Google Uses Reputation To Detect Malicious Downloads
CowboyRobot writes "Using data about Web sites, IP addresses and domains, researchers find that they can detect 99 percent of malicious executables downloaded by users, outperforming antivirus and URL-reputation services. The system, known as Content-Agnostic Malware Protection or CAMP, triages up to 70 percent of executable files on a user's system, sending attributes of the remaining files that are not known to be benign or malicious to an online service for analysis, according to a paper (pdf) presented at the Network and Distributed System Security Symposium (NDSS) in February. While the system uses a blacklist and whitelist on the user's computer to initially detect known good or bad files, the CAMP service utilizes a number of other characteristics, including the download URL, the Internet address of the server providing the download, the referrer URL, and any certificates attached to the download."
Google, we want to scan your computer for you too. All that other stuff we find ... you know, the personal stuff or the illegal downloads or copyrighted stuff ... we promise not to see it.
It is interesting to see how karma works in the business world. Microsoft has been doing this for quite some time, with a few differences in implementation. But when Microsoft does it, we see that they are spying on us. When Google plays catch up, it grabs headlines for fighting malware.
This posting is provided 'AS IS' without warranty of any kind, implied or otherwise.
It's only in Windows 8, but Microsoft does the same thing.
1% of false negatives is good, but how about false positives?
The state you are in while your HEAD is detached... - wait, what?
Except I completely control it locally @ the fastest level of operations possible (the TCP/IP stack running in PnP designed kernelmode/rpl 0/ring 0 operations) as a filter:
---
APK Hosts File Engine 5.0++ 32/64-bit:
http://start64.com/index.php?option=com_content&view=article&id=5851:apk-hosts-file-engine-64bit-version&catid=26:64bit-security-software&Itemid=74
---
(What custom hosts files do for me in added value for better speed, security, reliability, & even anonymity to an extent is listed there in 16 discrete points...)
* "Auto-Magically" populating & creating a custom hosts file from 14++ reputable & reliable sources for data for protecting vs. known malicious sites/servers/hosts-domains:
http://hosts-file.net/?s=Download
http://www.malwaredomainlist.com/hostslist/hosts.txt
http://www.malware.com.br/cgi/submit?action=list_hosts_win_0000
http://mirror1.malwaredomains.com/files/
http://hostsfile.org/hosts.html
http://someonewhocares.org/hosts/
http://www.malwareurl.com/
http://sysctl.org/cameleon/hosts
http://pgl.yoyo.org/as/serverlist.php?hostformat=hosts&showintro=1&mimetype=plaintext
http://winhelp2002.mvps.org/hosts.htm
http://hostsfile.mine.nu/downloads/
http://safeweb.norton.com/buzz
https://zeustracker.abuse.ch/monitor.php?filter=lastupdated
http://amada.abuse.ch/palevotracker.php
APK
P.S.=> Best part is, it's not only of value for security, but also for added:
---
1.) Speed (via blocking adbanners as well as bogus sites online, but also via "hardcoding" your favorite sites into it for FASTER IP address resolution locally than from remote DNS servers (which have faults in them, many of which remain unpatched vs. the Kaminsky DNS redirection poisoning flaw, 1/2 a decade++ later AFTER its discovery -> )
2.) Reliability (vs. said unpatched flaw above OR downed remote DNS servers)
3.) To an extent, anonymity (vs. DNS request logs)
---
... apk
You evidence my subject-line when you show us all you're reduced to unjustifiable downmods to my post on hosts files' value to end users in better:
---
A.) Speed
B.) Security
C.) Reliability
D.) Anonymity (to an extent)
---
Online, rather than disproving any points I state in my post on YOUR PART & validly on computing technical grounds... which you are clearly unable to manage. Period.
* You fail in that alone!
And, you know it, I know it, + anyone else reading with 1/2 a brain does also...
(& especially since "the best you've got" is off-topic illogical trolling & unjustifiable invalid downmods vs. facts I posted!)
APK
P.S.=> Bottom-line: Thanks for proving that much for me in your off-topic illogical trolling reply along with the bogus -1 downmod of my post you replied to via AC posts afterwards & yet per my subject-line above, you NEVER, EVER disprove the points I state on custom hosts files value to end users, validly on computing tech grounds!
(Instead, you're merely reduced to downmodding the post, then logging out to preserve your "registered 'luser'" karma for you too, allowing you to do such reprehensibly WEAK replies with bogus downmods)...
... apk
http://tot-ltd.org/techinf.html
NSRL is also a pretty good site to get a comprehensive whitelist from. Best of all, the whitelist database is free, and used for forensic file analysis. The only mildly difficult part is sometimes keeping up with the release of new malware, but that's why I implement several other databases, including one based on API calls in known hostile applications. The really interesting thing with API groups, is that you can identify which piece of new malware most likely belongs to a specific family. So far, I've had no false positives on whitelisted files checked against the API database. ( http://www.tot-ltd.org/API )
All of my clients (tourism industry) need a good reputation. However, to get punished by Google would be very hard. It gets many years to get a good reputation, but just a moment to destroy everything. Just like in "real" life. Best regards, Muriel
Applying unjustifiable downmods to my posts can't hide their truth http://tech.slashdot.org/comments.pl?sid=3626185&cid=43390817 in the value of added speed, security, reliability, & even anonymity to an extent that custom hosts files give end users of them, as well as easy TOTAL local control of that too!
* :)
(Man... "Gee, I wonder WHAT you're SO AFRAID OF?" (lol, NOT!), that you bogusly downmodding trolls constantly make ME look good on via your "hit & run" unjustifiable downmods that lack validity to them which also FAIL to disprove points on gains hosts files give users of them too!)
APK
P.S.=> Point-Blank: "You FAIL" trolls - And, you know it... Just like I know that's "the best you've got" (which is ZERO) vs. facts in my posts you can't validly disprove on computing technical grounds!
(Yes, instead you effetely *try* to "hide them" via your bogus downmods, such as the original one you downmodded -> http://tech.slashdot.org/comments.pl?sid=3626185&cid=43390539 and the one beneath it also here -> http://tech.slashdot.org/comments.pl?sid=3626185&cid=43390817 thus, simply exposing your continual "fails" on that very account as well... "TRIPLE BONUS" for me yet again trolls, lol!)
... apk - And, you know it... Just like I know that's "the best you've got" (which is ZERO)
Theoretically, distributing software using a self-signed certificate, as is done on Android, would create a "key continuity" situation that would allow "the reputation of the file [to] follow the reputation of the key". But I was under the impression that the warnings for downloading software with a self-signed certificate were even sterner than the warnings for distributing completely unsigned software. So what should a hobbyist software developer do to avoid a recurring fee of $100 to $200 per platform per year?
Submitting 1 of his many March 2013 spams as himself here http://slashdot.org/comments.pl?sid=3581857&cid=43276741 instead of by ac submissions he usually did for those spam posts of his (that fail in discrediting apk as a spammer). Jeremiah Cornelius further exposed himself as a slashdot troll that failed in that just as he does disproving apk's points on hosts files validly on computing tech grounds. Jeremiah Cornelius proves all he has is his off topic illogical invalid trolling like that post in the link above, nothing more.
At disproving apk's points on hosts files giving users more speed, security, reliability, and even anonymity to a degree here http://tech.slashdot.org/comments.pl?sid=3626185&cid=43390539 - you fail, accept it (or doesn't your offtopic illogical further failing ad hominem attack attempts prove that much for us as well?)
We know it's you doing those spam posts http://slashdot.org/comments.pl?sid=3581857&cid=43276741 and you fail at disproving apk's points that custom hosts files can give users of them better speed, security, reliability, and even anonymity to a degree here http://tech.slashdot.org/comments.pl?sid=3626185&cid=43390539
http://tech.slashdot.org/comments.pl?sid=3626185&cid=43401051
* :)
APK
P.S.=> Face facts, & accept 1 thing: YOU are far too technically weak to EVER "get the better of me" (and you know it, I know it, + so does anyone else reading with 1/2 a brain... & all your unjustifiable downmods that can't disprove that custom hosts files yield better online speed, security, reliability, + even anonymity (to an extent) for end-users of them, as I stated here http://tech.slashdot.org/comments.pl?sid=3626185&cid=43390539 which "the trolling likes of you" are clearly unable to disprove validly on computing-tech based grounds... you, FAIL!)
... apk
You just plain LOST vs. myself, long ago -> http://tech.slashdot.org/comments.pl?sid=3626185&cid=43401051
* :)
(Since you're clearly unable to disprove my points on custom hosts files being of value to end-users of them for better online speed, security, reliability, & even anonymity to an extent as well...).
LMAO - no, instead, you show us that "the best you got" = zero in unjustifiable downmods & NOT disproving my points on a computing tech level... period!
APK
P.S.=> Face facts, & accept 1 thing: YOU are far too technically weak to EVER "get the better of me" (and you know it, I know it, + so does anyone else reading with 1/2 a brain... & all your unjustifiable downmods that can't disprove that custom hosts files yield better online speed, security, reliability, + even anonymity (to an extent) for end-users of them, as I stated here http://tech.slashdot.org/comments.pl?sid=3626185&cid=43390539 which "the trolling likes of you" are clearly unable to disprove validly on computing-tech based grounds... you, FAIL!)
... apk
Jeremiah Cornelius spammed this all March 2013 http://slashdot.org/comments.pl?sid=3581857&cid=43276741 , and was caught in that link, by mistakenly submitting that as his registered user account instead of his usual 100's of ac submittals of it he did. This shows us all how weak trolls like JC are against facts apk put out in favor of custom hosts files gaining users of them added speed, security, reliability, and even anonymity as well as those same trolls frustration at being defeated so easily by apk every single time since they are unable to validly disprove apk's points (to the point of all trolls have is computing technically unjustifiable downmods & failed illogical off topic ad hominem attacks, nothing more). Jeremiah Cornelius = pitiful (and weak).
Shut up, Paul.
Shut up, Paul.