Slashdot Mirror
Anti-Virus Bug Briefly Identified Windows Explorer as Malware
SJ2000 writes "Windows Explorer was quarantined last week by Kaspersky Lab's antivirus software after being falsely identified as malicious code. The security company's systems had decided that a virus called Huhk-C was present in the explorer.exe file, leading to its confinement or, in some cases, deletion. The bug was only live in the wild for two hours, and ended up affecting just one corporate customer and a handful of home users."
Shouldn't this have been caught by even the simplest test before releasing?
That's my first reaction, now I'm off to RTFA
It made the front page of Slashdot because a corporate user shouldn't be stupid enough to use Microsoft Explorer over a real browser.
So what does that make people who are stupid enough to mistake Internet Explorer for Windows Explorer?
When I was a kid, we only had one Darth.
Now, of course they should not. Never. But they do. A few years ago, McAfee found MS Excel as malware (and acted accordingly, including detention or deletion, just like Kaspersky did with explorer now).
But how? Don't they test?
Of course they do. AV developers usually have some way to test against the most common software (and a few more software packages) before issuing a new signature. Though, as you can hopefully imagine, that takes time. The "whitelist" box that contains those "known good" files contains literally gigabytes (and soon terabytes) of software. As you can imagine, it takes a LOT of time to scan it all.
Time, though, is of the essence in the malware fight. You NEED that signature out before the proverbial shit hits the fan (i.e. before your customer opens that infected spam mail that was just distributed a few billion times globally). So your sig update has to go out NOW. Preferably it should've been out an hour ago.
How do you solve that quandary?
There are a few strategies. But they all come down to one single problem: Having a current version of every file you want to whitelist. So what most likely happened is this:
MS pushed an update for the file in question, most likely another of their infamous "silent" updates. You know, the ones you don't even notice. Now, if it wasn't a "silent" one, then one should wonder whether Kaspersky was sleeping (because they didn't fit it into their whitelist box in time) or whether it was pushed JUST at that time when they committed that update. Unfortunately such coincidences do happen.
Now, I'm not working at Kaspersky. Rather, I'm working at one of their fiercest competitors. So I should probably rejoice at their blunder (and I'm fairly sure my boss will be in a GOOD mood on Thu, time to ask for a raise, I guess). But it can, did, does and will happen. To anyone in the biz. No matter how good you are and how good your false positive alarms and nets are, it can happen to everyone. If anything, this proves it. Kaspersky IS one of the key players in the business, and they usually know what they're doing.
That's one of the reasons why I do highly recommend that you set your AV tools on "ask me before any action" mode. Yes, it bugs you every now and then, but it also means that things like this won't happen to you should your AV tool manufacturer have a similar problem one day.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Both of the items you mention I can just about understand making it through a software testing process. It is feasible that none of the test machines had the two peices of software you mention installed. But if you can find me a windows box without explorer.exe I will show you a borked installation.
It is not an optional component to install last time I checked so all of their test machines should have had this file. At least some of their test machines should have had exactly that same version of this file as the one they decided was a virus. So how the hell did they not notice when it quarantined or deleted it? Windows would go tits up at the next boot, if not earlier.
The only way I can think this could happen is if the skimped on testing. In which case this is most definitely the sort of news I would like to read on slashdot as it will give me a reason not to use their anti-virus solutions. An Anti-Virus solution without a very well defined and effective testing procedure is not one I want to use.
I dont read
The point I was making, which should be clear to you, was that there is no merit in making a choice just because it is popular. I can choose to eat food because "everyone else does" and it means nothing; I can choose to eat food because my survival as an organic being depends on it and this is a rational decision. You could claim that jumping on the Windows bandwagon is a sign of intelligence due to business realities; you could conversely claim that the truly intelligent find ways to deal with compatibility issues without needing to use a single Microsoft product. Both claims mean next to nothing without some reasoning and perhaps evidence to back them up, and for all I know a serious study might determine no correlation with intelligence at all. The only reason why I used the word "fulfilled" is because some of us make decisions using additional criteria other than how much cash is invested in something. You can treat that concept as a stumbling block and willfully miss the point I was making if you like, but this does not negate what I am saying.
All I said is that popularity does not determine actual merit. To say that this must mean I think I am the "all knowing one" is an emotional knee-jerk response that attempts to turn this into a personal matter and does nothing to address what I was saying. You don't like what I am saying, that's fine, but to act like this gives you license to automatically declare it false and make assumptions about my character is the very arrogance of which you seem to be accusing me.
The bottom line is, whether the popularity of Windows is due to inherent merit and good design cannot be assessed objectively in the current marketplace (I am putting this mildly). That claim could only be made if 1) all PCs were shipped with blank hard drives and did not come with an operating system of any kind and it was up to the user to separately obtain and install one and 2) all users were technically skilled enough, as well as willing and able, to independently evaluate the stability, performance, and security of all major (PC) operating systems before choosing the one to use. Unless you could arrange for both of these to be true, what popularity is measuring is the marketing skill, business acumen, and incumbency of Microsoft and not the actual merit or design of Windows.
It is a miracle that curiosity survives formal education. - Einstein