Antivirus Software Is 'Increasingly Useless' and May Make Your Computer Less Safe (www.cbc.ca)

Emily Chung, writing for CBC: Is your antivirus protecting your computer or making it more hackable? Internet security experts are warning that anti-malware technology is becoming less and less effective at protecting your data and devices, and there's evidence that security software can sometimes even make your computer more vulnerable to security breaches. This week, the U.S. Department of Homeland Security's Computer Emergency Readiness Team (CERT) issued a warning about popular antivirus software made by Symantec, some of it under the Norton brand, after security researchers with Google's Project Zero found critical vulnerabilities. "These vulnerabilities are as bad as it gets. They don't require any user interaction, they affect the default configuration, and the software runs at the highest privilege levels possible," wrote Google researcher Tavis Ormandy in a blog post. Symantec said it had verified and addressed the issues in updates that users are advised to install. It's not the only instance of security software potentially making your computer less safe. Concordia University professor Mohammad Mannan and his PhD student Xavier de Carne de Carnavalet recently presented research on antivirus and parental control software packages, including popular brands like AVG, Kaspersky and BitDefender, that bypass some security features built into internet browsers to verify whether sites are safe or not in order to be able to scan encrypted connections for potential threats. In theory, they should make up for it with their own content verification systems. But Mannan's research, presented at the Network and Distributed System Security Symposium in California earlier this year, found they didn't do a very good job. "We were surprised at how bad they were," he said in an interview. "Some of them, they did not even make it secure in any sense."

Comments

You Misspelled Title

[zenlessyank]

ilcreasingingly

What the fuck

[Anonymous Coward]

Slashdot editors are INCREASINGLY useless

Re:What the fuck

[Raistlin77]

It's not possible to be increasingly useless. They could be increasingly less useful, but useless already means that they are no longer useful in any way.

Unfortunately for us readers, they became useless years ago.

Re:What the fuck

[Anonymous Coward]

"increasingly less useful"

Ow! My eyes! What's wrong with "decreasingly useful"?

Re:What the fuck

[Anonymous Coward]

Ow! My eyes! What's wrong with "decreasingly useful"?

That "increasingly useless" covers it better?

Re:What the fuck

[Yvan256]

How about "more better less decreasingly not anymore useful or less"?

Re:What the fuck

[Captain Splendid]

It's not possible to be increasingly useless.

Clearly someone wasn't around to witness eight years of George W Bush.

Re:What the fuck

[Anonymous Coward]

Except "uselessness" is a binary state, either something is of absolutely no use (useless) or has some quantity of usefulness. There is no gradient in between to be more or less useless.

Ha haaaa. Semantics.

Re:What the fuck

[I4ko]

doubleplusunuseful

Re:What the fuck

[sexconker]

You can't be "increasingly less useful" when comparing to yourself.
You can be "increasingly less useful" when comparing to something else, but it doesn't mean what they intended.

If A is increasingly less useful than B, then:
A is less useful than B.
A's usefulness is increasing.

If A is increasingly less useful (than A), then:
A is less useful than A (at some prior point in time).
A's usefulness is increasing (compared to A at that same prior point in time).

That's a contradiction. It makes no sense.

If you don't want increasingly to modify useful, you really need to use that hyphen and write "increasingly-less".
On the other hand, you would do well to write "increasingly and less useful" or "increasingly, less useful" to be more clear for the upward trend.

The best bet, however, is to write "decreasingly useful". The word "decreasing" contains the direction in it, so you don't need to try to negate "increasingly" with "less" and make a mess of things.

Re:What the fuck

[TechyImmigrant]

It's not possible to be increasingly useless. They could be increasingly less useful, but useless already means that they are no longer useful in any way.

Unfortunately for us readers, they became useless years ago.

It was already useless. What has happened is that it has become more robustly useless. There are multiple ways in which is it useless and any one of those ways is sufficient. Making it partially useful required fixing all the problems that make it useless. By adding more problems that ensure it is useless, its uselessness is rendered more robust against attempt to fix or justify it.

Re:What the fuck

[Anonymous Coward]

Double secret unuseful.

Re:What the fuck

[mschwanke97402]

You folks are just using too many syllables. How about "less useful" as in "less useful by the day".

Re: What the fuck

[Anonymous Coward]

The anti-malware software is less useful or useless or dangerous to use. The article contains statements that indicate what the antivirus programs have, in some tests, shown to have an increased vulnerability to malicious attacks.

Re: What the fuck

[TechyImmigrant]

How far does one have to go to get a funny mod around here?

Having Symantec Comment On Antivirus Info

[zenlessyank]

Is like having a guy with peanut allergies pushing Planters products.

Re:Having Symantec Comment On Antivirus Info

[arth1]

Is like having a guy with peanut allergies pushing Planters products.

I bet that drives you nuts...

Re:Having Symantec Comment On Antivirus Info

[Anonymous Coward]

I guy walks into a bar with a steering wheel on his groin...

Re:Having Symantec Comment On Antivirus Info

[mrbester]

A dry roasting there...

Clicking on attachments

[martyros]

After a recent debacle where Symantec apparently didn't get the proof-of-concept exploit sent to them by a security researcher because the mail filter automatically opened the document and crashed, I friend of mine joked that antivirus software was actually a tool to "automatically click on attachments for you".

that hyperbole though

[Anonymous Coward]

ok look, i do some malware analysis.

the thing is, 99% of the malware you run into is run-of-the-mill stuff.

to paraphrase someone who was talking about EMET:

not running AV because some researcher are doing next-level shit is like not wearing your seatbelt because a sniper might get you.

Tavis Ormandy has uncovered a shit-ton of serious vulnerabilities in some big name AV / Endpoint Protection products. Great! Those will get fixed and life goes on. There are also some AV suites that taviso has NOT found bit problems in.

keep in mind also that some other big names in "next level" endpoint protection and security services who monetarily gain from pushing the idea that "endpoint security is dead".

Re:that hyperbole though

[EndlessNameless]

not running AV because some researcher are doing next-level shit is like not wearing your seatbelt because a sniper might get you

To extend your analogy, we are now driving at speeds that render the seatbelt inadequate. While it may still be wise to buckle up, we need a better seatbelt design, a supplementary measure, or a replacement.

Right now, we have IDS/IPS applications and ad/script blocking as reasonably good supplements. But even that isn't enough anymore---just as adding an air bag isn't enough to make a car safe at racetrack speeds.

There are suitable solutions for enterprise where the budget and administrative skills can support it, but there is really nothing for home users.

Re:that hyperbole though

[swillden]

the thing is, 99% of the malware you run into is run-of-the-mill stuff.

Which Windows' built-in antivirus protection will stop.

not running AV because some researcher are doing next-level shit is like not wearing your seatbelt because a sniper might get you.

Nonsense. There's nothing "next level" about this. What Tavis found is that running vulnerable A/V software adds a large and easily-exploitable attack surface to your system. The fact that most current-generation malware isn't exploiting these bugs yet doesn't mean they won't, soon.

Tavis Ormandy has uncovered a shit-ton of serious vulnerabilities in some big name AV / Endpoint Protection products. Great! Those will get fixed and life goes on.

And how many more will be added? A/V software adds attack surface to your system, running at high priority. That's bad. In the past it was a net win because the base OS did nothing to protect against malware, but that's no longer the case. Does Symantec actually provide additional protection over Windows Defender? If so, how do you balance that against the additional risk it adds?

Re:that hyperbole though

[chispito]

99% of the malware you run into is run-of-the-mill stuff

You're likely casting as wide a net as you can to find that malware. The malware that actually works its way through the Internet to the endpoint of an average person will also sail on by standard AV because there are no definitions for it yet. I'm not talking Stuxnet, I'm talking the same run-of-the-mill malware that you are, just slightly tweaked to require a new definition/hash.

There are products that are good at stopping even re-hashed malware (Cylance), but they are effective in part because nobody is writing malware specifically to evade them (and Cylance does no remediation; if the malware gets by it, you're not going to get a definitions update that same afternoon to help you contain it).

Re:that hyperbole though

[I4ko]

ahh, but there is. two ways at least - durex and plain old water. If your computer has only a wired connection you need to put the connector in the durex condom before placing it into the socket. The condom prevents electrical connections, hence network is not connected, hence less need to worry. If your computer also has a wireless network connectivity submerging it into water will sever the wireless connection hence you don't need to worry. There aren't good reasons to have tons of computers networked to the open internet..

Re:that hyperbole though

[Anonymous Coward]

You do realize how Cylance works right? It doesn't actually need definitions. That's the entire point of the service. So when there's a new variant created 10 minutes after the initial variant is patched, Cylance blocks that.

Re:that hyperbole though

[Anonymous Coward]

I work in the AV field, and I can tell you for certain that modern AV is not all signatures and hashing, there is a ton of behavioral and IDS type stuff that is included in the suite as well. Additionally the comment about outfits like Cylance having a significant monetary incentive to spout misinformation like TFA is spot on.

Re:that hyperbole though

[whoever57]

not running AV because some researcher are doing next-level shit is like not wearing your seatbelt because a sniper might get you.

I think that a better analogy is that not running AV is like disabling the Takata airbag on your Honda.

Re: that hyperbole though

[Anonymous Coward]

"Endpoint" is one of those terms that when you hear somebody using it, the proper action is to terminate their processes with a claw hammer.

Re:that hyperbole though

[Khyber]

" What Tavis found is that running vulnerable A/V software adds a large and easily-exploitable attack surface to your system."

I would argue he didn't find shit. Stupidity like this has been known since startkeylogger/stopkeylogger in Norton products. He's only re-iterating that AV products are simply shit, much like other 'security' solutions ACs tend to post here.

Re:that hyperbole though

[chispito]

You do realize how Cylance works right? It doesn't actually need definitions. That's the entire point of the service. So when there's a new variant created 10 minutes after the initial variant is patched, Cylance blocks that.

Except their patching cadence is measured in weeks or months, not hours.

Re:that hyperbole though

[rtb61]

The correct slashdot car analogy. Is anti virus software is like a really secure armoured truck that will protect you money but they armoured truck comes from an unsecure yard where anyone can take it over and then drive up and take your money. The antivirus software can still secure you hugely unreliable operating system, it just can not secure itself because they failed to pay attention to that part and because the security software stuck itself in with root access, hack the security software and you gain control of the operating system.

Re:that hyperbole though

[Anonymous Coward]

Cylance PROTECT is available for home users (now) from https://www.malwaremanaged.com ; whereas it had only previously been available to large organisations.

Re:that hyperbole though

[Anonymous Coward]

Home users have chromebooks and chromeboxes that will do what most people want to do, without fear of infection.

Re:that hyperbole though

[NotAPK]

My friend and I wanted to capture someone's password.

So we fired up .NET and Googled for a code snippet and used that to write a very simple little program that ran on Windows 7 and wrote key-presses to a file on the local HDD. Nothing fancy. The whole time I thought this would never work, since while our program was completely unknown to the AV software, surely the API hook and overall pattern (as you mention above) would be trivial to detect.

Our program worked perfectly and was never detected by any of the anti virus programs we tested it against.

We got the password.

The experience really scared the crap out of me, and since then I've been exceedingly paranoid about trusting sources of software more than AV.

Re: that hyperbole though

[Veretax]

Would that be the same Takata airbag that is recalled what unions and millions of airbags for defects from the last two years?

Re: that hyperbole though

[whoever57]

That's my point. The airbag might save your life in an accident, or it might kill you.

Re:that hyperbole though

[peawormsworth]

the thing is, 99% of the malware you run into is run-of-the-mill stuff.

Which Windows' built-in antivirus protection will stop.

I think you missed the point that Windows is a virus.

Did you even read the EULA before clicking to accept?

Re:that hyperbole though

[swillden]

the thing is, 99% of the malware you run into is run-of-the-mill stuff.

Which Windows' built-in antivirus protection will stop.

I think you missed the point that Windows is a virus.

Did you even read the EULA before clicking to accept?

No, because I don't use Windows. I switched to Linux in 1999 and have never gone back. Well, these days I also use OS X.

But anyway, that's irrelevant, because in the context of this conversation Windows is a given. The question is, if you are already using Windows, whether or not you should also install an anti-virus product.

Adblock

[Anonymous Coward]

I think installing an adblocker in your webbrowser is probably the best antivirus available today.

Re:Adblock

[tnk1]

Best antivirus in a qualitative sense? Probably not.

Best antivirus in the sense that it blocks the source of significant amounts of malware, yes.

It does need to be pointed out that you're going to cut down considerably on malware by closing that channel, but you're still toast if you are opening attachments or you are the target of a specific attack which is less scattershot than an ad network.

We do need something *like* dedicated antivirus. It just has to be light-years better than the bloated crap that goes for AV today.

 

Re: Adblock

[Type44Q]

And NoScript, and a custom HOSTS file... or just run a proper OS. ;)

Re:Adblock

[Anonymous Coward]

For people that don't open attachments, and are more resistant to Trojans, malvertising is probably the top infection vector there is.

I did a test on this a few years back. VM #1 running XP hasn't been patched, other than the browser (Firefox), and doesn't have any AV on it. VM #2 was patched all the way with Windows and all applications and add-ons (Flash, Acrobat, etc.) has all AV stuff, but no ad blocking.

I used VM #1 for dedicated web browsing for a long while, and when I shut it down, mounted the virtual drive, scanned it as well as used Autoruns to look at the registry, it was clean. VM #2, which was used for browsing a few mainstream social media sites was nailed in less than ten minutes with pop-up scareware ads, then software using a third party add-on exploit.

Moral of the story: I can go without AV and have a clean system. AV doesn't do anything against malvertising, and with the advent of sites using Flash + EME to protect their content, AV only adds complexity, expands the attack surface, and does nothing.

Re: Adblock

[bytestorm]

It'd be nice if this proper OS existed at the present time because I'm not going back to Amiga despite its lack of viruses. I'm reading between the lines here, but I infer you are setting up Linux or a BSD variant as this hypothetical proper OS, all of which have their fair share of vulnerabilities and are even harder for non-technical end users to configure correctly to avoid problems.

Re: Adblock

[arth1]

I'm not going back to Amiga despite its lack of viruses

This is rather funny, considering that the Amiga was infamous for its plethora of viruses.
Some of which were rather amusing, like playing a song with the stepper motor of the floppy drive, or using any modem found to dial the home phone number of an Antivirus creator, or randomly inserting words like "sex" in any text files. All in the 1kB boot block.

Re: Adblock

[Anonymous Coward]

Some an virus software actually installs browser ad bars and other junk , so it's hard to differentiate between a vendor of security software and a sleazy bastard

Re:Adblock

[pr0fessor]

My brother and I were talking the other about how things appeared to have changed over the years and how the line between legitimate program and scourge of the internet is awfully thin.

 

Re:Adblock

[Etcetera]

For people that don't open attachments, and are more resistant to Trojans, malvertising is probably the top infection vector there is.

Moral of the story: I can go without AV and have a clean system. AV doesn't do anything against malvertising, and with the advent of sites using Flash + EME to protect their content, AV only adds complexity, expands the attack surface, and does nothing.

BS. "Malvertising" doesn't exist fundamentally at a technical level any more than "malshareware" exists. The problems are, respectively, vulnerabilities in flash/imagemagick/browser software/etc and intentionally subversive code that doesn't do what it claims to do. "Restricting advertising" as an AV response is catching things in the dragnet, but that's much more just rationalizing the fact that you just don't want to see ads on websites.

We've all seen parents' and friends' computers that didn't have AV software installed and the sh*tshow they usually are, and it's not because they saw banner ads but because they got infected with viruses. Is AV foolproof or guaranteed to catch everything? Of course not. Does it run as a privileged process and thus require extra scrutiny in the privileged code sections? Of course. So does sudo. But most people are much better off with AV software than without, notwithstanding the fact that people at heightened risk should have even more layers of protection.

Re: Adblock

[UnknownSoldier]

> considering that the Amiga was infamous for its plethora of viruses.
> Some of which were rather amusing, like playing a song with the stepper motor of the floppy drive, ..

Go on ...

Now I've heard of Beagle Bros' "Silicon Salad" TL:CHUGGACHUGGA for the Apple ][ before

0 REM AJIT JOSHI--CANTON,MI
1 HOME: POKE 50,223:FOR X = 150 to 255:SPEED=X:PRINT PEEK (49385) + PEEK (49386);:PRINT "CHUGGA";: PRINT PEEK(49387);:NEXT:END

but I haven't heard that about one !

Re: Adblock

[Anonymous Coward]

"So does sudo. But most people are much better off with AV software.."

The big difference being, you run sudo when YOU want and want more privelage. Antivirus runs at that level of privelage 24/7.

Plus there are known exploits for A/V right now. Not so much for sudo.

Re:Adblock

[thoromyr]

Nice to hear someone without a clue comment on the topic. Speaking as someone who actually works in an IT security position (responsible for a ~8000 node network or so -- you have to decide how you're going to count it...) there are two basic measures that cut the majority of infections off at the knees:

1) block advertising

2) blackhole DNS

While some advertising industry shills get very shrill about #1, the problem is solidly in their court due to their increasingly obvious inability to stop malware from being delivered as advertising. I've posted before about why the problem exists and it is easy enough to learn more on the topic so I won't belabor that point further.

The idea behind blackhole DNS is that you discover a domain name is bad and you prevent hosts on your network from being able to resolve. More precisely, you resolve it to a server that will happily deliver a message about content having been blocked.

Blocking advertising is better because it does not rely on prior knowledge or a threat feed. It is simple, easy and very effective. But if you have a good threat feed then blackhole DNS is also quite effective. Sure, someone *else* paid the price already, but now the rest of the population is protected.

*Most* security professionals would not recommend eliminating AV (although in many cases that is solely to maintain the ability to check the box in audits) and it does serve a purpose (either as a canary or blocking old school malware).

EMET and related techniques aim for generic protections, but they are only relevant after the malware is already on the system and it is obviously better to prevent that from happening in the first place. Defense in depth means that additional measures are good, but they should never been seen as a replacement.

Re: Adblock

[thoromyr]

Aspiring programmers created many viruses for the Amiga. If memory serves, LAMER was one of the more prevalent ones. It was so-named for being targeted at pirates (and quite possibly written by a commercial software programmer). The Amiga had *zero* security features. Any application could write to any portion of memory which made poorly written but otherwise non-malicious software a problem for system stability. It was an inherently single-user system. File attributes are not protection. RDB permitted the inclusion of arbitrary code that would be loaded on demand when a drive was scanned (this was intended to allow a drive to provide its own file system drivers, but like many such cool features no one had given security even a passing thought).

However, *most* of the "viruses" on the Amiga were toys or jokes -- there weren't that many with malicious intent (though see LAMER) -- so users often were not particularly concerned about them.

Re:Adblock

[dcooper_db9]

Perhaps. But the biggest vulnerability in Windows computers (for home users) comes from users running as an administrator. The Windows install process should really be changed to setup an administrator account as well as a standard user account. Very few users get viruses when they have to elevate privileges.

I currently have 117 home and small business clients that I've educated about this. I create a new administrator account and change their original user account to standard. Only one of my clients that made the change have had a virus infection in the past three years. Almost all of my clean-up business comes from the people who continue to run as admin. And yes, I sometimes wonder how much money I'm losing by doing this.

Re:Adblock

[Anonymous Coward]

There is plenty of damage that can be done using just a regular user account. What really needs to be done in Windows is better partitioning of programs into different users and have some real form of POLA by adding teeth to access control, capabilities, and privilege separation.

Re:Adblock

[Anonymous Coward]

Bullshit. Even running as a non-admin, there is still a lot of malware that will happily run under the user account to show ads / steal authentication information / encrypt all the user's accessible files.

NoScript / FlashBlock has been a requirement for 10+ years now in order to keep you safe from drive-by infections. Blocking executables / infected files at the mail server is a second requirement.

The only advantage that running as a non-admin might give is that damage is limited to just the files that the user can normally write. But that goes out the window as soon as the attacker has a working privilege escalation exploit.

Re: Adblock

[arth1]

Then this will blow your mind :)

Re: Adblock

[UnknownSoldier]

That is freaking AWESOME! Got any more cool hardware hacks?!

And here I thought Oscifun was amazing!

Oscillofun on Tektronix 2245A
* https://www.youtube.com/watch?...

Re: Adblock

[cwsumner]

... The Amiga had *zero* security features. ...

In those day, -most- computers had zero security features. Big computers had locked doors. Micro-computers, no one seemed to care.
Microsoft grew up in those days, thats why they don't really understand security or multi-thread stuff.

In fact, tech people working on "micro-computers" hated big IBM and DEC so much that a lot of things were left out because it was "big computer trash, we don't need that" !

Except that the "micro-computers" that we are working on, now, are much bigger and more powerful than the "big" computers were back then. A change in mindset is needed...

News from Canada

[Anonymous Coward]

As usual anything coming out of Canada is 10 years out of date.

Re:News from Canada

[mark-t]

Which is kind of funny, because I'm from Canada, and I realized this 20 years ago (while working as a tech support minion for a branch of the federal government, actually).

Eh?

[Anonymous Coward]

Haven't anybody realised that Kaspersky is basically a spyware?

Intrusive

[Anonymous Coward]

The problem with AV software in my eyes is how intrusive they've become, they're worse than viruses in some cases

You install, say, Kaspersky and you immediately get 2 browser plugins installed into Firefox, 3 root certs get dropped into Windows certificate list and kasperskylabs.net scripts get injected into every page you visit, even if you turn the "web shield" off
Not to mention those garbage software "firewalls" that hardly give you any control over anything. Though for instance Avira does it differently, it just takes over Windows Firewall for you and won't even let you turn that "freature" off, so screw you if you configured it by hand.

Just use appropriate browser plugins, Windows Defender, Malwarebytes and common sense.

Re:Intrusive

[Archangel Michael]

Just use appropriate browser plugins, Windows Defender, Malwarebytes and common sense.

That last one, "common sense", doesn't exist. Click here for a free iPad!

Re:Intrusive

[RKThoadan]

They say antivirus is useless but it blocked your nefarious link. Ha!

Can I still get my free iPad?

Re:Intrusive

[Dorianny]

The problem with AV software in my eyes is how intrusive they've become, they're worse than viruses in some cases

You install, say, Kaspersky and you immediately get 2 browser plugins installed into Firefox, 3 root certs get dropped into Windows certificate list and kasperskylabs.net scripts get injected into every page you visit, even if you turn the "web shield" off Not to mention those garbage software "firewalls" that hardly give you any control over anything. Though for instance Avira does it differently, it just takes over Windows Firewall for you and won't even let you turn that "freature" off, so screw you if you configured it by hand.

Just use appropriate browser plugins, Windows Defender, Malwarebytes and common sense.

This is all an attempt at branding and making their product highly visible to the user. its purpose is to make it seem to the user that it absolutely imperative they renew their "subscription service" and are getting good value out of it. As far as anti-virus engines go, MS-defender is consistently ranked towards the bottom of the list and most 3d party engines do a better job of actually catching and cleaning infections, however when they add all these components to their "suites" which needlessly replace other system-components and put in place unnecessary addons, they make the system less secure

Re:Intrusive

[Anonymous Coward]

Defender has a different job than other AV products. What it is supposed to do is get what poses the largest risk to everyone. It doesn't matter that it scores poorly on the latest viruses released 10-minutes ago, it catches the ones getting people in real quantity. You can see that in tests that test samples with real age or that have actually infected a certain amount of computers.

No shit

[JustAnotherOldGuy]

"Antivirus Software Is iIncreasingly Useless' and May Make Your Computer Less Safe"

Ignoring the typo, all I can say is, "No shit, Sherlock."

And it's been this way for at least 5 years, not including the abortion known as "Norton", which was worse than the viruses it claimed to prevent.

Their motto should have been, "Got a nice, new PC that runs really fast? No problem, Norton Antivirus can fix that!"

Re:No shit

[Anonymous Coward]

"Antivirus Software Is iIncreasingly Useless' and May Make Your Computer Less Safe"

Ignoring the typo, all I can say is, "No shit, Sherlock."

And it's been this way for at least 5 years, not including the abortion known as "Norton", which was worse than the viruses it claimed to prevent.

Their motto should have been, "Got a nice, new PC that runs really fast? No problem, Norton Antivirus can fix that!"

Yes, the best way to get rid of viruses is to reset the computer and start over. If AV software sees the virus in or on memory it is already too late. Antivirus software has caused me more problems than it has solved over the years.

Re:No shit

[Anonymous Coward]

In my situation, I use a combination of NOD32 and Faronics Deep Freeze. Also, a hosts file to block ads. But I think smart surfing would help too.

Re: No shit

[Type44Q]

I remember that shit being so bad that at one point I had to hunt-down a third party program just to remove it since it was clearly designed as a virus itself...

Re:No shit

[Desler]

"Smart surfing" only works in a world in which servers don't ever get breached. We don't live in such a world.

Re: No shit

[JustAnotherOldGuy]

I remember that shit being so bad that at one point I had to hunt-down a third party program just to remove it since it was clearly designed as a virus itself...

Yeah, Norton had to write a tool just to remove their own shit.

The "Norton Removal Tool" is still available from the Norton site, which should tell people all they need to know about Norton.

Re:No shit

[mlts]

For front-line Web browsing at home, I run a Windows instance in a VM and browse with that. Every so often, I roll back to a snapshot, and continue browsing from there. If the VM gets infected, since it sits behind a PFSense virtual router which is configured to block any traffic going anywhere but out the gateway, block outgoing port 25, and other sanity rules, the VM is limited of what damage it can do.

Re: No shit

[Etcetera]

I remember that shit being so bad that at one point I had to hunt-down a third party program just to remove it since it was clearly designed as a virus itself...

Yeah, Norton had to write a tool just to remove their own shit.

The "Norton Removal Tool" is still available from the Norton site, which should tell people all they need to know about Norton.

Why is that a bad thing? I'd prefer a separate tool to fully remove, rather than the normal Windows Uninstall being programatically accessible. Hell, if I install my AV, I'd love for a specific YubiKey being needed by some authoritative process to remove it.

We shouldn't be trying to get the computer to do things for us, because that makes things more vulnerable to malicious cyberspace actors. Pumping that back into meatspace (hey, how about we bring DIP switches back and require them to be flipped to write to BIOS again) forces humans back into the loop. Physical security and intrusion detection is a hell of a lot more of a solved problem than IoT security.

Re: No shit

[JustAnotherOldGuy]

Why is that a bad thing?

Found the Norton user. Lol, just kidding. If you had Norton running you'd be unable to browse the web, let alone post on slashdot.

-

I'd prefer a separate tool to fully remove, rather than the normal Windows Uninstall being programatically accessible.

That just means the malware would have to find a way to spoof that. It's not a solution, it's a minor impediment as long as the system has write privileges.

-

(hey, how about we bring DIP switches back and require them to be flipped to write to BIOS again)

Actually I'd be all in favor of this, and I'm dead serious. For something like BIOS updates and changes, I'd very much like to have a physical switch that can't be manipulated by software no matter what it wants.

This is the reason...

[Anonymous Coward]

I now use Chrome, even though I don't like it as a browser. Chrome does better than any other browser besides Opera (sadly sold to Chinese, so cannot be trusted) regarding protecting users whilst they surf. I don't like Chrome, but Opera, my old standby, went batshit crazy and allowed themselves to get bought by the Chinese. AV software has long been useless. I've never bought or used it besides what I'm forced to use at work. One of the simplest settings to prevent malware, at least on a Windows machine, it to surf the Internet with a Standard user account--never one with Administrative privileges. This alone will stop 95% of trouble before it starts.

Use Chrome for banking, not IE or Edge. Don't surf the Web with the same browser you're banking with. Don't do it. I use Incognito mode to log into my bank and open no other windows until I've logged out. I surf non-important things with Firefox.

Re:This is the reason...

[mlts]

Even if malware gets your user account's context, it still can do a lot of damage. Ransomware only needs user access to do its dirty deeds, and botnets and BitCoin miners can run well without needing anything from the admin account.

I also recommend Sandboxie if one doesn't want to use a full virtual machine. If the browser gets compromised, it still is only in the sandbox. It can't get to a user context, much less one with admin rights. With the ability to redirect all writes to a separate filesystem, if malware decides to do something annoying like (mkdir foo, cd foo, repeat), you can just format that filesystem and be done with it.

Increasingly?

[Anonymous Coward]

That's a politician's word.

Antivirus never did much except provide income for the vendors.

Blacklist vs. whitelist

[tepples]

Antivirus software that detects apps known to be harmful is a form of blacklisting. But as a general rule, blacklisting is considered less secure than whitelisting. An antivirus using whitelisting, such as PC Matic, allows only known good apps to run.

The obvious problem with this approach is who defines the set of known good programs. In a corporate environment, an IT department has the resources to review the programs on which employees rely. But a home PC owner who isn't quite a PC expert may not feel qualified to do this, instead delegating review to a trusted party. This has led to cases of rent-seeking, where a gatekeeper demands payment from each developer to review each app.

Bruce Schneier explains further

Re:Blacklist vs. whitelist

[hibiki_r]

And the moment you put a whitelisting antivirus on a programmer's machine, who will often compile their own executables, the corporate plan goes to shit anyway.

Just like how IT departments often make programmers' kufe hell by not make exceptions for a directory used for compilation and artifact downloading. Triple your compile times for no good reason!

Re:Blacklist vs. whitelist

[the_Bionic_lemming]

Yup, Mcafee regularly deleted an application we sold to about 90 people worldwide. Every single time we issued an update.

Whitelisting is great if you are a million plus user base, but costly to small business catering to just a few clients.

Re:Blacklist vs. whitelist

[phantomfive]

Whitelisting doesn't help when adding a whitelist creates an exploitable remote vulnerability that doesn't require user interaction, like Symantec and TrendMicro

Re:Blacklist vs. whitelist

[Anonymous Coward]

why are they compiling executables on their own machine, where you don't know what dependencies are being used, etc.

There are these things called build servers ya know? and like continuous integration, automated testing, etc... That way that executable compiled in the build env. is the same as the other 20 revisions, and don't have weird dependencies on some stupid crap the developer installed on their computer months ago and forgot to uninstall it.

Re:Blacklist vs. whitelist

[Samizdata]

Plus, the whole whitelisting argument is predicated on the fact the whitelisting app is stable and unassailable. Speaking of PC-Matic, don't know if you have checked, but the VirusBTN tests have frequently cited stability issues for it. So, how's your whitelister going to whitelist if it has crashed or locked up?

i don't know

[Anonymous Coward]

never used any

Stupid Software Design Decisions

[nateman1352]

Seriously why the hell does Antivirus software need to run its scan engine at Admin group privileges, and why is half of the scan engine running in Ring 0 kernel drivers?

Its amazing, my work laptop BSODs about once a day just because of some crappy driver included in the Antivirus software installed by IT.

Since it crashes that frequently just in normal operation it seems likely that there is at least 1 vulnerability in that driver which is exploitable from user mode.

Re:Stupid Software Design Decisions

[Anonymous Coward]

Your work laptop shouldn't BSOD once a day. Tell them to hire new IT staff because they don't know how to install the proper drivers.

Re:Stupid Software Design Decisions

[cbiltcliffe]

If the scan engine wasn't running as Ring 0 kernel drivers, then it wouldn't be able to detect Ring 0 rootkit drivers, and other such crapware. Since we know there are kernel vulnerabilities which allow infection with Ring 0 malware, not running your scanner at least partially in Ring 0 would make it even less useful than it currently is.

Re: Stupid Software Design Decisions

[nateman1352]

Since the whole point of it is security it really makes sense to have two copies of your scan engine installed, one in Ring 0 for early boot rootkit detection that scans every driver as it loads and only scans if the binary passes MSFT's driver signing checks first.

All of your scanning of code modules after the kernel is up should be forwarded to a sandboxed user mode service so that even if the scan engine is compromised the malicious code can't go anywhere. Not a bad idea to fire up a new process for every scan so the exploit will be short lived.

Its pretty clear that antivirus software isn't written this way. They run everything in high privileges.

Re:Stupid Software Design Decisions

[Anonymous Coward]

Because the antivirus needs to read all files on the system including protected one, it can only be done using admin priv and running as ring 0 on the kernel. Otherwise it's not going to be very effective at prevention.

Your laptop crashing is probably due to a bad software install or bad hardware, corporate antivirus is usualy really stable, it needs to be or people stop paying for it.

Re:Stupid Software Design Decisions

[bytestorm]

We're just lucky it's not a ring -3 antivirus coprocessor embedded in the northbridge.

Re:Stupid Software Design Decisions

[Anonymous Coward]

Isn't that what Intel bought McAfee for? Oh wait, they're selling off McAfee ... so either that didn't pan out or they found a "better" way to do it ... latest IME?

Re:Stupid Software Design Decisions

[Anonymous Coward]

Actually, the basic AV services usually run as System, not Admin. Which is necessary for all the reasons mentioned above, plus being able to deal with stupid things running as admin. That's why, to completely eliminate the AV, it's necessary to operate in Safe Mode.

Agree regarding the laptop crashes, but also think that corporate/govt IT is often driven more by low-bid or kickbacks than by it-works. Otherwise why would the place I worked use use McAfee for over 20 years? Not that Norton (the only corporate alternative in the early years) have been significantly better ...

Re: Stupid Software Design Decisions

[Anonymous Coward]

> Not a bad idea to fire up a new process for every scan so the exploit will be short lived.

A new process? For *every* *single* *file* accessed? Do you know why Windows software is generally multi-threaded instead of multi-process? (hint: launching new processes is expensive on Windows)

You have no idea what you're talking about.

Re: Stupid Software Design Decisions

[nateman1352]

I should have been more clear, every scan *job* not every file. I am very aware of the way Windows works and its horrible amount of overhead for creating a new process compared to UNIX.

This performance concern would need to be balanced against the added security of preventing a persistent malware infection of the scan engine process. Maybe replace the process every 1000 files scanned? This is what performance profiling is for.

From a software engineering standpoint, one should start out with the "best" design and ignore performance for the most part, and then after the initial implementation do performance profiling to see what you actually need to optimize. If you optimize up front, then you have no way of knowing if the optimizations you did in the initial design actually had any benefit.

Most Clients Get Infected Looking For Free Movies

[zenlessyank]

Almost every client that I have had to deal with infected machines were looking for free movies on the web. They lie and say they have no idea, but when I show them their browsing history then they get all stuttery and defensive. I would say it is about 50/50 with porn and regular movies. I haven't seen many infections thru e-mail that actually make it to the machine.

How to not get a virus

[Anonymous Coward]

1. Don't open e-mail you're unfamiliar with or open attachments from senders you don't know.
2. Keep your browsers and OS up-to-date
3. Don't go to sketchy web sites
4. Don't download anything from CNET.
5. Remove Java, flash and silverlight
6. Use an adblocker.

Done.

Re:How to not get a virus

[Desler]

And when that non-sketchy sites gets breached and starts serving drive-by malware how do your steps catch that?

Re:How to not get a virus

[tepples]

"6. Use an adblocker" makes a breach far less likely because ad networks are by far the most common vector for breaches of ostensibly legitimate websites. Furthermore, "2. Keep your browsers and OS up-to-date" makes "drive-by malware" far less likely to start executing.

Re:How to not get a virus

[Desler]

Using an adblocker prevents a server from being breached? lolwut?

Re:How to not get a virus

[Anonymous Coward]

And don't surf the net using an account with administrative privileges. Use a "mortal user" account. This alone will stop 95% of all malware. Very little malware (yet) can install directly to the user's home directory.

Use Chrome--it auto-updates and also uses a transparent check of known bad websites.
Use Opera or Firefox as backups.
Use uBlock Origin or some adblocker, coupled with Privacy Badger and Disconnect. Using this with the above surfing as a regular user will protect you 99% of the way. The other 1% would be stupidity, and there's no fixing or mitigating stupid.

Re:How to not get a virus

[Anonymous Coward]

And when that non-sketchy sites gets breached and starts serving drive-by malware how do your steps catch that?

Run NoScript to avoid any surprises. For extra credit, do it on a Linux machine that lies because the browser claims to be running on Windows 7, not just in the User Agent but also in various JS properties in the event that you accept any JS. Use a Firefox that you compiled yourself with a hardened toolchain, including SSP, address space randomization, and other mitigations so unpatched zero-days are likely to simply crash the browser.

Then it's just a matter of not downloading suspicious .exes and running them with WINE.

Re:How to not get a virus

[thoromyr]

Responding to AC, but it isn't a /bad/ post.

#1 is quick and easy (which commends it) but is too little. Why do you think spammers use "you have a package" emails as bait? Because some fraction of the recipients *will* be expecting a package so -- for them -- it is not unexpected and they think they know the sender. Opening an email should never be risky, though in practice it is. Rephrased:

    1. If at all possible use a mail reader that does not load external content without your prompting it to do so. Be wary of links (hover, don't click) and attachments (save, then open from what should open it -- never double click/execute/directly open an attachment)

To keep it short, I'd split that into three components: a) block external content; b) don't trust links; c) don't trust attachments

#3 is a popular notion, but is just wrong. Thank you advertising networks for ensuring there is as much badness on the popular sites as the "sketchy" ones. Don't believe me? Google it. I can't be bothered to find citations for the actual research on the topic. That's right, actual research, not just a seat-of-the-pants feels-right guess.

The only other comment I have is that with all of those you are still not done. For example, if your OS supports it, ensure at least basic white listing is enabled (e.g., Gatekeeper on OS X). And smack anyone who says to disable it because they don't feel like signing their application (the proper method is to right click, then select run -- not disable Gatekeeper).

None of these measures is sufficient and neither are all possible measures combined. There is always a way. Sometimes you have a bad day and click on a link because you're half asleep. So plan for *that* and have backups.

Re:How to not get a virus

[Anonymous Coward]

One important addendum to your point #1: Disable the preview pane, summary, and keyword-sorting feature of your email program. It is hard to avoid opening an email message when your MUA is automatically opening and parsing them for you.

Antivirus is Last-gen Tech

[EndlessNameless]

It is a huge liability to rely on virus definitions and heuristics engines. They are often too little, too late. The trend toward rapid development and advanced threats started about 15 years ago, and it has been making antimalware applications increasingly irrelevant.

Ad- and script-blocking helps, but those are targeted primarily at web browsing, and that is certainly not the only attack vector.

Whitelisting and mandatory access controls (e.g., SELinux) are the only truly effective measures, and they require a lot more work than antivirus. Antivirus is a simple 5-minute installation with automatic updates thereafter---and some even refuse to do that much. There is little hope that most home users will implement anything better.

There are adequate solutions, but they raise the bar in terms of the expertise, expense, and effort required. Even if a company addressed the "expense" issue by releasing a consumer-priced whitelisting application for Windows, there is no clear way to eliminate the other requirements.

In light of all this, I see things getting worse before they get better. It takes a lot of problems before home users pony up their time and money.

Re:Antivirus is Last-gen Tech

[aaarrrgggh]

After watching a server and network upgrade for my company, I am convinced that user actions are likely much less of a problem than technicians not understanding security, remote management tools, full Linux stack in access points, routers, cameras, and copiers, and the giant attack surface that is the IoT.

It used to be that my emergency contingency plan was to pull the incoming network cable... but once you add site-to-site resource dependencies that quickly becomes suicide. This could easily be much worse than all the Windows problems back in the day.

Re:Antivirus is Last-gen Tech

[tepples]

There are adequate [application whitelisting] solutions, but they raise the bar in terms of the expertise, expense, and effort required. Even if a company addressed the "expense" issue by releasing a consumer-priced whitelisting application for Windows, there is no clear way to eliminate the other requirements.

I know of a couple consumer whitelist tools for Windows. One is the SuperShield feature of PC Matic. Another is the SmartScreen feature of Internet Explorer since 9 and Windows since 8, which prompts the user to delete programs that are "not commonly downloaded". But I've read complaints on forums that the EV code signing certificate needed to immediately pass SmartScreen for a new release can be too expensive for part-time developers.

Re:Antivirus is Last-gen Tech

[Bob the Super Hamste]

Whitelisting and mandatory access controls (e.g., SELinux) are the only truly effective measures

And the shit storm from the general population with this will be a huge problem. It already is for me trying to get a very regulated industry to do it.

Stopped using AV software about a decade ago

[Anonymous Coward]

The trick was I had "out grown" the novelty of torrents and porn by replacing them with a career and girlfriend. Haven't had a single issue since.

Re:Stopped using AV software about a decade ago

[Anonymous Coward]

You were executing torrents and porn?! Dude, I'm not sure your career and girlfriend were really the cause. It sounds like you didn't know how to use your media player. ("So, uhh, I just run backdoorsluts9.mp4.exe, right?") It's just that when you gave up on entertainment (probably because you could never figure out how to make it work) you suddenly had a lot of spare time, and a career and girlfriend happened as a result.

You should learn more about computers. They're going to become a big thing. Then you and your girlfriend can watch porn together, and you might be an even better career, too.

Re:Stopped using AV software about a decade ago

[Anonymous Coward]

LOL. When you "out grow" your girlfriend and she becomes your wife and you have kids, you'll be back to Netflix and porn. I haven't had a single issue since either.

Re:Stopped using AV software about a decade ago

[Anonymous Coward]

You should learn more about girlfriends. Sounds like you could use one to help get rid of that neck beard and condescending attitude.

Now, that's unfair

[Opportunist]

Saying that Antivirus Software is useless and using Symantec as an example is like saying that editors are useless and using /. editors as examples.

Re:Now, that's unfair

[szy]

If I had mod points, I couldn't decide if I wanted to mod parent up as funny or insightful!

Re:Now, that's unfair

[thoromyr]

that deserves at least a +1 Funny, but sadly I've already posted. Sigh.

The best AV is Linux

[Anonymous Coward]

Not perfect ... best.

About 15 Years Too Late

[Anonymous Coward]

I'm glad to see the Millennials are catching up.

Worse than useless

[Anonymous Coward]

On top of that they waste my computers resources.

Re:Most Clients Get Infected Looking For Free Movi

[Anonymous Coward]

I dont even bother trying to figure out how they got the virus. you know they're going to lie so why bother. clean the machine, get my money and repeat in a couple months. And its no wonder they get irked if you're going through their browsing history. first thing I do is clean all the temp files, cookies, browsing history off before I start doing anything. I dont want to know.

Better antivirus than antivirus... apk

[Anonymous Coward]

APK Hosts File Engine 9.0++ SR-4 32/64-bit http://www.bing.com/search?q=%...

Less power/cpu/ram + IO use vs. DNS/routers/addons/antivirus (slows you) + less security issues/complexity. Compliments firewalls (w/ layered drivers blocking less used IP addys vs. hosts blocking more used domains) & DNS (lightens dns load). Gets data via 10 security sites.

Ads rob bandwidth/speed, security (malvertising), privacy (tracking) + anonymity.

Hosts add speed (hardcodes/adblocks), security (bad sites/poisoned dns), reliability (dns down), & anonymity (dns requestlogs/trackers) natively. Hosts != ClarityRay blockable (vs. souled-out to admen inferior wasteful redundant slow usermode addons)

Works vs. caps & HTTP PUSH ads w/ firewalls.

Avg. webpage = big as Doom http://www.theregister.co.uk/2... & ads = 40% of the size.

APK

P.S. - Safe https://www.virustotal.com/en/... (Verified by Malwarebytes' S. Burn "I've seen the code & it's safe" http://forum.hosts-file.net/vi... )

Re:Better antivirus than antivirus... apk

[Anonymous Coward]

By the way, I'm fat, insecure, and I truly HATE those NIGGERS! Oh and I think the TIMECUBE guy is a GENIUS!

APK

Re:Better antivirus than antivirus... apk

[Anonymous Coward]

+1, Informative

Re:Most Clients Get Infected Looking For Free Movi

[jawtheshark]

I would say it is about 50/50 with porn and regular movies.

Which I don't understand. You can get porn risk free pretty much on all big platforms. Free porn is a solved problem. No need to go to shady websites.

Hell, it's in the interest of most porn providers to avoid infecting you because, they'd rather have you as a paying customer. Go to the big streaming porn websites, invariably there are payvideo on demand, webcam sites and dating sites behind them. They want you to pay for that. They don't want your credit card number to be lifted by some malware writing shady criminals...

Windows Problems

[Anonymous Coward]

Is like having a guy with peanut allergies pushing Planters products.

As a longtime Linux and OpenBSD user, it's amusing to hear from all of these Satisfied Microsoft Customers.

Re:Windows Problems

[avandesande]

Yes, I use windows antivirus and have never had any problems.

Re:Windows Problems

[operagost]

Ever since I started carrying this rock, I have not been attacked by a single tiger.

Re:Windows Problems

[avandesande]

I've never had a virus on windows 7 and I suspect that's true about most competent users. What are you saying?

Re:Windows Problems

[secretsquirel]

"I've never had a virus on windows 7" ...that you knew about

Re:Windows Problems

[avandesande]

I've never had any strange behavior or unknown processes running on my machine and none of my online accounts have been hacked. What exactly should I be worried about?

How to stop that?

[Anonymous Coward]

See step 6 above. If the malware is served from ad servers that will block that threat.

But more generally, run NoScript. Stops most of that crap like those listed in tip# 5.

Other tips 1-4 look good also.
[And of course, better to run Linux]
[For the truely paranoid, fun Linux from a non writable live disk and surf away !

Obligatory link

[Place a name here]

Enumerating badness is a lousy idea.

Re:Obligatory link

[tepples]

I agree. But in practice, how can an inexperienced PC owner understand how to enumerate goodness?

Re: Obligatory link

[Anonymous Coward]

By Googling. Google $SOFTWAREPRODUCt malware spyware adware and you'll find out quickly enough.

It's the first thing I do when asked about a product I don't know that a user would like to have.

Re:Obligatory link

[Place a name here]

With properly constructed software, the inexperienced PC owner shouldn't have to. Consider cell phone OSes that ask you if you want some given app to access location data, etc. There's little reason for a web browser to access anything but the profile and its download directory. A picture viewer doesn't need to write to disk, and so on. That approach makes enumeration much less important because the system already assumes the worst (default deny instead of default permit).

In practice, until software is programmed more defensively, PC owners will have to get that experience. Hopefully indirectly. What the article says is that antivirus might be worse than nothing at all even on the way there.

Re:Obligatory link

[tepples]

There's little reason for a web browser to access anything but the profile and its download directory.

Looking through the permissions that Chrome for Android has, I can see a few little reasons:

• Obviously, a web browser needs to access the Internet.
• WebRTC requires microphone and camera access but allows things like voice search, product lookup by barcode, reverse image search, and voice and video chat.
• Geolocation API requires location access but allows not having to key in your street address every time when looking for stores near you.
• Web Notifications requires receiving cloud to device messages but allows a user to choose to let a web application get the user's attention.

A picture viewer doesn't need to write to disk

Unless it offers a feature for the user to rotate an image by 90 degrees and save the fact that it was rotated. (The cosine transform used in JPEG allows lossless rotation of images whose size is a multiple of the macroblock size, usually 16x16 pixels.)

Ad networks are currently juicier targets

[tepples]

Blocking ads doesn't directly block breach of a publisher. But I imagine that breach of a publisher is far less likely than breach of the ad network that the publisher uses because the return on investment for breaching an ad network is greater than that for breaching a publisher. A user who blocks ads is immune to breach of an ad network.

Re:Ad networks are currently juicier targets

[arth1]

It took me a while before I figured out that you've swallowed the PC pill and now refer to servers as publishers.
Sorry, the term server is ingrained, and not subject to change. It's also quite inaccurate, as many servers do not publish anything.

Re:Ad networks are currently juicier targets

[tepples]

In ad industry jargon, the publisher hosts an article, and the ad network hosts the ads embedded in the article. Both the publisher and the ad network operate servers. What's a more readily understood term meaning "site on which an advertisement is placed"?

Re:Ad networks are currently juicier targets

[Khyber]

"It took me a while before I figured out that you've swallowed the PC pill"

Spoken like a true console peasant.

Re:Ad networks are currently juicier targets

[Anonymous Coward]

Khyber... has no idea what the fuck he is talking about, but his low self esteem requires him to put others down to feel better about himself.

Re:Ad networks are currently juicier targets

[Khyber]

You have no actual argument, which actually means I'm correct.

BTW, for all intents and purposes, Macs are consoles. They're not even worthy of PC status. PCs allow freedom, not walled gardens.

Comment removed

[account_deleted]

Comment removed based on user account deletion

What a name!

[Anonymous Coward]

Xavier de Carne de Carnavalet

Seriously? That might just be the best name I've ever seen. It's like a cross between an anime villan and an heir-apparent to the old French monarchy.

Imagine that signature!

Confirmed

[YoungManKlaus]

The last three infections I had were all along the lines of "Virus detected" - "Attempting to remove virus" - [system hijacked]. Seriously, how hard is it to write a reliable and bug free quarantine -.-

Maybe antivirus companies should spend more time on that than adding fucking useless spyware features to their own products (like ssl interception)

Your anecdote is worthless

[s.petry]

I have been working in IT security for nearly 3 decades. Work for a mail hosting company or support large mail infrastructure if you want to find people infected by mail. I have, do, and can tell you that most business PCs are infected through email and attachments. For home PCs, you are right that most comes from malicious sites often hosting video. There is another very small set of hosts who get attacked quite differently. These are targeted service attacks generally masked by a massive DDOS. They are specific, crafted, and staffed with experts at exploiting systems.

You not having clients infected by means other than pr0n is purely due to a very shallow pool of clients.

Re:Your anecdote is worthless

[zenlessyank]

Thank you for reminding me that I am stuck in a house with a blown out back and just don't have the clients flowing through..... I always appreciate the sly underhanded comments on Slashdot. ...... Looking forward for more!!!

Re:Your anecdote is worthless

[thoromyr]

I'll see your anecdote and raise you: most are caused by malvertising from general web browsing. Perhaps you aren't seeing other infection vectors if your work focuses on the email side? I don't run the mail service or the network, but I'm responsible for security generally. Most of the unwanted email we see is spam, a bit of phishing, and of course login attempts from Nigeria. Email is normally how *accounts* are exploited here, but *system* compromises usually originate from malvertising.

Of course, we also likely have different user bases. If you have everything locked down and going through a proxy then email as a vector may get to the front. We certainly have seen our share of email delivered badness, but there is far more being stopped by blocking advertising and making use of blackhole DNS than is blocked by the email filtering.

Re:Your anecdote is worthless

[s.petry]

I did not discount that pr0n was an attack surface, I said that the majority of businesses are hit at surfaces other than pr0n. I don't work only in email, I work at the infrastructure layer so get the joy of seeing it all.

Re:Your anecdote is worthless

[PCM2]

My actual, literal first thought was: "WTF? Why doesn't he fix his damn house?"

I'll get the lights on my way out.

Re:Your anecdote is worthless

[Anonymous Coward]

I'll see your anecdote and raise you:

String bet!

Came to that conculsion several years ago..

[FirstOne]

After a stream of viri made it past the dictionary lookuip and a low hit rate on new viri, I made a decision to not install anti-viris software on any newly built virt boxes.

To replace it, I added an execute permission restrictions policy, so that any thing a limited user downloaded or any file that resided in his/her directory/server file tree could NOT execute. 2nd, I hired a company called "spam experts" to filter incomming emails/ (primary infection path). Lastly and very important, setup a filter for any emails that remembered the old server IP address(open port 25) and bypassed spamexperts(MX reord) to be redirected into a offsite spam holding account.

Finally, added as much encryption as possible, TLS links between email clients and server, same goes for between email servers(TLS over port 25 comms)..

Re:Came to that conculsion several years ago..

[NotAPK]

Sorry to nitpick, but I think the plural of "virus" is "viruses".

There is no logic to this. Very broadly, in English the plural form often comes from the etymology of the original root, be it either latin or greek.

There's a good rant here about this.

However, how about the plural of "forum"? Here are some comments. So do we use "forums" or "fora". While the technically correct latin form is "fora" I just can't get my head around it, and prefer to say "forums".

Anyway, off topic, sorry...

Re:Most Clients Get Infected Looking For Free Movi

[chispito]

I dont even bother trying to figure out how they got the virus. you know they're going to lie so why bother. clean the machine, get my money and repeat in a couple months.

You could actually give them a better value for their money and offer to train them how to use their computer more wisely. Maybe they'll surprise you and seek more of your services outside of just reactionary repairs.

FMTowns

[Anonymous Coward]

I don't want to start a holy war here, but what is the deal with you Windows fanatics? I've been sitting here at my freelance gig in front of a PC (a Dell Dimension with 2 Gigs of RAM) for about 20 minutes now while it attempts to copy a 17 Meg file from one folder on the hard drive to another folder. 20 minutes. At home, on my MacBook Air, which by all standards should be a lot slower than this PC, the same operation would take about 2 minutes. If that.

In addition, during this file transfer, IE will not work. And everything else has ground to a halt. Even MSPaint is straining to keep up as I type this.

I won't bore you with the laundry list of other problems that I've encountered while working on various PCs, but suffice it to say there have been many, not the least of which is I've never seen a PC that has run faster than its Mac counterpart, despite the PC's faster chip architecture. My Mac IIfx with 8 megs of ram runs faster than this Dell machine at times. From a productivity standpoint, I don't get how people can claim that the Windows PC is a superior machine.

PC addicts, flame me if you'd like, but I'd rather hear some intelligent reasons why anyone would choose to use a PC over other faster, better, more stable systems.

Re:FMTowns

[Anonymous Coward]

PC addicts, flame me if you'd like, but I'd rather hear some intelligent reasons why anyone would choose to use a PC over other faster, better, more stable systems.

As a Mac user, I agree with most of what you said. However, the one BIG reason for choosing Windows over other alternatives is software. There are lots of applications that only run on Windows, so that's what you have to run if you need those applications.

Sure you can run Windows in a VM, but for many users that's just not going to be a workable solution.

I've spent the better part of a day reloading Windows 7 on a new Dell machine. The Windows Updates take forever (had to leave it overnight), and then seeking out all the missing drivers, etc. It's just painful to use Windows anymore, but I understand why so many still do.

Comparing closeness to a binary state

[tepples]

Let me explain this usage:

In prescriptivist theory, comparative words such as "more" or "increasingly" cannot be used with binary state words such as "unique" or "useless". But in practice, when a comparative word is used with a binary state word, the binary state word takes on the meaning of closeness to that state. So "more unique" means "closer to unique", and "increasingly useless" means "increasingly close to useless".

Re:Comparing closeness to a binary state

[fizzup]

It takes on the meaning of increasing closeness to that state.

Re:Comparing closeness to a binary state

[PCM2]

Which raises the question: Is the uselessness of /. editors a finite set?

Re:Comparing closeness to a binary state

[tepples]

Or decreasing: "SoylentNews editors have shown themselves less useless than Slashdot editors."

Re:Comparing closeness to a binary state

[cwsumner]

The problem is that there are not really any "binary words". The universe does not have anything like that, it is fractal.

So the poplular usage, in this case, is actually more accurate. Words like "unique" can not accuratly be used to describe anything real, they are imaginary states.
Except to mathematicians...

Re:Best adblocker & more vs. threats online

[Anonymous Coward]

Nobody wants to use your shitty app. Give it up already.

(Got your waders on, everybody? Here... we... GO...!)

Impersonating me? LOL, please... apk

[Anonymous Coward]

See subject: Grow up!

APK

P.S.=> Seriously... apk

Re:Impersonating me? LOL, please... apk

[Anonymous Coward]

See subject.

By the way, I'm fat, insecure

Thanks for clearing that up, but there was no need to restate the obvious.

No one wants your stupid host file program anyway. If you didn't have these long-winded, spamming, used car salesman tactics i might be inclined to at least TRY it. But not with this level of BS.

APK

P.S. ====================> Seriously, the real APK. And THIS time I fucking MEAN IT.

Re:Impersonating me? LOL, please... apk

[Anonymous Coward]

Will the real apk please stand up. I repeat.... will the real ak please stand up. We're going to have a problem here

Someone should mod that up

[Anonymous Coward]

Defender works great for 99% of the stuff out there. For the other 1% that Defender may have problems with, I use MalwareBytes AntiMalware (free version) and Spybot Search & Destroy.

With those, I've never had a problem, nor has anyone I've recommended them to/installed for.

On the other hand, I've uninstalled Symantec from a number of machines for people. Same with Norton. And nobody has ever come back to me asking for that crapware back.

Re:Someone should mod that up

[GargamelSpaceman]

That works if you are careful. If you are not careful, you need Avast.

Seems appropriate, actually.

[DrYak]

A porte-manteau of:
"ill" and "increasingly"
seems strangely fitting to the subject.

Re:Best adblocker & more vs. threats online

[coastwalker]

You really ought to rewrite this occasionally you know. It reads like a spam advertisement by an African prince with a mental illness. I suppose that at least the way it is written we all know what it is and skip past it without bothering to read it. You are welcome for thanking me for my advice.

Our /. peers disagree w/ you... apk

[Anonymous Coward]

his hosts program is actually pretty good by xenotransplant

his hosts tool is actually useful for those cases in which one does indeed want to locally block stuff outright while consuming minimum system resources by alexgieg

I've never tried to belittle (APK's) work, I've flat out said it's good by BronsCon

I like your host file system by Karmashock

I find your hosts file admirable by vel-ex-tech

take a look at the APK hosts file engine by SuperKendall

APK is kinda right. I've given up on JS based adblocking and gone to blackholing in /etc/hosts, just like it was back in the 90s. The computational load has gotten intolerable for any ad-blocking using JS. I've tried his hosts file generating software. It works by bmo

APK

P.S.=> Want more opinions like those that trash yours & outnumber you many orders of magnitude:1 as the ratio? Ask & 'ye shall receive'... apk

Re:Our /. peers disagree w/ you... apk

[Anonymous Coward]

Do you have tonight's winning lotto numbers by chance?

Not entirely useless... business models

[Anonymous Coward]

Maybe useless at protection, but the pervasiveness of scanner/detector software, and institutional and regulatory requirements to have it mean that it provides jobs for legions of software developers. The large scale and complexity means that they'll never get all the bugs out, so the mfrs keep having to revise and renew it, as well as adapting to new versions of OS and so forth.

It's a fine example of regulatory capture and perhaps even, "white collar welfare", because those folks working for Symantec might otherwise be out on the street committing horrible crimes.

chroot /var/empty; suid nobody

[emil]

Privilege separation and sandboxing are well-tested mitigation techniques that allow OpenBSD to assert "Only two remote holes in the default install, in a heck of a long time!" - this security record is far, far superior to the Windows OS and the virus scanners that run atop it.

What Microsoft still fails to grasp, even after Gates' force majeur with the XP-SP2 security redesign, is that all applications should default to a strong sandbox. When a developer pushes code outside the sandbox, it should trigger more aggressive audits prior to listing in the Windows store, and user warnings of increasing severity upon installation.

The pertinent question for developers and administrators, especially with regards to network-facing services, is "how strong can we build the cage, and how little can we let out?" Until OS-designers build from this focus, the security tsunami will continue.

Re:chroot /var/empty; suid nobody

[Anonymous Coward]

On the other hand, MS also has to ship an actual product with actual features to be used by actual users.

The more security you have, the longer it takes to get to market and the harder it is for users to get stuff done.

The balance for a mass-market desktop OS is a lot different than for a niche server OS.

dom

Re:chroot /var/empty; suid nobody

[emil]

Well, of course, Microsoft could never use a sandbox in production code for the Windows desktop, because ease-of-use and compatibility would be compromised. Sandboxes are just for servers.

Best adblocker & more vs. threats online

[Anonymous Coward]

APK Hosts File Engine 9.0++ SR-4 32/64-bit http://www.bing.com/search?q=%...

Less power/cpu/ram + IO use vs. DNS/routers/addons/antivirus (slows you) + less security issues/complexity. Compliments firewalls (w/ layered drivers blocking less used IP addys vs. hosts blocking more used domains) & DNS (lightens dns load). Gets data via 10 security sites.

Ads rob bandwidth/speed, security (malvertising), privacy (tracking) + anonymity.

Hosts add speed (hardcodes/adblocks), security (bad sites/poisoned dns), reliability (dns down), & anonymity (dns requestlogs/trackers) natively. Hosts != ClarityRay blockable (vs. souled-out to admen inferior wasteful redundant slow usermode addons)

Works vs. caps & HTTP PUSH ads w/ firewalls.

Avg. webpage = big as Doom http://www.theregister.co.uk/2... & ads = 40% of the size.

APK

P.S. - Safe https://www.virustotal.com/en/... (Verified by Malwarebytes' S. Burn "I've seen the code & it's safe" http://forum.hosts-file.net/vi... )

Re:Most Clients Get Infected Looking For Free Movi

[NetNed]

"I don't even look for porn/movies online" = "I look for movies and porn online all the time"

Funnier is some that I know are quite the church goers and then I find traces from "girl on girl" or "young sluts" on their computers. Wouldn't believe how fast they blame someone else.

Re:Most Clients Get Infected Looking For Free Movi

[zenlessyank]

I should have added that the porn wasn't the usual porn that they were looking for. Usually animal and scat. Sometimes other things which I wont even speak of. I have had several clients call the police on their significant other also after seeing the list of filth right in front of their eyes.

Re:My Research is nearly ready to pay off!

[zenlessyank]

It's not funny to mock stutterers. I see what u did there.

News at 11 !

[stooo]

Antivirus is useless ? News at eleven.

"safe and effective"

[david.emery]

AV software should meet the standards for medical treatments, following the virus analogy. First, they should be clearly shown to be 'safe' - to not cause problems on the machine or introduce new vulnerabilities. Second, they should be shown to actually stop known viruses, be able to react to new infections, and in general do a better job than the OS vendor in rapidly adapting to threats.

Frankly, on Mac OS, I don't think any product meets these standards.

Re:Most Clients Get Infected Looking For Free Movi

[zenlessyank]

Yet if we saw all those people at school we would think someone is trying to steal some kids. The point being that eventually you graduate and leave school. These fuckers keep going for 20+ years!!! How much church schooling do you need???!!! There is only ONE FUCKING BOOK to read.

Re:Best adblocker & more vs. threats online

[Anonymous Coward]

Perhaps you ought to write a better program.

but... but... there is a better program, and it is called HostsMan:

http://www.abelhadigital.com/h...

It's inferior in 3 areas... apk

[Anonymous Coward]

1st: It doesn't take advantage of speedup & security by hardcoded favorites (where you spend most time online) vs. DNS hijacks or being downed...

2nd: It has dependencies on others' libs - mine doesn't & is self-contained single .exe file code... if those libs like sqlite develop a bug, they have to wait out the fix - I don't.

3rd: It's 'stuck' in 32-bit, whereas by comparison, my program has a native true 64-bit version...

APK

P.S.=> Still a decent program, but it falls short of MINE in those 3 areas (adding it would be imitation @ this point of MY work)... apk

Re:It's inferior in 3 areas... apk

[Anonymous Coward]

"It has dependencies on others' libs - mine doesn't & is self-contained single .exe file code"

Which means you had to use other libraries for building, programming, and compiling, you fucking nitwit.

"It's 'stuck' in 32-bit, whereas by comparison, my program has a native true 64-bit version..."

Well-written programs can run on 8-bit and 256-bit systems. That you couldn't write a universal x86 application shows your amateur level of competence.

Are antivirus (especially free one) still relevant

[Eloking]

Here's what I wrote in Avast Acquiring AVG thread. It's even more relevant in here.

First off, all virus come from the internet nowadays. Yeah there's USB stick, but, in most case, you plug them between stuff at your house.

Add a good browser paired with ad-block kinda remove all threat from your usual website. Now even Chrome block you from entering website with reported attack. Even sending virus through email seems like a challenge with build-in antivirus check scanning the crap out of every byte in your attached file.

And, as a final layer of security, there's the new Microsoft antivirus (Defender, ex. Microsoft Security defender) that seem to give a decent security. And it's got the most importing feature that all others antivirus seem to lack, it's not a virus itself.

How many time I have checked a slow laptop only to uninstall Norton and see it running fine again? And what about the other free antivirus? When they don't put adware and trick you into giving them money, they just simply sell your data : http://www.pcmag.com/article2/...

So, back to my initial question, are antiviruses still relevant today?

Re:Most Clients Get Infected Looking For Free Movi

[Anonymous Coward]

Leading to the conclusion that the best security enhancing work benefit would be an access to streaming services and selected, quality porn sites, with enough variety of course.

SQLite != native to OS API... apk

[Anonymous Coward]

See subject stupid (sqlite hostsman uses != that) - You strangely (not) AVOID the fact hostsman doesn't take advantage of hardcoded favorites speed & security advantages (mine does).

* ... & for such a "big talker", where's your program that's better? It's not.

APK

P.S.=> Big talkers like you abound - anyone can talk, only some of us actually DO... & you're clearly not one of them, but I am... apk

Unfortunately

[s.petry]

Pain medication may also induces paranoia. There was no "sly underhanded comment" at all, it was a very detailed response with a factually verifiable view of the world outside of your personal anecdote.

As a person who has had a full shoulder reconstruction (18 Mitek anchors collar bone, shoulder blade, ball joint), 3 knee surgeries (ACL and Kneecap once, MCL and meniscus twice), and 4 damaged disks (L1-4) I speak from experience in that category too. The Army was fun, but may also cause permanent injury.

Re:Unfortunately

[zenlessyank]

What pain medication? I would have to have some form of medical insurance to get pain medication. Dope ain't free.

Re:Most Clients Get Infected Looking For Free Movi

[thoromyr]

nice way to justify your voyeurism. Or is it a desire to look down on and belittle them?

Trawling through someone's browsing history and attributing an infection to "trying to download a movie" is about as robust as any other "pulled it out of my ass" explanation. People with the knowledge of how to track down a root infection cost more than a "rebuild my computer" effort is worth. And, frankly, the time spent is rarely worth it. If all you have is a dead file system (no RAM dumps, no packet captures, not even netflow traffic, no meaningful logging enabled on the end point, no DNS logging, etc.) then there will be a lot of dead ends.

At one time home infections were primarily caused by malicious links spread through instant messaging clients. You could ask about links being clicked on or just save your breath over the argument as to whether or not it was "something they had done" and just remind them to be cautious about links (was it expected? who sent it? hover before click; best practice is to type it in manually to avoid look-a-like domains). And that same advice then serves them well when the delivery method shifts to email.

My hosts file program does both & more

[Anonymous Coward]

APK Hosts File Engine 9.0++ SR-4 32/64-bit http://www.bing.com/search?q=%...

Less power/cpu/ram + IO use vs. DNS/routers/addons/antivirus (slows you) + less security issues/complexity. Compliments firewalls (w/ layered drivers blocking less used IP addys vs. hosts blocking more used domains) & DNS (lightens dns load). Gets data via 10 security sites.

Ads rob bandwidth/speed, security (malvertising), privacy (tracking) + anonymity.

Hosts add speed (hardcodes/adblocks), security (bad sites/poisoned dns), reliability (dns down), & anonymity (dns requestlogs/trackers) natively. Hosts != ClarityRay blockable (vs. souled-out to admen inferior wasteful redundant slow usermode addons)

Works vs. caps & HTTP PUSH ads w/ firewalls.

Avg. webpage = big as Doom http://www.theregister.co.uk/2... & ads = 40% of the size.

APK

P.S. - Safe https://www.virustotal.com/en/... (Verified by Malwarebytes' S. Burn "I've seen the code & it's safe" http://forum.hosts-file.net/vi... )

Re: My hosts file program does both & more

[Anonymous Coward]

Oh my God APK, I haven't seen you in months! How've you been?

Re: My hosts file program does both & more

[Anonymous Coward]

He must have accidentally added slashdot and it's subdomains to the hosts file on accident and just thought they closed up shop.

Re:Most Clients Get Infected Looking For Free Movi

[NetNed]

Ahhh isn't that true about any religion?? Unless I missed something.......

Can Antivirus do what a HOSTS FILE can do?

[allo]

Not only blocking viruses, but even ads and windows 10?

Re:Most Clients Get Infected Looking For Free Movi

[zenlessyank]

I thought the term 'Church' covered all the bases. Don't really feel like typing synagogue and temple and mosque and cowfield and morgue and all the other places man sits down with satan and breaks bread.

Huh?

[Anonymous Coward]

What a pointless article.

Sorry, there is no direct relationship between antivirus/anti-malware products and anything produced by Symantec. Symantec products are utterly useless resource hogs that fail to protect anyone from anything, while providing backdoors to both attackers and governments.

Two analogies

[Anonymous Coward]

Would you buy a new car from a dealership if the dealership recommended that the first thing you should do before going out in public is to install after market locks? In fact, for an extra fee, they could have their tech install some after market locks, In fact, they will throw in a three month trial for free. Would you buy a car that didn't come with locks designed and built in at the factory?

I live in a rural western U.S. community in the middle of nowhere a few miles off an interstate freeway. Occassionally, we have a crime spree where people from the nearest big city come out and steal ATVs, etc. Understandably, locals aren't happy about this. Some want to install webcams on the only road connecting us to the freeway. They reason that this will help track down the thieves.

Imagine instead if we build a little checkpoint on that road. Every car leaving town would have to pull through, get dog sniffed, have mirrors run under their car, be asked to open their trunk, etc. It might take 5-10 minutes to complete the inspection. The outcome is easy enough to forecast. It costs money to build the checkpoint, pay the guards to staff it (and for their uniforms and machine guns), etc. So we will have everyone kick in a little tax to pay for it. People who commute or shop or whatever outside the community will have to budget a little extra time to get through the checkpoint. Vehicles will stack up at times and wait times might sometimes climb to 30 minutes. (People who commute every day start looking nervous.) But we all go along and we make it happen.

Then, people's ATVs keep getting stolen.

Somebody realizes that there is a back road out past the lake that avoids the checkpoint. So we build a second checkpoint, and raise taxes again.

Then, people's ATVs keep getting stolen.

Then somebody realizes that thieves can just drive the ATVs offroad over to the freeway and load them on trailers. Much hand ringing and discussion about how to stop this. What about constant helicopter surveillance? How much will we have to raise taxes for that?

Then, people's ATVs keep getting stolen.

Then, one of the folks with the machine gun got some new instructions over the phone. Nobody seems to be leaving the community. The checkpoint has shutdown all traffic. Well, it is supposed to shutdown all traffic. But it supposed to release it, and that isn't happening. Some people miss work one day while outside experts are brought in to figure out and resolve the problem. The outside experts cost more that two years of checkpoint funding.

And people's ATVs keep getting stolen.

At some point, the cost of maintaining the checkpoints, helicopters, machine guns, etc. become greater than the cost of the occassional ATV. Plus the inconvenience of traffic slow downs, cavity searches, etc. is very unpleasant. And after all this, the ATVs keep disappearing.

New plan: build a small ATV yard at the edge of town. Whenever a local wants a new ATV, buy one from the checkpoint taxes and give it them. Then have them leave their not-so-old ATV in the yard outside of town with no security at all. Post a sign that says, "Help yourselves. Consider it stealing if you want."

The new plan costs less, is much more convenient, and results in every local riding a new ATV. Oh and nobody is wondering how much they can trust the camo folks carrying machine guns.

That's about as much sense as security software makes to me.

Politically correct master race

[tepples]

BTW, for all intents and purposes, Macs are consoles. They're not even worthy of PC status.

I disagree. Macs are personal computers because the person who owns it controls what computing is done on it, even down to compiling apps from source code. What game console runs Xcode or even anything remotely like Xcode?

But back to topic: arth1 meant "politically correct", not "personal computer". He perceived "publisher" as a politically correct synonym for "server", unaware of its adtech sense "operator of a site on which an advertisement is placed". If ad networks are breached more often than publishers, measures to protect yourself from breached ad networks have a better payoff than measures to protect yourself from breached publishers.

Re:Politically correct master race

[Khyber]

"I disagree. Macs are personal computers because the person who owns it controls what computing is done on it"

Wrong. System Integrity Protection is a built-in Apple blacklist. That's SPECIFICALLY stopping you from controlling what computing you're doing. It even blacklists its own drivers.

Re:Politically correct master race

[tepples]

SIP is a driver whitelist and a lock on system directories analogous to Trusted Solaris or SELinux. At the high level, it doesn't block user mode execution of compiled source code or of executables obtained from third parties. (That's Gatekeeper, which can be turned off.) At the low level, it doesn't block the owner from turning it off in recovery console (which an article by Andrew Cunningham and Lee Hutchinson admits that 5 percent of users may have a good reason to do) or from installing another operating system. A console blocks all four of these.

CI is in addition to local testing

[tepples]

Continuous integration is in addition to local testing of local incremental builds of a local branch, not a replacement for it. Just because Netscape and Mozilla pioneered CI with the "Tinderbox" system doesn't mean engineers weren't also building Gecko on their own machines.

What else is new

[psycheitout]

Well I didn't need to read this to know Norton is garbage. Don't tell me McAfee is as well.

Re: Most Clients Get Infected Looking For Free Mov

[psycheitout]

Ain't that the truth. The closest I have seen to a virus transmitted by email was one idiot that got a browser hijacker off of a link he followed from a spam letter. On a related note he also had Norton installed on his pc.

Re:My Research is nearly ready to pay off!

[Anonymous Coward]

Ya stuttering prick ya

anti-virus Vs content protection

[Anonymous Coward]

Sub:Anti-virus vs content Protection
Taken for a ride-Permissive Society- Question boomerangs
Content Vulnerability- symantic or Avast are no exception, Even Google ability to Content protection is a question mark. US Copyrights office must attend to such issues