Slashdot Mirror
Google Uses Reputation To Detect Malicious Downloads
CowboyRobot writes "Using data about Web sites, IP addresses and domains, researchers find that they can detect 99 percent of malicious executables downloaded by users, outperforming antivirus and URL-reputation services. The system, known as Content-Agnostic Malware Protection or CAMP, triages up to 70 percent of executable files on a user's system, sending attributes of the remaining files that are not known to be benign or malicious to an online service for analysis, according to a paper (pdf) presented at the Network and Distributed System Security Symposium (NDSS) in February. While the system uses a blacklist and whitelist on the user's computer to initially detect known good or bad files, the CAMP service utilizes a number of other characteristics, including the download URL, the Internet address of the server providing the download, the referrer URL, and any certificates attached to the download."
Google, we want to scan your computer for you too. All that other stuff we find ... you know, the personal stuff or the illegal downloads or copyrighted stuff ... we promise not to see it.
It is interesting to see how karma works in the business world. Microsoft has been doing this for quite some time, with a few differences in implementation. But when Microsoft does it, we see that they are spying on us. When Google plays catch up, it grabs headlines for fighting malware.
This posting is provided 'AS IS' without warranty of any kind, implied or otherwise.
It's only in Windows 8, but Microsoft does the same thing.
1% of false negatives is good, but how about false positives?
The state you are in while your HEAD is detached... - wait, what?
http://tot-ltd.org/techinf.html
NSRL is also a pretty good site to get a comprehensive whitelist from. Best of all, the whitelist database is free, and used for forensic file analysis. The only mildly difficult part is sometimes keeping up with the release of new malware, but that's why I implement several other databases, including one based on API calls in known hostile applications. The really interesting thing with API groups, is that you can identify which piece of new malware most likely belongs to a specific family. So far, I've had no false positives on whitelisted files checked against the API database. ( http://www.tot-ltd.org/API )
take another look at that... it looks like he was replying to it...
Theoretically, distributing software using a self-signed certificate, as is done on Android, would create a "key continuity" situation that would allow "the reputation of the file [to] follow the reputation of the key". But I was under the impression that the warnings for downloading software with a self-signed certificate were even sterner than the warnings for distributing completely unsigned software. So what should a hobbyist software developer do to avoid a recurring fee of $100 to $200 per platform per year?
You are the most consistently annoying creature on the internet. There are people worse than you, just like cancer is worse than psoriasis, but you're more like the latter: pervasive, annoying, and always cropping up when one has mostly forgotten about it. You are that indeterminate, continuous itching that slowly erodes someone's mood until they consider cutting off a part of themselves just to stop it for a while.
And like psoriasis, you're auto-immune and not fully understood by science. Slashdot continuously makes it worse by scratching that itch over and over again. It's not smart. It just encourages the disease. But everybody's got a limit to their patience.
There is no cure for you. But at least, when slashdot dies, you will die with it, and there will be peace.