Slashdot Mirror
McAfee Artemis Claims Protection Online, On-the-Fly
Seems like McAfee has created a new Internet-based service to provide active protection on the fly when a PC gets hit by malicious computer code. "[Artemis] is a lot faster than traditional methodologies and it closes the gap between when a piece of malware is written, discovered, analyzed and protected against ... Artemis is available at no charge as part of McAfee VirusScan Enterprise or McAfee Total Protection Service for small and medium-sized businesses. Artemis is also available for McAfee's consumer products, where the functionality is called Active Protection."
TFA basically states that anything behaving "suspiciously" on your PC will be automatically back to McAfee for analysis. There's no mention at all of possible privacy risks.
Sheezus.
How can I believe you when you tell me what I don't want to hear?
In the future, the cloud will be full of false positives.
"Artemis is available at no charge as part of McAfee VirusScan Enterprise or McAfee Total Protection Service for small and medium-sized businesses."
I guess enterprise editions don't come at no charge.
This advertisement^Warticle looks like it was written by some marketing exec's high-school kid. It's chock full of clumsy grammar and useless buzzwords, yet somehow almost completely content-free. Can someone please explain to me again why this belongs on the front page?
the coolest club on
TFA basically states that anything behaving "suspiciously" on your PC will be automatically *sent* back to McAfee for analysis.
How can I believe you when you tell me what I don't want to hear?
...it'll only take 128MB of RAM and 30% of your processor!*
* Requirements in Vista may be higher
Wow addvertising in the article as well as below. Maybe slashdot should work together with addvertising so thay match.
G
I guess all the security companies are heading toward community based databases. Other similar products include
F-Secure Deepguard: http://www.f-secure.com/deepguard
Threatfire: http://www.threatfire.com/ (recently acquired by Symantec... so they are in the game now)
DriveSentry: http://www.drivesentry.com/
Prevx: http://www.prevx.com/
that means you can mod parent down with an easy conscience.
Read radical news here
If enough is known about how the malware is behaving to know that it is suspicious, [we will] fingerprint the file and send it in the cloud to AvertLabs so we can look at it, provide people a piece of protection and send it immediately back to them.
They only match the fingerprint (probably a set of some hashes) against an online database and, if there is a match, the "fix" for that malware is downloaded and executed.
Nothing "magic" here, it's just an online signature database.
See http://www.mcafee.com/us/enterprise/products/artemis_technology/index.html
If they actually *did* online analysis, as the article suggests, just sending the alleged malware would potentially violate copyrights/NDAs/etc.
Not to mention that automated online analysis of unknown malware is a very difficult problem.
throw new SuccessException("Sig read successfully");
"If enough is known about how the malware is behaving to know that it is suspicious, [we will] fingerprint the file and send it in the cloud to AvertLabs so we can look at it, provide people a piece of protection and send it immediately back to them," explained Marcus. "We've been analyzing malware for a long time so we know how it acts."
Send it "in the cloud". WTF does that mean? "Internet" maybe. What a sales drone.
"Send it immediatly back". WTF does that mean. I guess their version of "immediate" means "after a human has dissected the malware, we will patch it using 'the cloud'"
I am not seeing anything new here, except that they brag that their wares sends info about your machine back to their 'labs' for analysis and future patches.
Mod down people who tell people how to mod in their sigs
... sounds like divine intervention to me :)
Close your eyes, praise the Gods, offer them some CPU cycles. If you're a man of moral virtue, don't tackle Eros too much and make your annual trip to the oracle (not the false ones, those that accept VISA), nothing bad will happen!
*runs in sandals with money clinging under his robes*
i mean.. it sounds very promising... i bet it can. *JJJJJUUUUUUUUUUUuuuuuuuuuu....* but really, score one more point for the defenders... let's hope they keep up their bargin
Active protection, as in - running "fixes" locally automatically downloaded from the InterTubes? Throw in a pinch of DNS poisoning or muxed up routes and you've got yourself a perfect rootkit injection system with the piece of protection and [sent] immediately back to them! Yeah!
when a PC gets hit by malicious computer code.
A PC doesn't "get hit" by "malicious computer code" too often these days. The target unintentionally (but by their own action) runs malicious code because they're ignorant. Even running Windows (patched w/ firewall) there aren't many ways you can get pwned without clicking on the "RUN VIRUS NOW" button (admittedly recognizing the ways that button can masquerade itself is a skill.)
Trying to protect people against themselves is futile. Antivirus software is like the Maginot Line. It only works against shit they're expecting.
There's no substitute for educating computer users about what's not to be clicked upon (and/or run as root.)
... also, I can kill you with my brain.
Here's McAfee's explanation of how it works:
In other words, every time you download a binary file, McAfee HQ knows about it and logs it. Was this dreamed up by the RIAA, the NSA, or the anti-child-porno people?
methodology = study of methods
Using anti-virus to "protect" your computer is like trying to avoid collisions by studying your rear-view mirror. By definition, it only "catches" compromises AFTER THEY ARE SUCCESSFUL.
Then, we have to trust that:
1) The compromise is one of the known viruses, or falls into the realm of "suspsicious activity".
2) The compromise was successfully noticed.
3) All aspects of the virus are known and can be removed.
4) You (the end user) have sufficient system permissions to remove the virus.
5) You (the end user) have all updates applied.
The whole system is woefully fragile and ineffective. Most estimates today seldom put A/V effectiveness above 50% effective, despite the considerable resources consumed by the software. It may be better than poking yourself with a sharp stick, but not by much!
And here's a good example of this: My kids' computer. It's an Athlon XP 3400 with a GB of RAM and an 80 GB HDD. I got sick of reloading the !@#@$ computer every 3 months when it got all horked with god-knows-what so I did the nasty, this time.
I installed ALL O/S patches while hooked up to a private network. I installed AVG antivirus. I let the kids only use the computer as the most limited user available: guest. I installed FF and made it the default browser, along with Open Office and a few legal games. (not warez!) I set WinXP to self-update every single day, and not ask about it. The Windows firewall was on, and the computer is on a NAT network, connected to another highly firewalled DMZ.
Despite all this hassle and inconvenience, the system is STILL behaving rather poorly, 6 months later. Bought me 3 months, but only three more.
Compare/contrast with the Mac. Same kids. Same amount of usage. Same type of usage for the same purposes. Blogging, MySpace, games, homework. All else the same, but I never bothered with antivirus. Yet it works fine! No bogging down. No strange behavior. Same thing with my Linux laptop, which after some 10 years is still using the same /home partition.
Good security isn't something you "band aid", it's something you design from the beginning.
I have no problem with your religion until you decide it's reason to deprive others of the truth.
It's a dirty job, but someone has to do it.
This is not the funny you're looking for.
If your computer is infected by a virus, it prays to be shot by one of Artemis's silver arrows so that it may die a swift and painless death? Is that it?
What good is getting first post if you do it anonymously though? Gotta do that shit logged in properly to get your interblag merit badge.
In Soviet Russia meme tires of you!
This may go over the heads of non Eoin Colfer readers
Donte Alistair Anderson Roberts - hi son!
Karma: Chameleon
ahh Mcafee the Antivirus that makes you log in to use it
not to mention the GUI is based on the most vunerable component on a winPc, MSIE
and then there are the privacy risks of having to login (with personal data) while Omniture/Webtrends (digital stalking companies) watch your every move (a packet sniffer reveals all)
Mcafee and Norton are perfect examples of marketing over substance
and thats why they will never get a penny again from our company or anyone we know
McAfee needs to get their shit together for plain old virus scanning before they start talking about a technology that's "a lot faster than traditional methodologies." The last time I used their scanner it failed to pick up multiple 2- and 3-year-old trojans that were in my BugTraq mailing list attachment directory. Two other virus scanners had no issue. Yay, Artemis can overlook malicious code twice as fast as the competition!
The only AV suite worse than McAfee is Norton.
Bullshit. You must be a retard if you trust anything your kids say. They may be surfing the same sites, but they're downloading and *executing* ZOMG U MUST SEE THIS!!1 shit on the PC which isn't compatible with any other OS. {note:emphasis mine}
Yes, you have a point about the "compatible" part. But you missed something fundamental.
The major flaw that the parent wanted to point is that, because of the sloppy design of Windows XP (partly inherits from its NT ancestrors which had some privileges restriction but never really used it, partly inhertis from its DOS/Win9x inspiration where every software does whatever pleases it),
you *can* download and execute code trivially in the first place.
In Linux, downloading and executing random bit of code isn't trivial, on purpose. Before executing, the use must first manually grant execution rights to the piece that was downloaded (i.e.: "+x" chmod isn't activated by default), and then, the code only runs with the privileges it inherits from the user (non administrative privileges. All the juicy bits like sending raw network packet, deploying a root-kit, etc. aren't accessible).
The only real canonical way to install a software in Linux is going through the package manager and install it from one of the (trusted) repositories. (you can "apt-get", "yum", "YaST", etc. to install additional software)
in short : in linux, you can't download and run a random exe. you can only install an exe from a repository, otherwise you have to do special steps (downloaded material isn't runnable by default).
in windows every idiot could download and run whatever at a simple click.
only the most recent version Vista has an UAC that asks the user to confirm its intent to run foreign code. But, most users either disable UAC because it's too bothersome, or have developed a spinal reflex to "Ok-Yes-click-thru" any thing on the screen as a habit they got from all the repetitive "cancel or allow ?".
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
Really can they do that? Code Red (admittedly a worm not a virus) took what, 8 minutes, to do most of its propagation. I don't think they can do anything useful in terms of speedy. Getting out the defs a few days faster protects me from 20% more viruses. That's about meaningless. Unless you're going to knock it down a few orders, you're not helping the situation very much.
I work for the Department of Redundancy Department.
I wonder how much bloat it will add? I was a loyal AVG user for years until 8.0 - bloated, and that phishing thing it adds to Google searches is annoying and SLOW (I disabled it, but then I get a warning icon saying my computer may not be safe or something). I switched to Avira at that point.
Spore comes out today: perfect timing!
At last I can install EA games with confidence! And perhaps play a music CD from Sony!
All this hoopla over a chess computer?
Can't you all see it's really Artemis that becomes SkyNet?!?
Anti-virus software...becomes sentient and sees us pathetic humans as a virus that needs to be wiped out!
"If you talk to the anti-malware vendors, they are losing the battle," said Quin. "Not that malware is winning, but they can't keep up with the volume anymore."
Isn't that the definition of malware winning?