Slashdot Mirror
Tavis Ormandy Criticizes Meaningless Antivirus Excellence Awards (softpedia.com)
An anonymous reader writes: A Google security expert (Tavis Ormandy) has become annoyed with antivirus products receiving awards a week after he finds huge security holes in their software. He's talking about Comodo who received an "excellence" award from Verizon, after the researcher discovered 4 security issues in the past four months, and is in the process of submitting a fifth. His criticism of Comodo and Verizon's silly awards is also validated by the fact that during the past year, he discovered security flaws in numerous antivirus and security software such as Avast, Malwarebytes, Trend Micro, AVG, FireEye, Kaspersky, and ESET.
were for the holes.
Many antivirus products started as small, useful tools which genuinely helped detect and neutralize viruses, at least still in the 90s and early 2000s. For some reason which I can only compare to gluttony for more "features" and attention, most have grown to bloatware with flashing popups, nagging screens and award stickers collected like flairs which are supposed to validate their usefulness, but are meaningless. When friends ask me to set up a newly purchased laptop, one of the first things to do is remove all that antivirus crap and educate them on PC hygiene.
We've been there before. (17 seconds clip and it's NOT Rick Astley)
bickerdyke
switching to an Operating System that is not the target of virus writers, or at least less of a target
Linux is your best bet for a general purpose operating system
Politics is Treachery, Religion is Brainwashing
Well you know, it is Verizon handing out the rewards.
It's much easier to be skeptical after realizing that.
Have you ever fallen asleep at the keybhanusdiog?
I should think not! They paid good money for that award!
Perhaps said Google employee should focus on Google, which tends to be clueless about a lot of things. If you install a private CA cert, your Android phone will then start lying to you, claiming "This network may be monitored by an unknown party." (or similar). Nope. I who they are, I deliberately installed the cert, and your incorrect message only makes me tend to ignore any warnings you give in the future. OTOH, it also comes pre-loaded with a shitload of enabled CA Certs, most of which I likely have no use for, and which Google expects me to simply accept as trustworthy. WTF is "Government Root Certification Authority?" certainly sound like someone I wouldn't want to trust. Anyone remember Diginotar?
"National Security is the chief cause of national insecurity." - Celine's First Law
Did I just call the entire computer security industry a scam? Why yes, I did. Tell me I'm wrong please, and try and add a believable argument.
Okay. You're wrong.
You've painted the entire computer security industry as being nothing more than virus scanning software. For an example of how just wrong this is, you need to look no further than the summary; "the researcher discovered 4 security issues in the past four months, and is in the process of submitting a fifth." Security researchers who find flaws, the programmers who implement encryption algorithms to keep your data safe, the manufacturers of firewalls that help protect everyone's systems... the group of people you've dismissed as virus scanner scammers would be enough to fill a large city.
Let me illustrate what you're suggesting in a different way. Do a search for "internet of things exploit" and "internet of things security." You'll get tens of thousands of results. Read a few. You'll find that, to borrow a line from Ars Technica, âoeInternet of Thingsâ security is hilariously broken and getting worse. If the entire computer security industry was nothing but a scam, that is what all computer security would look like.
He may be inarticulate, but he's not wrong.
The entire "computer security industry" is little more than scammers selling nothing but snake oil, i.e., security products which themselves are full of exploitable vulnerabilities and in many cares are very close to being malware.
.
One A/V product pokes around my network trying to find my router and determine whether or not I have it configured properly? Give me a break. Focus on the reason I purchased the product, and stop surveying my network. If the router settings have changed, then the A/V product failed in its core goal. Why not focus more effort to preventing malware from getting on my PC and less effort in trying to clean up what happens when they fail in that task.
Antivirus was most useful in the days prior to it needing to be always running. TSR's started down the path towards bloat and instability, but prior to that it was quite helpful to be able to pop in a read-only floppy with antivirus and run a scan on your local drives.
Once they started running as TSR's (background programs), they became a constant hog of system resources oft-times worse than the viruses themselves. The internet furthered this in many ways because - previously - viruses generally spread through physical transfer.
In the "good ol' days", you got a virus by either running an infected file, or once MBR virii came around by inserting infected media into your PC. Those viruses were like blood/fluid born viruses in the human world, of-times nasty, but you wouldn't get computer-herpes without touching somebody elses infected junk. Sure there were networks, but infection usually stemmed from somebody running a trojan and having write access to files on a shared drive.
Nowadays, modern viruses are like an airborne version of ebola. You don't need to download anything, or insert anything. Visiting a legit site with a bad advertisement is enough to get you, or sometimes even just being online with a machine that has an unpatched vulnerability. That leads to constant-running A/V that is basically trying to scan memory of active software trying to catch viruses before they can dig in. That's fine for older viruses but new still the AV misses entirely, and unlike the days of physical transfer a new viruses can go from the creator's PC to a thousands of victims within seconds of being written.
At this point, your AV is flu-shot. It works on some known infections and possibly close variations, but many people who have it still get sick from new stuff.
An AC posted in reference to AV software once being nimble and useful before mutating into the crapware we see today. This is of course true. Things have escalated to such a level of what the fuck, I have been wondering if some AV companies are not covertly writing virus and malware software themselves, concurrent with the patch so that once they manage to get the virus\malware propagating out of the dark web, they can demonstrate how quickly they are able to update their software and better "protect" their customers. This would at least mitigate all the times AV companies get blindsided resulting in countless millions of infections. I was going to include an explanation as to why that is not as crazy as it sounds, but reading my own words it doesn't sound crazy at all.
Of course no AV company could ever keep a lid on that, but we already know we are talking about management making less than brilliant decisions about their software. I would not be the least bit surprised to see that as a Slashdot headline after someone squeals.
Brought to you by Carl's Junior.
He may be inarticulate, but he's not wrong.
The entire "computer security industry" is little more than scammers selling nothing but snake oil, i.e., security products which themselves are full of exploitable vulnerabilities and in many cares are very close to being malware.
This argument is why terms need to be defined. You and the GPP are defining "computer security industry" as the set of people and companies that build and sell security products. Even with that definition, the accusation of snake oil is overly broad; there are a few security products which are actually useful. The GP is defining "computer security industry" as the set of people and companies that work on and around computer security, including security researchers that find vulnerabilities, and engineers that fix them and design and build secure systems.
The computer security industry includes a lot of crap, but it also includes a lot of good people and organizations doing good work. Tavis Ormandy is a part of that industry.
An "award" is totally arbitrary and meaningless anyway, anyone can provide an award, for anything, based on any criteria and don't have to even disclose the criteria on which the award is based.
The problem is that people think any of these awards have any value whatsoever, so vendors will take steps to acquire them and use them in marketing material.
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
No it's just that the scammers selling snake oil are noisier, have bigger marketing budgets and are more trusted by those who don't know any better...
There are plenty of competent people out there, doing research, finding and fixing security holes, trying to write secure code themselves and trying to improve the coding and general security practices of others. The problem is that setting things up securely or building secure code requires a high level of (expensive and rare) skills, whereas trusting the snake oil salesman and buying his product does not.
To someone who doesn't understand the technical details, buying a product that claims to magically solve all your problems costs much less than employing people to actually address them.
Plus being horrendously insecure doesn't necessarily mean you will suffer a high profile breach, most organizations have gaping security holes but are either lucky and don't get hacked, or do get hacked but never find out about it. It only becomes a problem if a high profile breach occurs and goes public.
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
Maybe you're right, but I still can't figure out how these guys are scamming us. They sure look innocent.
As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.
Antivirus is borderline useless these days.
Application whitelisting, generally by publisher certificate, is the only way to lock things down meaningfully. Use hash-based exceptions for unsigned apps. Too bad all the tools are priced for enterprise.
SELinux is good, but it takes a lot of work to get it into shape if you are doing anything that lacks an out-of-the-box config.
Behavior-based anomaly detection is the next big thing. But the last I checked, it takes forever to establish your baselines, and false positives are the norm. Too many false positives is like crying wolf. People stop checking the alerts, admins create exceptions with little or no justification, or sometimes there are just too many to investigate individually.
But almost all of these alternatives are better than bloated crapware that only protects you against the oldest and least sophisticated threats. Most malware is spread over half the planet before there is a signature for it.
---
According to the latest ruleset, this post should be modded as Vorpal Flamebait +5.
ALL the awards are paid for, how do you think ICSA Labs survives?
nothing to see here - move along
Nobody is arguing with you after that response.
And the security people who know what they are doing cost more to hire than the H1B's
Religion: The greatest weapon of mass destruction of all time