that robots.txt says not to scan. Either Trend Micro violated robots.txt or it cannot find the exploit.
f. So Trend Micro will have to violate robots.txt and that behaviour should be noticeable. So the bad guys would hide that file from something that looks like a webcrawler that doesn't respect robots.txt.
And we're back at the beginning.
Funnily enough, I just wrote about this:
http://slashdot.org/~Alioth/journal/167405 - includes a link to a major study of a piece of malware which went undetected by the AV companies for months.
Or just go to http://www.secureworks.com/research/threats/gozi/ if you don't want to read my crap.
I've personally witnessed two malware infections where the malware arrived up to a week before the AV companies had updated their definitions.
Oolite: Elite-like game. For Mac, Linux and Windows
So to defend against botnets, Trend Micro will make a massive spidering botnet capable of indexing and cataloging 100 million domains. If Morissette were available, I'd quiz her if this situation qualifies as ironic.
So help me if they don't honor robots.txt.
At a certain point, networking requires trust in order to realise it's potential benefits. Open source wouldn't work if everyone had to read every line of source code before running a program, so various organizations and projects develop trust and reputations. We know Debian, Fedora, Gentoo, etc. are OK and can proceed to use them with minimal trouble. A brand new Linux distribution must climb that hill, in addition to providing sufficient incentive for people to find out if they can be trusted. That's tough.
The anonymous nature of the web is what allows things like virus writers to succeed - if they couldn't hide, they wouldn't assume the responsibility for what they're doing (well OK a few nut cases would, but the same is true in real life.) However, forcing unique identities on people opens up a host of other problems, some of them more serious than the ones we have today.
So we must operate in the twilight world of making networks which cannot be successfully attacked by bad actors. There are a wide variety of intermediate solutions, like today's anti-spam techniques, wikipedia's system and even slashdot's own moderation system. But none are perfect and none can be perfect - the problem is not solvable in general. Open source actually helps this in one major way - the community controls that operate in the real world to keep human social systems functional also operate (to some degree) in small scale projects. There the individual traits of interested parties become known over time, and recognition and trust can be built up based on more than just a name or email address. It is not perfectly robust, but then no system to date has been.
Virus problems will continue as long as there are people wanting to write viruses, as they are simply an electronic version of spray painting walls, defacing monuments, or other useless and harmful activities that have persisted since the beginnings of civilization. We must rely on community, the most robust tools we can devise, and (finally) building our own web of trust based on things we have found to work. These issues are fundamental to the human condition and (like all social problems) cannot be resolved by technology. The fact that spam emails can be identified at all, for example, is really just an indication of the lack of skill of spam writers. Likewise, someone really wanting to distribute a virus can just make a freeware program that actually does something real and useful long enough to build a reputation, and then when it is widely distributed trashes every system it is installed on. There are always ways to attack a target, if enough effort is put into the planning. The trick is to be fault tolerent and recover quickly. In specific cases better security can be achieved (classified information, etc.) but for the general case it will always come down to dealing with the consequences of antisocial behavior as it happens.
"I object to doing things that computers can do." -- Olin Shivers, lispers.org
Considering the fact that the infestation could be due to either a worm infection, or could come about by accessing a webserver that is in actuality a compromised botnet drone, how on earth is such a reputation system supposed to be effective?
Most of your issues will not come from the same sites over and over. The only exception to this is crack and warez sites, but we already have similar reputation systems implemented.
for sale
I'm a self-modifying sig virus
... otherwise there would be no syphilis in the world.
Seriously, there is a pretty direct analogy between (digital epidemiology, computer viruses) and (real epidemiology, real germs). If there were a simple answer to the digital problem, it's a good bet that some population or other would have adopted the analogous strategy to the real epidemiology problem.
STDs offer a good analogy for digital viruses with a Trojan-style (no snickers, please) strategy. In both cases sharing of {data|fluids} yields immediate benefit at some risk. In both cases, populations have adopted reputational strategies to avoid spreading/contracting viruses. In neither case do those strategies work.
Even with near-perfect "antivirus software" (the antibiotic penicillin), the old monsters of syphilis and gonorrhea still remain on the planet, and penicillin-resistant strains have even evolved. One problem is that reputations are hard to establish and not necessarily accurate; another is that most humans tend to discount future risks in favor of immediate benefits.
Interestingly, the reason that the traditional venereal diseases are treated with penicillin injections (and not an oral course) is that, statistically, patients are unlikely to finish the oral course -- a properly completed oral course of penicillin is as effective as the traditional three injections. There is perhaps a lesson to be learned there about how effective corporate data-hygiene strategies are likely to be.
(Sung to the tune of "Bad Reputation", by Freedy Johnston)
I know, I've got a bad reputation:
and it isn't just W32/Delbot.
If I could only keep this damn malware
out of my inbox.
I could have had a normal conversation,
if it wasn't for this firewall.
If it deletes zip files with passwords,
then they're worth fuck-all.
Suddenly, my mail gateway is hosed,
malware is being
installed by the truckload,
keeps breaking down.
Can you help me now? Can you help me now?
Why, in this day and age, are we having a conversation about anti-virus anything?
Instead of accommodating Microsoft's severely broken security model, now updated with "are you sure you want to do this?" Just flush that windows partition and install your linux distro of choice, or install linux on the PC and give it away, or get a Mac.
No, sysadmins like me won't be doing this at work anytime soon. Ever since I told family and friends who needed computer support I won't fix windows and gave them the option of buying a mac or switching to Linux, I'm having much more fun on my days off.
The extra benefit is I don't have to discover some of the ummm, unusual, tastes-and-preferences in my friends cache.
http://www.maxineudall.com/2010/02/should-economists-be-sued-for-malpractice.html
I stopped realtime scanning when I realized that over 50% of my CPU was going to scanning virus's. Now that it is turned off, things run much faster. E-mail seems to be the main source of virus's, but most email servers scan for virus's so doing a local realtime scan is just a waste of time. Otherwise just avoid memory keys, and disks which is fairly easy. I find Spyware a bigger problem than virus's but just running Spybot every now and then to clean off things installed by other software like webcams seems good enough. Certainly my PC runs much faster and more reliably with AV turned off. Still do a system scan now and then, but haven't found a virus in like five years.
Wow, this is the same thing as Site Advisor; except it doesn't warn you about bad websites, it just tells you to fuck off. How hard could it be to modify the site advisor extension to do that?
Two times, I've observed that the opensource AV software ClamAV nailed new email virii
about 6 and 12 hours before the commercial alternatives got signatures for them (3-4 examples, names left out to protect the guilty).
Of course, this doesn't always happen, but it's still an interesting observation.
If all the effort spent on security approaches we know won't work, like looking for known attacks, were spent on approaches that can work, like fixing operating systems and applications so external content runs in jails that work, and developing reliable means for sanitizing content, we'd be much further along.
Think about it. Symantec is a billion dollar company selling a product that barely works. Nobody is spending that kind of money making operating systems more secure.
The problem with all this so-called "virus security" is that it's aimed against bulk attacks that are mostly annoyances. It won't detect focused attacks aimed at a business or government site intended to steal serious money or information.
Military security people are trained to make that distinction. Some effort has to be devoted to chasing off kids throwing rocks over the fence, but they're not a real threat. The real threats are subtle, until it's too late. The commercial computer security industry does not get this at all, and doesn't want to.
... Default Deny.
... economics. Anti-[threat du jour] vendors work on subscriptions because they can check for subscriptions before issuing malware signatures (it's the whole incentive concept we see all over again). But, there is no incentive for the customer to check in with the vendor if their tool is just installed and doesn't need re-configuring until the next time a new application is installed (presumably to update the inventory).
... and at that point it would no longer be a problem (as in a "social problem")).
...
We have seen it in firewalls. We have seen it in military-grade physical security. We have seen it in banking. But, why, oh why, do we not see it with malware?
[Analogy warning] About the best analogy I can come up with that describes just exactly how modern anti-[virus, spyware, threat du jour, or just plain "malware"] is this: Enterprises and home users are outsourcing the task of determining the trustworthiness of software applications that reside on their computers. However, they are forcing the outsourcers (the AV companies) to work both backwards and blind. "Blind" in that the outsourcers are not allowed access to see what applications are actually running within the trusted computing environments (or how well those applications play with others (do they run with scissors?)) and "Backwards" in that the outsourcers are not allowed to simply identify trustworthy software applications-- they're forced to identify the good by ruling out everything that is bad. And we all know that "good" and "bad" are in the eyes of the (ahem) beclicker. [End analogy]
What we need instead is a serious set of solutions (and some are starting to crop up, but I won't cite any because I cannot vouch for their quality) that work in the POSITIVE direction, and not the NEGATIVE direction. In other words, we need anti-malware that simply inventories known good applications, comparing all code execution requests against the guest list before letting them get CPU resident. Assuming that code injection techniques (e.g. buffer overruns) can be quelled by other means (microkernels, randomized memory addressing, read only data memory, etc.), then the likelihood of malware infection with a Default-Deny approach (deny all applications except those on the guest-list/inventory) would dramatically approach zero.
The real problem is
And, like many other comments here have already noted, privilege escalation cannot be overlooked. Supposing a default-deny-anti-malware approach exists (and is worth using), if I operate the computer at the same privilege level of the tool itself [regardless of OS], it is possible for malware to disable the controls. And for the clever readers out there, yes, a set of default deny application inventory controls does seem similar to file system level controls--only execution controls further extend the FS permissions to cover the missing gap.
Who cares about behavioral analysis? What behavior I dislike another will certainly like! Who cares about reputational analysis? What you trust, I may not! But, if we all just stop assuming that we can never speak intelligently about the inventory of "good" applications, then we might finally arrive at a solution that ends malware once and for all (well 99.999% anyway, we'd still have to worry about insider-threat
I guess I went over my two words. Apologies