Slashdot Mirror
Ask Slashdot: How Dead Is Antivirus, Exactly?
Safensoft writes: Symantec recently made a loud statement that antivirus is dead and that they don't really consider it to be a source of profit. Some companies said the same afterwards; some other suggested that Symantec just wants a bit of free media attention. The press is full of data on antivirus efficiency being quite low. A notable example would be the Zeus banking Trojan, and how only 40% of its versions can be stopped by antivirus software. The arms race between malware authors and security companies is unlikely to stop.
On the other hand, experts' opinions of antivirus software have been low for a while, so it's hardly surprising. It's not a panacea. The only question that remains is: how exactly should antivirus operate in modern security solutions? Should it be one of the key parts of a protection solution, or it should be reduced to only stopping the easiest and most well-known threats?
Threats aren't the only issue — there are also performance concerns. Processors get better, and interaction with hard drives becomes faster, but at the same time antivirus solutions require more and more of that power. Real-time file scanning, constant updates and regular checks on the whole system only mean one thing – as long as antivirus is thorough, productivity while using a computer goes down severely. This situation is not going to change, ever, so we have to deal with it. But how, exactly? Is a massive migration of everything, from workstations to automatic control systems in industry, even possible? Is using whitelisting protection on Windows-based machines is the answer? Or we should all just sit and hope for Microsoft to give us a new Windows with good integrated protection? Are there any other ways to deal with it?
On the other hand, experts' opinions of antivirus software have been low for a while, so it's hardly surprising. It's not a panacea. The only question that remains is: how exactly should antivirus operate in modern security solutions? Should it be one of the key parts of a protection solution, or it should be reduced to only stopping the easiest and most well-known threats?
Threats aren't the only issue — there are also performance concerns. Processors get better, and interaction with hard drives becomes faster, but at the same time antivirus solutions require more and more of that power. Real-time file scanning, constant updates and regular checks on the whole system only mean one thing – as long as antivirus is thorough, productivity while using a computer goes down severely. This situation is not going to change, ever, so we have to deal with it. But how, exactly? Is a massive migration of everything, from workstations to automatic control systems in industry, even possible? Is using whitelisting protection on Windows-based machines is the answer? Or we should all just sit and hope for Microsoft to give us a new Windows with good integrated protection? Are there any other ways to deal with it?
"only 40% of its versions can be stopped by antivirus software" Take a general case. What proportion of crime is stopped by the police?
What are virus writers looking to get out of writing malware? Money? Fame? Absolute Power?? Well neither of the last two are ever going to happen.
We should incentivize the reporting of bugs... Getting recognition as being a prolific bug finder, and fixer in a positive light would be a start. Also being paid is another avenue. Optional fame, and a steady reliable source of money would be very appealing to most people.
Am I just being naive?
I'd say security in the future will converge on three lines:
a) Sandboxed browsers/apps: Different browsers for mail access, general browsing and sensitive browsing (banking, using credit card, etc). All browsers revert to base state after closing, or allowing just a limited set of changes (bookmarks, cookies). The browsers are possibly stored in a USB stick with a physical write protection switch for part of the storage.
b) Trust structure: The OS will only execute programs with a certain signature, based in a chain of trust. You can choose who to trust or not.
c) Closed devices: (See Apple iPhone and iPad, but with paranoid-mode).
Well implemented, these strategies can reduce the malware threat, and they are implementable with current technology. I really don't see the anti-virus surviving much. It's an after-the-fact tech that was born as a patch for systems unprepared for a new threat. The playing board is now set and the structure of the systems must change to reflect that.
Rome taught me patience and assiduous application to detail. Virtues which temper the boldness of great, general views.
Let's translate the OP's question:
I have this insecure by design environment, while there are more secure by design environments available (yeah, probably not completely secure, but much more secure than what I'm using now). I'd like to patch my grossly insecure environment to get at least an illusion of security instead of considering the alternatives.
I apologize for the lack of a signature.
Mostly 'cause it's not profitable. Too small a market. Same reason why business software is rare for Linux (desktop, at least): No market.
As for "but it's more secure because you don't need root for every shit": The current big thing, cryptolocker, would work just as well on Linux. It needs no special privileges, all it needs is to run as the current user to encrypt all of the current user's documents and hold them for ransom.
I don't want to start the flamewar of whether Linux is more secure than Windows. Mostly because it does not matter jack. Linux could be the most insecure OS on the planet and still Windows would get the bigger share of malware. Simply because it is the bigger market.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
In an ideal world we would be a bunch of smurfs helping each other out when needed. However, this would simply be utopian. This lifestyle might work for small communities of 5-25 people where everyone is dependent upon each other for friendship, socialization, and survival.
Which will last exactly as long as it isn't profitable to make a virus for it.
If everyone swapped to a certain distro of Linux, I'd be willing to bet you'd have major problems within a week.
This old Trope again; completely belied by the facts that:
There are several major things;
Each of these are deisgn differences and the problems come down to commercial choices by Microsoft to increase their profit at risk their own user's safety. Microsoft invented the executable email attachment making email spreading viruses, previously thought of as just a joke, a reality. Note, that these are not technical problems. The Windows NT kernel, a design copied from VMS, is a perfectly fine base for security. What is needed to get rid of viruses is to start to see competing companies who actually care about their users and not just the lockin and immediate profit they can extract from those users.
I have a small client that hasn't run anything more than Microsoft Security Essentials for three years, mainly because they don't want to spend the money.
So far, I've only had to rebuild about 3 PCs in that time frame due to infection. They also got hit by crytolocker but at a weird time where it just made sense to reload the share directories from a recent backup because there hadn't been any changes to worry about between infection and last backup.
The controller feels that this is more or less an acceptable trade-off over time -- my labor cost to rebuild the PCs vs. the ongoing cost of AV.
They are probably right there - of those 3 rebuilds, how many do you think would have been prevented by paying more for any given AV product? Thinking back, I can remember several PCs needing recovery work because of the AV system in use (good old McAfee pulled down an update which declared a piece of Windows XP itself to be malware and need deletion - leaving a machine you couldn't log in to until that file was reinstalled), and probably two nasty infections for me to clean, which got in despite McAfee being present with fairly paranoid settings.
sounds like we've got an Id ten T error.
thing is, i've seen $100 a fix computer security professionals unable to remove a virus.
i removed the administrator privileges from said user and the malware couldn't reinstall itself. funny thing about windows is that making a new user account prevents many reinfection scenarios, yet a $100 a fix professional tries to fix it with tools that wont install properly because a malware is reinstalling every boot up.
they infected the keyboard controller on the laptop somehow too, so i used a new $10 usb keyboard to fix that because i didn't want to replace the whole keyboard, and made it so that the id ten t user would have to enter a password to install a program, and would have to use a password to remove the anti virus which i wrote down and didn't give to them. they also though youtube movie links were 'purchasing' movies so i did what i could and washed my hands of the situation.
https://www.gnu.org/philosophy/free-sw.html