Slashdot Mirror
Testing Free English Anti-Malware On Non-English Threats
An anonymous reader writes "Brazilian technology news site O Globo posted an interesting comparison on how free anti-malware behaves against non-English threats (Google translation of Portuguese original). By using a database of over 3000 samples from Brazil's Security Incident Contact Center, the numbers are quite different from all US anti-malware reviews. While Avira achieved the best score, 78%, Microsoft Security Essentials stopped less than 14%. This can be a headache for some large multinational corporations, whose IT departments deploy US anti-malware on the entire network, but have network segments outside US with many 'unknown' threats roaming around. I wonder what the results would be in other countries."
So it can be as simple as getting your malware translated into another language?
paid solutions?
These programs don't even remove the biggest English language security threat. After you run them Windows is STILL installed meaning you are STILL vulnerable to getting pwned. Big rip off if you ask me.
Monstar L
It isn't really news that AV products rely fairly heavily on canned signatures and that heuristic detection of evil lags behind evil by a fair margin.
What does surprise me, though, about these results, is that they suggest a fairly high level of geographic discrimination in the customization and targeting of malware. My (naive) expectation would have been that, aside from trivial stuff like trying to get the language of your spam/phishing/social engineering emails correct, the market for good exploits, well-crafted viruses, and so forth would be a fairly global one. Also, given that some malware attempts to propagate itself, rather than being delivered by a bugged website or other external mechanism, I would expect a fair amount of "splash" from malware spreading to any vulnerable hosts it can find, not bothering with any sort of geolocation, or from expats who live in country A, but still visit websites from home country B.
I would have expected a much more homogeneous(from the perspective of the mechanics of the exploit mechanism, evasion techniques, and payload) worldwide population of malware.
This only proves what people have been saying since day 1: fighting malware via blacklisting is a losing battle.
Eventually some company will come up with a business plan which is the opposite: if you are interested to run an application, you can pay them to do a security review on it. If the company worked on a "we do the review once $X dollars have been raised" basis, popular applications would be reviewed for small change per user, and niche applications would be expensive to have reviewed.
Unfortunately, that's also a losing battle because of the noncomputablity of the stopping problem, but it's less so --- developers who want their application to be reviewed quickly would supply source code to the reviewing company and the developers would have an interest to have the code be as "clean"-looking as possible, raising the bar for slipping in "underhanded" side effects (and hopefully making malware with complex behavior difficult to pass muster).
In my experience it's pretty easy to spot malware when English menu options and stuff start appearing on a non-English Windows installation, such as "Open" or "Open folder to view files" for thumbdrives while the rest of the options show up in the local language, sometimes malware can even bork the system because of it (like in the olden days of Windows 9x when installing IE in a different language caused all sorts of havoc in the OS)
Even with such a blatant language mismatch most users simply won't notice anything wrong with their systems until it bites them really hard.
2011 New arrival fashionable style fashion accessories A wonderful website to shop online.It is specialize in supplying discounted hot designers and top brand clothings, such as:Coach,Gucci, Prada, Fendi, ED-Hardy,Chanel and much more! Many fresh kinds of accessories are here, waiting for you to find out. Ture Religion Skinny Jean,Gucci diaper bag,Timberland boot,A&F shirts ... ...
Website: http://useetrading.com/
O Globo is one of the biggest newspapers on the country. But it is not a technology news site as the summary implies. Although yes, this was posted on the tech area of the site, it is hardly the focus of the newspaper.
Regarding the testing itself. This is just a report on a test made by an external firm (www. clavis.com.br) which was commissioned by the site. The test focused on the quality of free antivirus only. With implications that the issue lies in the fact that they are free, not that all antivirus are plagued by these issues (I will let you decide on what was the exactly aim of the article). Besides that, the test is devoid of crucial information. The database they used is a great one, the CAIS is maintained by our best scientific network, RNP (site in English: http://www.rnp.br/en/), so I trust the info there. But nowhere does it say that the threats are in Portuguese.
They used a list of 3.269 threats among virus, trojan horses, spywares, keyloggers, and etc. We don't know how many of each. Before the article they praise pay security suites, because they are a suite and not an antivirus only. There is no data on these threats, nor how many of each type, how old each one was, nor how they have threats which are not on the known list of each antivirus. Much less the language of the code.
Let me repeat it: NOTHING on the test implies that antivirus have a problem with non-English threats. It only said that those antivirus had that percentage of correct matches on either Heuristics or non-threads. But we don't know the exactly content of the database or the code used to test it. Much less the quality of the test.
Again: Language was not a part of the test!!!
--- "When you gotta do something wrong. You gotta do it right. (Fighter)"
Right, because a multinational is going to be using a basic security product with no management features like Microsoft Security Essentials.
I can't read the article: blocked by company policy.
But I would like to know whether they tested with Comodo in the "auto sandbox" setting. Since the virus would run sandboxed, it should not matter what the language was.
I am thinking of switching from MSSE to Comodo, and if they tested it and it failed then Comodo would not be an option for me.
Well, I might have a way, but it only works on a semi spherical planet in a vacuum.
It seems that at least in my assessment that Microsoft will have to come with some way of changing their operating system completely and then adding an application support layer to the new one for the old applications the way OSX did. This would be a very large undertaking and an extremely difficult one. The application support layer would have to be sand-boxed and would still represent a security challenge. I feel like computing is going to a more distributed utility type service model in the near future which would be enabled by faster more secure fiber-optic communications. I suspect that apple has this in mind with its new datacenter(s). If this is the case Windows may become quickly overtaken as Apple leverages open technologies, those already in OSX and ones already being developed for it. I think that OSX is headed for an iMakeover. Hint: the termination and or possible re-purposing for internal use of of the xServe line. And the interesting coincidence that the price of OSX server is the same as a machine installed with it (the Mac Mini Server) which is fast enough but not front end heavy leaving windows to to poorly copy it yet again. Maybe some day Apple will just acquire Microsoft and deal with the mess for them. They will probably be able to afford it at some point but I doubt is something that a company like Apple would take on. ;-) I want to be PERFECTLY clear that I am ONLY speculating here but this future seems inevitable if not highly plausible. Label me as a "troll" if you want.
.... are a HUGE number of threats....
Posted AC due to incredibly old and lame joke.
Nevertheless, why should Soviet Russia be the only one to get it's own meme?
Spamming /. with fashion accessories. Mod parent funny and then visit the link.
Silence
Do you speak English?
Silence
(This time with Hand gestures and really loud) Do YOOOOOO SPEEEAAAAAAAKKKKK Englissshhhh?
Thanks to the Internet, there is no reason that malware written in one place cannot easily spread across the world...
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
anti-malware, about as much use as selling rocks ...
The O Globo article doesn't mention language issues but only free AV quality.
Moreover, in Brazil we have much Banker malwares, that are malwares specialized in faking home banking web pages and stole user passwords.
Not exactly the same thing, but I've been getting a lot of spam in Greek for some reason -- and I have no idea how to filter it out (I could just capture any message with a common Greek word, but it's... gibberish to me). It's clearly spam, and probably all from the same sender, because the formatting is always similar, though of course the links vary.
please mod me down I suffer from ADD today, I did not read the part about nessus and WSUS....
Jehovah be praised, Oracle was not selected
With implications that the issue lies in the fact that they are free, not that all antivirus are plagued by these issues (I will let you decide on what was the exactly aim of the article).
Yup.
It's strongly tuned to make reader buy commercial antivirus.
For a start, it only mentions popular commercial antiviruses which happen to have a free version. /. entry and mentionned elsewhere in this discussion), has better chance to get covered.
It does not mention the freesoftware ClamAV, for example, which could have been a nice addition. Specially because ClamAV accepts lots of community input in its database. So malware more frequent in some less marketed countries (like suggested by the
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]