Slashdot Mirror
Software Security Suffers as Startups Lose Access To Google's Virus Data
Iain Thomson, writing for The Register: Security firms that use the Google-owned VirusTotal malware database but don't contribute to the silo are going to find themselves out on a limb. For the past 12 years, researchers have been feeding samples of software nasties into VirusTotal, allowing antivirus engines to check they can detect malicious code. But the site has seen an increasing number of security startups have been using the VirusTotal data without giving back. Now Google, and other contributors have had enough and have changed the terms and conditions of the website. Put simply, if you don't share samples, you can find your own malware elsewhere.From a Reuters report: The policy change at the information-sharing pioneer VirusTotal takes aim mainly at a new generation of security companies, some with valuations of $1 billion or more, that haven't been contributing their analysis. Older companies, some with market valuations much smaller than the upstart rivals, had pressed for the shift. "If they no longer have access to VirusTotal, their detection scores will drop," said Andreas Marx, chief executive of security software evaluation firm AV-TEST. With detection rates down, hackers will find easier entry.
Some of us share and share and share and share and share and get no recognition for it.
Then the people who don't share, get told they have to share and get immediate recognition if they do.
That makes no sense.
Sounds like the GPL dialed up a notch. Aren't the big guys always pushing the BSD licenses? Do as I say, not as I do, hmmm?
You cannot just consume and hope nobody cares that you don't give back.
Don't build your "startup" on other people's data/API/etc. unless you have a contract. They could change the terms tomorrow and then you're screwed.
... "If they no longer have access to VirusTotal, their detection scores will drop," said Andreas Marx, chief executive of security software evaluation firm AV-TEST. With detection rates down, hackers will find easier entry....
The people who use the products with the poorer detection rates should just switch to products that continue to provide good detection rates, and the hackers will then find entry to be more difficult.
.
If those a/v companies built a ~$1B business based upon the acquisition of free data for which they have no long-term contract to obtain, then those companies do not deserve to continue to be in business.
To put that much money at risk because the supply chain has not been properly vetted is not a good business practice.
What risk? They took someone else's work, added marketing and a price tag. It's pure profit until they get cut off, and then they file for bankruptcy and move to Panama where they can live like kings for the next three generations on that pile of cash.
A few years ago, when there was a US hops shortage, Samuel Adams (the big beer brewing company) made the gesture of selling significant amounts of its hops stock at cost to small craft brewers, to help keep the industry afloat. This helped a significant number of small businesses stay alive and the talent in those companies make a living until the shortage was over.
Given that the malware detection software companies are more like pure competitors to Google, and that software engineers generally are never out of work for a long time, plus that they are generally unlikely to be "grateful" to Google for its charity, I think Google and the database contributors generally aren't expected to give the freeloaders anything.
Signature-based AV is already ineffective to the point of being useless. Trivial obfuscation techniques can and does fool every solution out there.
You don't seem to understand logic.
Let's accept the unstated axiom that those who willfully download pirated media are largely the same group who has no problem with Google doing this. That is still not hypocritical, because even those who download such media acknowledge that the producers have a right to prevent it.
This might go sideways in more ways than VirusTotal realize. For example, consumers might realize that all end-point AV products are highly ineffective and stop buying them.
What risk? They took someone else's work, added marketing and a price tag. It's pure profit until they get cut off, and then they file for bankruptcy and move to Panama where they can live like kings for the next three generations on that pile of cash.
Is this not the way open source and free software works too? A company, say RedHat Inc., takes freely available software, say the Linux kernel, some GNU tools, and assorted other software, and then adds some of their own "secret sauce" proprietary software to charge their customers annual hefty support contract fees.
Yes..... Also; I do think I am going to immediately cease submitting the hundreds of undetected malware samples I get a month to VirusTotal, and look for another venue that is truly open.
It feels to me like this move is totally disingenuous on the part of VirusTotal cutting off their nose to spite their face / intended to harm players in the industry to the benefit of some companies more than others..... The motivation is obviously greed by companies losing some market share who influence VirusTotals' operation.
I would point out that VT concealing their data is detrimental to companies that consider purchasing security products; it erodes vendor trust from the market, which affects everyone, And it reduces malware detection rates for everyone, which can only hurt the public and society at large.
This maybe so, but we're not turning around and trying to make mad money off said movie. Most of us anyway.
Have you ever fallen asleep at the keybhanusdiog?
this is /. please stop making sense and include musk/disrouption at least twice per line.
That crucial piece of information has unfortunately been omitted.
If those a/v companies built a ~$1B business based upon the acquisition of free data for which they have no long-term contract to obtain, then those companies do not deserve to continue to be in business.
I'm interested to know what you think a $1B business actually means?
Remember that $1.8B business called twitter? Did you know that business never made a profit? In fact the same quarter it was valued at $1.8B they made a net loss of $23M.
A valuation is something someone thinks about you, and in the tech industry that is completely devoid of any resemblance of reality. Unfortunately those same unicorn farts that power the valuations can't be used to pay your suppliers. Good business practice really doesn't come into startups because that requires something completely different: money.
You build startups on VC money and over-caffeinated bullshit. You know, fancy slides full of buzzword and graphs of projected future earnings^Wusers going to the moon. "Build it and they will come." And all that.
Not owning the core ingredients that make your business tick? It's outsourcing, baby. It's all on someone else's servers? It's the cloud, baby. Both at the same time? Buzzgasm, oh yeah baby. That's the stuff "startups" are made out of. VC money and over-caffeinated bullshit.
why should these new companies be allowed to continue to use VirusTotal without giving back anything? The companies that do contribute have a cost associated with doing so, but they ALL benefit by contributing in good faith to the same pool. No one is saying these new companies have to lose access, they just won't be allowed to continue leeching the work of others for their own profit. Sounds like the greedy ones are not the contributors...
I'd be more worried about the programmer who thinks of a clever new way to detect viruses while in the shower, but can't easily test how effective it is because there's no large public database of viruses. He can't afford the time or several tens of thousands of dollars to get a dataset just to test out a hunch, so the idea dies on the vine instead of being developed.
As you allude, ideally they'd restrict access for companies with large revenue while keeping it free for the little guy. But the problem with giving stuff away for free is you're not collecting enough info to distinguish the big guy from the little guy.
I'd love to hear a "explain it to me like I was 5" accounting-focused explanation of how a business like Twitter manages to lose money and still pay the bills.
Conceptually it makes sense when a business has been around for some time and had profitable years and then has a year where they lose money -- they might have cash reserves or access to credit to make up the shortfall.
But a shorter-lived business like Twatter that's maybe never made a profit -- they don't have a savings account with reserves built up from previous years' profit because they've never had it.
How does that work? People are willing to loan them the money because of their high valuation? The corporation holds some of its own stock and sells it to provide cash? It's all funny accounting math, and their "losses" aren't actually negative cash balances but a bunch of accounting gobbledygook that "add up" to a loss, but they're actually slightly better than break even in cash flow?
I would point out that VT concealing their data is detrimental to companies that consider purchasing security products; it erodes vendor trust from the market, which affects everyone, And it reduces malware detection rates for everyone, which can only hurt the public and society at large.
That assumes that none of the freeloaders changes their business model and decides to contribute back. It only takes one firm to decide to do so to make the net result improved malware detection for most people.
You're assuming that the end user will correlate their detection rate with this sort of thing. If they didn't happen to read this story, they might continue on blissfully unaware that their vendor now suddenly sucks. You can be sure the vendor won't say a damn thing about it, unless prompted by the customers first.
One wonders though. Why was VT set up? Was it made open to make it possible for more and more security vendors to get good data in order to increase global security? If so, then the failure to give back is a problem, but as long as that data is used, the goal of the project is satisfied. More security.
What is happening is that there appears to be some who are able to leech. Well... to some degree, that is merely an extreme use case of what VT was intended for. Even if they don't give back, they are improving global detection of malware to the collective benefit of everyone.
As for the competition... here is my question. Why is it that these "old school" contributors don't have the billion dollar valuations? Clearly, they've been doing this longer and they have experience. I can understand why they wouldn't want to feed their competitors who aren't sharing with them, but if this had been meant to be a security cartel to begin with, the rules would have started that way. To me, it is clear that these leechers are better at something than the sharers, either technically, or in marketing, or whatever. Admittedly, they're hitching a free ride, but couldn't it be argued that VT was basically set up to encourage the growth of good detection and these companies are pushing that forward?
I'm not totally defending these leechers. Without contributions, the database isn't going to go anywhere, and if the leechers put the contributors out of business, then not only is there no reason to contribute, but the leeches will end up killing themselves by out-competing those who actually make it possible for them to detect viruses and malware.
So for all the reasons above, I agree that a common sense contribution policy or at least a subscription rate for the data should be implemented which could be used to compensate contributors and Google for their efforts.
However, rather than slam the leeches for leeching, I think leeches should be *encouraged* until it gets to the point where they no longer need the help to get off the ground, and then they should either contribute, or alternately, pay for their data. We want to get new companies off the ground to add global security capacity and expertise. We just don't want the leeches to be parasites who kill the host in the process.
"On Wednesday, the 12-year-old service quietly said it would cut off unlimited ratings access to companies that do not share their own evaluations of submitted samples" ref
By not sharing their own evaluations these companies are also facilitating the hackers, are they not. Does software evaluation firm AV-TEST contribute their own evaluations to VirusTotal?
"With detection rates down, hackers will find easier entry."
On the other hand, if these self-serving leeches would give back anything they learn themselves to the project - detection rates across the board will be UP.
Besides, detection rates won't go down -that- far. As soon as people start noticing their AV of choice has become a piece of shit at actually doing it's job, they'll move to a competitor - likely one that isn't being a leech, at which point their own detection rate won't drop at all.
The only thing that's really going to drop is the market share of those leeches.
CrowdStrike has been all over my local ISSA the last year pimping their crapware. This is pretty ironic considering VirusTotal is a Google service and CrowdStrike has been selling themselves on the fact Google gave them 100 million in capital.
The motivation is obviously greed
Um, what? Asking / requiring people to contribute and share is now considered greed?
Except that's a horrible comparison since, as I recall, Red Hat is actually one of the single largest contributors to the Linux kernel, etc.. They do give back, and dramatically so, they just *also* include a lot of "value added" software and support to make their distro more attractive than the competition. If you don't want to pay for the value added stuff, then I believe CentOS is still offering the core Red Hat distro sans "secret sauce".
--- Most topics have many sides worth arguing, allow me to take one opposite you.
How does that work? People are willing to loan them the money because of their high valuation?
Exactly. Cashed up VCs chasing unicorns with the hope of a part of the pie of a multi-billion dollar IPO. What wallstreet maketh silicon valley vapourises into the ether.
See subject & before it can get you blocking sources of it APK Hosts File Engine 9.0++ SR-4 32/64-bit http://www.bing.com/search?q=%...
Less power/cpu/ram + IO use vs. DNS/routers/antivirus + less security issues/complexity. Compliments firewalls (w/ layered drivers blocking less used IP addys vs. hosts blocking more used domains) & DNS (lighten dns load). Gets data via 10 security sites.
Ads rob bandwidth/speed paid for, security (openbid adnetworks abuse), privacy in tracking + anonymity.
Hosts add speed (hardcodes/adblocks), security (bad sites/poisoned dns), reliability (dns down), & anonymity (dns requestlogtrackers) natively. Hosts != blockable by ClarityRay (like. souled-out to admen inferior wasteful redundant slower usermode browser addons)
Works vs. caps & HTTP PUSH ads w/ firewalls.
APK
P.S. - Safe https://www.virustotal.com/en/... (Verified by Malwarebytes' S. Burn "I've seen the code & yes it is safe" http://forum.hosts-file.net/vi... )
And I get that with VCs and startups before they go public, and the spend money to make money concept. I've been around too many under-capitalized businesses and totally get the idea of losing money building up a foundation for future growth.
But Twitter as an example already has done an IPO and in theory is past the point at which VCs sink money in -- the stock is already issued.
I'm guessing at Twitter's scale the idea that they are losing money is mostly nominal, and that the business isn't absolute, negative cash flow and that substantial portions of their losses are paper losses, with the real portion of the loss something they can kick down the road a fair number of times before it becomes a meaningful problem -- you issue bonds, collect the cash, and then issue new bonds to pay off the old bonds and collect the extra cash, ad nauseum until you've taken on so much debt it just collapses.
why should these new companies be allowed to continue to use VirusTotal without giving back anything? The companies that do contribute have a cost associated with doing so
The problem is they mean something very specific by "Giving back"; They have to adapt their scanner, so their scanner is one of the scanners that VirusTotal checks samples against. And VirusTotal in their own words admits why this is not applicable to all scanners..... VirusTotal's antivirus engines are commandline versions, so depending on the product, they will not behave exactly the same as the desktop versions: for instance, desktop solutions may use techniques based on behavioural analysis and count with personal firewalls that may decrease entry points and mitigate propagation, etc.
The cost is negligible if their tool is scanner that analyzes a file statically, and Non-negligible for startups whose security tool is not a file-based scanner.
They mention techniques based on behavioral analysis, BUT some of the important tools are based almost SOLELY on behavioral analysis or techniques which cannot be incorporated into an offline scanner integration.
So VT's requirement may be unreasonable.
Asking people to contribute back would not be greed, But (1) That's not what they are asking, And (2) I am implying an ulterior motive driven by other companies who have a reason for pursuing this which is not what it is stated.
If an antimalware vendor has not integrated their tool into VT, because their methodology doesn't lend itself to a program that "scans a specific file", then VT provides them no chance of participating.
It's not like VT offers them a chance to pay for it or make a donation, or contribute their research..... if the vendor doesn't make their tool one of the scanning engines that VT uses, then they can no longer get the data or participate.
So it's extremely disingenuous to say they are "freeloaders" or unwilling to contribute security research back, since that's not the criteria VT is requiring, appparently
there's no trust in this market due to these leeches. And BTW, this is the proper way to spell "leeches". And I'm sure you're hundreds of submissions / month will bring the industry to its collective knees. Grow some humility, ass hat.