Antivirus Software Is 'Increasingly Useless' and May Make Your Computer Less Safe (www.cbc.ca)

Emily Chung, writing for CBC: Is your antivirus protecting your computer or making it more hackable? Internet security experts are warning that anti-malware technology is becoming less and less effective at protecting your data and devices, and there's evidence that security software can sometimes even make your computer more vulnerable to security breaches. This week, the U.S. Department of Homeland Security's Computer Emergency Readiness Team (CERT) issued a warning about popular antivirus software made by Symantec, some of it under the Norton brand, after security researchers with Google's Project Zero found critical vulnerabilities. "These vulnerabilities are as bad as it gets. They don't require any user interaction, they affect the default configuration, and the software runs at the highest privilege levels possible," wrote Google researcher Tavis Ormandy in a blog post. Symantec said it had verified and addressed the issues in updates that users are advised to install. It's not the only instance of security software potentially making your computer less safe. Concordia University professor Mohammad Mannan and his PhD student Xavier de Carne de Carnavalet recently presented research on antivirus and parental control software packages, including popular brands like AVG, Kaspersky and BitDefender, that bypass some security features built into internet browsers to verify whether sites are safe or not in order to be able to scan encrypted connections for potential threats. In theory, they should make up for it with their own content verification systems. But Mannan's research, presented at the Network and Distributed System Security Symposium in California earlier this year, found they didn't do a very good job. "We were surprised at how bad they were," he said in an interview. "Some of them, they did not even make it secure in any sense."

Comments

You Misspelled Title

[zenlessyank]

ilcreasingingly

Having Symantec Comment On Antivirus Info

[zenlessyank]

Is like having a guy with peanut allergies pushing Planters products.

Re:Having Symantec Comment On Antivirus Info

[arth1]

Is like having a guy with peanut allergies pushing Planters products.

I bet that drives you nuts...

Re:Having Symantec Comment On Antivirus Info

[mrbester]

A dry roasting there...

Clicking on attachments

[martyros]

After a recent debacle where Symantec apparently didn't get the proof-of-concept exploit sent to them by a security researcher because the mail filter automatically opened the document and crashed, I friend of mine joked that antivirus software was actually a tool to "automatically click on attachments for you".

that hyperbole though

[Anonymous Coward]

ok look, i do some malware analysis.

the thing is, 99% of the malware you run into is run-of-the-mill stuff.

to paraphrase someone who was talking about EMET:

not running AV because some researcher are doing next-level shit is like not wearing your seatbelt because a sniper might get you.

Tavis Ormandy has uncovered a shit-ton of serious vulnerabilities in some big name AV / Endpoint Protection products. Great! Those will get fixed and life goes on. There are also some AV suites that taviso has NOT found bit problems in.

keep in mind also that some other big names in "next level" endpoint protection and security services who monetarily gain from pushing the idea that "endpoint security is dead".

Re:that hyperbole though

[EndlessNameless]

not running AV because some researcher are doing next-level shit is like not wearing your seatbelt because a sniper might get you

To extend your analogy, we are now driving at speeds that render the seatbelt inadequate. While it may still be wise to buckle up, we need a better seatbelt design, a supplementary measure, or a replacement.

Right now, we have IDS/IPS applications and ad/script blocking as reasonably good supplements. But even that isn't enough anymore---just as adding an air bag isn't enough to make a car safe at racetrack speeds.

There are suitable solutions for enterprise where the budget and administrative skills can support it, but there is really nothing for home users.

Re:that hyperbole though

[swillden]

the thing is, 99% of the malware you run into is run-of-the-mill stuff.

Which Windows' built-in antivirus protection will stop.

not running AV because some researcher are doing next-level shit is like not wearing your seatbelt because a sniper might get you.

Nonsense. There's nothing "next level" about this. What Tavis found is that running vulnerable A/V software adds a large and easily-exploitable attack surface to your system. The fact that most current-generation malware isn't exploiting these bugs yet doesn't mean they won't, soon.

Tavis Ormandy has uncovered a shit-ton of serious vulnerabilities in some big name AV / Endpoint Protection products. Great! Those will get fixed and life goes on.

And how many more will be added? A/V software adds attack surface to your system, running at high priority. That's bad. In the past it was a net win because the base OS did nothing to protect against malware, but that's no longer the case. Does Symantec actually provide additional protection over Windows Defender? If so, how do you balance that against the additional risk it adds?

Re:that hyperbole though

[chispito]

99% of the malware you run into is run-of-the-mill stuff

You're likely casting as wide a net as you can to find that malware. The malware that actually works its way through the Internet to the endpoint of an average person will also sail on by standard AV because there are no definitions for it yet. I'm not talking Stuxnet, I'm talking the same run-of-the-mill malware that you are, just slightly tweaked to require a new definition/hash.

There are products that are good at stopping even re-hashed malware (Cylance), but they are effective in part because nobody is writing malware specifically to evade them (and Cylance does no remediation; if the malware gets by it, you're not going to get a definitions update that same afternoon to help you contain it).

Re:that hyperbole though

[I4ko]

ahh, but there is. two ways at least - durex and plain old water. If your computer has only a wired connection you need to put the connector in the durex condom before placing it into the socket. The condom prevents electrical connections, hence network is not connected, hence less need to worry. If your computer also has a wireless network connectivity submerging it into water will sever the wireless connection hence you don't need to worry. There aren't good reasons to have tons of computers networked to the open internet..

Re:that hyperbole though

[whoever57]

not running AV because some researcher are doing next-level shit is like not wearing your seatbelt because a sniper might get you.

I think that a better analogy is that not running AV is like disabling the Takata airbag on your Honda.

Re:that hyperbole though

[Khyber]

" What Tavis found is that running vulnerable A/V software adds a large and easily-exploitable attack surface to your system."

I would argue he didn't find shit. Stupidity like this has been known since startkeylogger/stopkeylogger in Norton products. He's only re-iterating that AV products are simply shit, much like other 'security' solutions ACs tend to post here.

Re:that hyperbole though

[chispito]

You do realize how Cylance works right? It doesn't actually need definitions. That's the entire point of the service. So when there's a new variant created 10 minutes after the initial variant is patched, Cylance blocks that.

Except their patching cadence is measured in weeks or months, not hours.

Re:that hyperbole though

[rtb61]

The correct slashdot car analogy. Is anti virus software is like a really secure armoured truck that will protect you money but they armoured truck comes from an unsecure yard where anyone can take it over and then drive up and take your money. The antivirus software can still secure you hugely unreliable operating system, it just can not secure itself because they failed to pay attention to that part and because the security software stuck itself in with root access, hack the security software and you gain control of the operating system.

Re:that hyperbole though

[NotAPK]

My friend and I wanted to capture someone's password.

So we fired up .NET and Googled for a code snippet and used that to write a very simple little program that ran on Windows 7 and wrote key-presses to a file on the local HDD. Nothing fancy. The whole time I thought this would never work, since while our program was completely unknown to the AV software, surely the API hook and overall pattern (as you mention above) would be trivial to detect.

Our program worked perfectly and was never detected by any of the anti virus programs we tested it against.

We got the password.

The experience really scared the crap out of me, and since then I've been exceedingly paranoid about trusting sources of software more than AV.

Re: that hyperbole though

[Veretax]

Would that be the same Takata airbag that is recalled what unions and millions of airbags for defects from the last two years?

Re: that hyperbole though

[whoever57]

That's my point. The airbag might save your life in an accident, or it might kill you.

Re:that hyperbole though

[peawormsworth]

the thing is, 99% of the malware you run into is run-of-the-mill stuff.

Which Windows' built-in antivirus protection will stop.

I think you missed the point that Windows is a virus.

Did you even read the EULA before clicking to accept?

Re:that hyperbole though

[swillden]

the thing is, 99% of the malware you run into is run-of-the-mill stuff.

Which Windows' built-in antivirus protection will stop.

I think you missed the point that Windows is a virus.

Did you even read the EULA before clicking to accept?

No, because I don't use Windows. I switched to Linux in 1999 and have never gone back. Well, these days I also use OS X.

But anyway, that's irrelevant, because in the context of this conversation Windows is a given. The question is, if you are already using Windows, whether or not you should also install an anti-virus product.

Adblock

[Anonymous Coward]

I think installing an adblocker in your webbrowser is probably the best antivirus available today.

Re:Adblock

[tnk1]

Best antivirus in a qualitative sense? Probably not.

Best antivirus in the sense that it blocks the source of significant amounts of malware, yes.

It does need to be pointed out that you're going to cut down considerably on malware by closing that channel, but you're still toast if you are opening attachments or you are the target of a specific attack which is less scattershot than an ad network.

We do need something *like* dedicated antivirus. It just has to be light-years better than the bloated crap that goes for AV today.

 

Re: Adblock

[Type44Q]

And NoScript, and a custom HOSTS file... or just run a proper OS. ;)

Re:Adblock

[Anonymous Coward]

For people that don't open attachments, and are more resistant to Trojans, malvertising is probably the top infection vector there is.

I did a test on this a few years back. VM #1 running XP hasn't been patched, other than the browser (Firefox), and doesn't have any AV on it. VM #2 was patched all the way with Windows and all applications and add-ons (Flash, Acrobat, etc.) has all AV stuff, but no ad blocking.

I used VM #1 for dedicated web browsing for a long while, and when I shut it down, mounted the virtual drive, scanned it as well as used Autoruns to look at the registry, it was clean. VM #2, which was used for browsing a few mainstream social media sites was nailed in less than ten minutes with pop-up scareware ads, then software using a third party add-on exploit.

Moral of the story: I can go without AV and have a clean system. AV doesn't do anything against malvertising, and with the advent of sites using Flash + EME to protect their content, AV only adds complexity, expands the attack surface, and does nothing.

Re: Adblock

[bytestorm]

It'd be nice if this proper OS existed at the present time because I'm not going back to Amiga despite its lack of viruses. I'm reading between the lines here, but I infer you are setting up Linux or a BSD variant as this hypothetical proper OS, all of which have their fair share of vulnerabilities and are even harder for non-technical end users to configure correctly to avoid problems.

Re: Adblock

[arth1]

I'm not going back to Amiga despite its lack of viruses

This is rather funny, considering that the Amiga was infamous for its plethora of viruses.
Some of which were rather amusing, like playing a song with the stepper motor of the floppy drive, or using any modem found to dial the home phone number of an Antivirus creator, or randomly inserting words like "sex" in any text files. All in the 1kB boot block.

Re:Adblock

[pr0fessor]

My brother and I were talking the other about how things appeared to have changed over the years and how the line between legitimate program and scourge of the internet is awfully thin.

 

Re:Adblock

[Etcetera]

For people that don't open attachments, and are more resistant to Trojans, malvertising is probably the top infection vector there is.

Moral of the story: I can go without AV and have a clean system. AV doesn't do anything against malvertising, and with the advent of sites using Flash + EME to protect their content, AV only adds complexity, expands the attack surface, and does nothing.

BS. "Malvertising" doesn't exist fundamentally at a technical level any more than "malshareware" exists. The problems are, respectively, vulnerabilities in flash/imagemagick/browser software/etc and intentionally subversive code that doesn't do what it claims to do. "Restricting advertising" as an AV response is catching things in the dragnet, but that's much more just rationalizing the fact that you just don't want to see ads on websites.

We've all seen parents' and friends' computers that didn't have AV software installed and the sh*tshow they usually are, and it's not because they saw banner ads but because they got infected with viruses. Is AV foolproof or guaranteed to catch everything? Of course not. Does it run as a privileged process and thus require extra scrutiny in the privileged code sections? Of course. So does sudo. But most people are much better off with AV software than without, notwithstanding the fact that people at heightened risk should have even more layers of protection.

Re: Adblock

[UnknownSoldier]

> considering that the Amiga was infamous for its plethora of viruses.
> Some of which were rather amusing, like playing a song with the stepper motor of the floppy drive, ..

Go on ...

Now I've heard of Beagle Bros' "Silicon Salad" TL:CHUGGACHUGGA for the Apple ][ before

0 REM AJIT JOSHI--CANTON,MI
1 HOME: POKE 50,223:FOR X = 150 to 255:SPEED=X:PRINT PEEK (49385) + PEEK (49386);:PRINT "CHUGGA";: PRINT PEEK(49387);:NEXT:END

but I haven't heard that about one !

Re:Adblock

[thoromyr]

Nice to hear someone without a clue comment on the topic. Speaking as someone who actually works in an IT security position (responsible for a ~8000 node network or so -- you have to decide how you're going to count it...) there are two basic measures that cut the majority of infections off at the knees:

1) block advertising

2) blackhole DNS

While some advertising industry shills get very shrill about #1, the problem is solidly in their court due to their increasingly obvious inability to stop malware from being delivered as advertising. I've posted before about why the problem exists and it is easy enough to learn more on the topic so I won't belabor that point further.

The idea behind blackhole DNS is that you discover a domain name is bad and you prevent hosts on your network from being able to resolve. More precisely, you resolve it to a server that will happily deliver a message about content having been blocked.

Blocking advertising is better because it does not rely on prior knowledge or a threat feed. It is simple, easy and very effective. But if you have a good threat feed then blackhole DNS is also quite effective. Sure, someone *else* paid the price already, but now the rest of the population is protected.

*Most* security professionals would not recommend eliminating AV (although in many cases that is solely to maintain the ability to check the box in audits) and it does serve a purpose (either as a canary or blocking old school malware).

EMET and related techniques aim for generic protections, but they are only relevant after the malware is already on the system and it is obviously better to prevent that from happening in the first place. Defense in depth means that additional measures are good, but they should never been seen as a replacement.

Re: Adblock

[thoromyr]

Aspiring programmers created many viruses for the Amiga. If memory serves, LAMER was one of the more prevalent ones. It was so-named for being targeted at pirates (and quite possibly written by a commercial software programmer). The Amiga had *zero* security features. Any application could write to any portion of memory which made poorly written but otherwise non-malicious software a problem for system stability. It was an inherently single-user system. File attributes are not protection. RDB permitted the inclusion of arbitrary code that would be loaded on demand when a drive was scanned (this was intended to allow a drive to provide its own file system drivers, but like many such cool features no one had given security even a passing thought).

However, *most* of the "viruses" on the Amiga were toys or jokes -- there weren't that many with malicious intent (though see LAMER) -- so users often were not particularly concerned about them.

Re:Adblock

[dcooper_db9]

Perhaps. But the biggest vulnerability in Windows computers (for home users) comes from users running as an administrator. The Windows install process should really be changed to setup an administrator account as well as a standard user account. Very few users get viruses when they have to elevate privileges.

I currently have 117 home and small business clients that I've educated about this. I create a new administrator account and change their original user account to standard. Only one of my clients that made the change have had a virus infection in the past three years. Almost all of my clean-up business comes from the people who continue to run as admin. And yes, I sometimes wonder how much money I'm losing by doing this.

Re: Adblock

[arth1]

Then this will blow your mind :)

Re: Adblock

[UnknownSoldier]

That is freaking AWESOME! Got any more cool hardware hacks?!

And here I thought Oscifun was amazing!

Oscillofun on Tektronix 2245A
* https://www.youtube.com/watch?...

Re: Adblock

[cwsumner]

... The Amiga had *zero* security features. ...

In those day, -most- computers had zero security features. Big computers had locked doors. Micro-computers, no one seemed to care.
Microsoft grew up in those days, thats why they don't really understand security or multi-thread stuff.

In fact, tech people working on "micro-computers" hated big IBM and DEC so much that a lot of things were left out because it was "big computer trash, we don't need that" !

Except that the "micro-computers" that we are working on, now, are much bigger and more powerful than the "big" computers were back then. A change in mindset is needed...

Intrusive

[Anonymous Coward]

The problem with AV software in my eyes is how intrusive they've become, they're worse than viruses in some cases

You install, say, Kaspersky and you immediately get 2 browser plugins installed into Firefox, 3 root certs get dropped into Windows certificate list and kasperskylabs.net scripts get injected into every page you visit, even if you turn the "web shield" off
Not to mention those garbage software "firewalls" that hardly give you any control over anything. Though for instance Avira does it differently, it just takes over Windows Firewall for you and won't even let you turn that "freature" off, so screw you if you configured it by hand.

Just use appropriate browser plugins, Windows Defender, Malwarebytes and common sense.

Re:Intrusive

[Archangel Michael]

Just use appropriate browser plugins, Windows Defender, Malwarebytes and common sense.

That last one, "common sense", doesn't exist. Click here for a free iPad!

Re:Intrusive

[RKThoadan]

They say antivirus is useless but it blocked your nefarious link. Ha!

Can I still get my free iPad?

Re:Intrusive

[Dorianny]

The problem with AV software in my eyes is how intrusive they've become, they're worse than viruses in some cases

You install, say, Kaspersky and you immediately get 2 browser plugins installed into Firefox, 3 root certs get dropped into Windows certificate list and kasperskylabs.net scripts get injected into every page you visit, even if you turn the "web shield" off Not to mention those garbage software "firewalls" that hardly give you any control over anything. Though for instance Avira does it differently, it just takes over Windows Firewall for you and won't even let you turn that "freature" off, so screw you if you configured it by hand.

Just use appropriate browser plugins, Windows Defender, Malwarebytes and common sense.

This is all an attempt at branding and making their product highly visible to the user. its purpose is to make it seem to the user that it absolutely imperative they renew their "subscription service" and are getting good value out of it. As far as anti-virus engines go, MS-defender is consistently ranked towards the bottom of the list and most 3d party engines do a better job of actually catching and cleaning infections, however when they add all these components to their "suites" which needlessly replace other system-components and put in place unnecessary addons, they make the system less secure

Blacklist vs. whitelist

[tepples]

Antivirus software that detects apps known to be harmful is a form of blacklisting. But as a general rule, blacklisting is considered less secure than whitelisting. An antivirus using whitelisting, such as PC Matic, allows only known good apps to run.

The obvious problem with this approach is who defines the set of known good programs. In a corporate environment, an IT department has the resources to review the programs on which employees rely. But a home PC owner who isn't quite a PC expert may not feel qualified to do this, instead delegating review to a trusted party. This has led to cases of rent-seeking, where a gatekeeper demands payment from each developer to review each app.

Bruce Schneier explains further

Re:Blacklist vs. whitelist

[hibiki_r]

And the moment you put a whitelisting antivirus on a programmer's machine, who will often compile their own executables, the corporate plan goes to shit anyway.

Just like how IT departments often make programmers' kufe hell by not make exceptions for a directory used for compilation and artifact downloading. Triple your compile times for no good reason!

Re:Blacklist vs. whitelist

[the_Bionic_lemming]

Yup, Mcafee regularly deleted an application we sold to about 90 people worldwide. Every single time we issued an update.

Whitelisting is great if you are a million plus user base, but costly to small business catering to just a few clients.

Re:Blacklist vs. whitelist

[phantomfive]

Whitelisting doesn't help when adding a whitelist creates an exploitable remote vulnerability that doesn't require user interaction, like Symantec and TrendMicro

Re:Blacklist vs. whitelist

[Samizdata]

Plus, the whole whitelisting argument is predicated on the fact the whitelisting app is stable and unassailable. Speaking of PC-Matic, don't know if you have checked, but the VirusBTN tests have frequently cited stability issues for it. So, how's your whitelister going to whitelist if it has crashed or locked up?

Re:What the fuck

[Anonymous Coward]

"increasingly less useful"

Ow! My eyes! What's wrong with "decreasingly useful"?

Stupid Software Design Decisions

[nateman1352]

Seriously why the hell does Antivirus software need to run its scan engine at Admin group privileges, and why is half of the scan engine running in Ring 0 kernel drivers?

Its amazing, my work laptop BSODs about once a day just because of some crappy driver included in the Antivirus software installed by IT.

Since it crashes that frequently just in normal operation it seems likely that there is at least 1 vulnerability in that driver which is exploitable from user mode.

Re:Stupid Software Design Decisions

[cbiltcliffe]

If the scan engine wasn't running as Ring 0 kernel drivers, then it wouldn't be able to detect Ring 0 rootkit drivers, and other such crapware. Since we know there are kernel vulnerabilities which allow infection with Ring 0 malware, not running your scanner at least partially in Ring 0 would make it even less useful than it currently is.

Re: Stupid Software Design Decisions

[nateman1352]

Since the whole point of it is security it really makes sense to have two copies of your scan engine installed, one in Ring 0 for early boot rootkit detection that scans every driver as it loads and only scans if the binary passes MSFT's driver signing checks first.

All of your scanning of code modules after the kernel is up should be forwarded to a sandboxed user mode service so that even if the scan engine is compromised the malicious code can't go anywhere. Not a bad idea to fire up a new process for every scan so the exploit will be short lived.

Its pretty clear that antivirus software isn't written this way. They run everything in high privileges.

Re:Stupid Software Design Decisions

[bytestorm]

We're just lucky it's not a ring -3 antivirus coprocessor embedded in the northbridge.

Re: Stupid Software Design Decisions

[nateman1352]

I should have been more clear, every scan *job* not every file. I am very aware of the way Windows works and its horrible amount of overhead for creating a new process compared to UNIX.

This performance concern would need to be balanced against the added security of preventing a persistent malware infection of the scan engine process. Maybe replace the process every 1000 files scanned? This is what performance profiling is for.

From a software engineering standpoint, one should start out with the "best" design and ignore performance for the most part, and then after the initial implementation do performance profiling to see what you actually need to optimize. If you optimize up front, then you have no way of knowing if the optimizations you did in the initial design actually had any benefit.

Most Clients Get Infected Looking For Free Movies

[zenlessyank]

Almost every client that I have had to deal with infected machines were looking for free movies on the web. They lie and say they have no idea, but when I show them their browsing history then they get all stuttery and defensive. I would say it is about 50/50 with porn and regular movies. I haven't seen many infections thru e-mail that actually make it to the machine.

How to not get a virus

[Anonymous Coward]

1. Don't open e-mail you're unfamiliar with or open attachments from senders you don't know.
2. Keep your browsers and OS up-to-date
3. Don't go to sketchy web sites
4. Don't download anything from CNET.
5. Remove Java, flash and silverlight
6. Use an adblocker.

Done.

Re:How to not get a virus

[Desler]

And when that non-sketchy sites gets breached and starts serving drive-by malware how do your steps catch that?

Re:How to not get a virus

[tepples]

"6. Use an adblocker" makes a breach far less likely because ad networks are by far the most common vector for breaches of ostensibly legitimate websites. Furthermore, "2. Keep your browsers and OS up-to-date" makes "drive-by malware" far less likely to start executing.

Re:How to not get a virus

[Desler]

Using an adblocker prevents a server from being breached? lolwut?

Re:How to not get a virus

[thoromyr]

Responding to AC, but it isn't a /bad/ post.

#1 is quick and easy (which commends it) but is too little. Why do you think spammers use "you have a package" emails as bait? Because some fraction of the recipients *will* be expecting a package so -- for them -- it is not unexpected and they think they know the sender. Opening an email should never be risky, though in practice it is. Rephrased:

    1. If at all possible use a mail reader that does not load external content without your prompting it to do so. Be wary of links (hover, don't click) and attachments (save, then open from what should open it -- never double click/execute/directly open an attachment)

To keep it short, I'd split that into three components: a) block external content; b) don't trust links; c) don't trust attachments

#3 is a popular notion, but is just wrong. Thank you advertising networks for ensuring there is as much badness on the popular sites as the "sketchy" ones. Don't believe me? Google it. I can't be bothered to find citations for the actual research on the topic. That's right, actual research, not just a seat-of-the-pants feels-right guess.

The only other comment I have is that with all of those you are still not done. For example, if your OS supports it, ensure at least basic white listing is enabled (e.g., Gatekeeper on OS X). And smack anyone who says to disable it because they don't feel like signing their application (the proper method is to right click, then select run -- not disable Gatekeeper).

None of these measures is sufficient and neither are all possible measures combined. There is always a way. Sometimes you have a bad day and click on a link because you're half asleep. So plan for *that* and have backups.

Antivirus is Last-gen Tech

[EndlessNameless]

It is a huge liability to rely on virus definitions and heuristics engines. They are often too little, too late. The trend toward rapid development and advanced threats started about 15 years ago, and it has been making antimalware applications increasingly irrelevant.

Ad- and script-blocking helps, but those are targeted primarily at web browsing, and that is certainly not the only attack vector.

Whitelisting and mandatory access controls (e.g., SELinux) are the only truly effective measures, and they require a lot more work than antivirus. Antivirus is a simple 5-minute installation with automatic updates thereafter---and some even refuse to do that much. There is little hope that most home users will implement anything better.

There are adequate solutions, but they raise the bar in terms of the expertise, expense, and effort required. Even if a company addressed the "expense" issue by releasing a consumer-priced whitelisting application for Windows, there is no clear way to eliminate the other requirements.

In light of all this, I see things getting worse before they get better. It takes a lot of problems before home users pony up their time and money.

Re:Antivirus is Last-gen Tech

[aaarrrgggh]

After watching a server and network upgrade for my company, I am convinced that user actions are likely much less of a problem than technicians not understanding security, remote management tools, full Linux stack in access points, routers, cameras, and copiers, and the giant attack surface that is the IoT.

It used to be that my emergency contingency plan was to pull the incoming network cable... but once you add site-to-site resource dependencies that quickly becomes suicide. This could easily be much worse than all the Windows problems back in the day.

Re:Antivirus is Last-gen Tech

[tepples]

There are adequate [application whitelisting] solutions, but they raise the bar in terms of the expertise, expense, and effort required. Even if a company addressed the "expense" issue by releasing a consumer-priced whitelisting application for Windows, there is no clear way to eliminate the other requirements.

I know of a couple consumer whitelist tools for Windows. One is the SuperShield feature of PC Matic. Another is the SmartScreen feature of Internet Explorer since 9 and Windows since 8, which prompts the user to delete programs that are "not commonly downloaded". But I've read complaints on forums that the EV code signing certificate needed to immediately pass SmartScreen for a new release can be too expensive for part-time developers.

Re:Antivirus is Last-gen Tech

[Bob the Super Hamste]

Whitelisting and mandatory access controls (e.g., SELinux) are the only truly effective measures

And the shit storm from the general population with this will be a huge problem. It already is for me trying to get a very regulated industry to do it.

Now, that's unfair

[Opportunist]

Saying that Antivirus Software is useless and using Symantec as an example is like saying that editors are useless and using /. editors as examples.

Re:Now, that's unfair

[szy]

If I had mod points, I couldn't decide if I wanted to mod parent up as funny or insightful!

Re:Now, that's unfair

[thoromyr]

that deserves at least a +1 Funny, but sadly I've already posted. Sigh.

Re:Most Clients Get Infected Looking For Free Movi

[Anonymous Coward]

I dont even bother trying to figure out how they got the virus. you know they're going to lie so why bother. clean the machine, get my money and repeat in a couple months. And its no wonder they get irked if you're going through their browsing history. first thing I do is clean all the temp files, cookies, browsing history off before I start doing anything. I dont want to know.

Re:Most Clients Get Infected Looking For Free Movi

[jawtheshark]

I would say it is about 50/50 with porn and regular movies.

Which I don't understand. You can get porn risk free pretty much on all big platforms. Free porn is a solved problem. No need to go to shady websites.

Hell, it's in the interest of most porn providers to avoid infecting you because, they'd rather have you as a paying customer. Go to the big streaming porn websites, invariably there are payvideo on demand, webcam sites and dating sites behind them. They want you to pay for that. They don't want your credit card number to be lifted by some malware writing shady criminals...

Re: No shit

[Type44Q]

I remember that shit being so bad that at one point I had to hunt-down a third party program just to remove it since it was clearly designed as a virus itself...

Re:News from Canada

[mark-t]

Which is kind of funny, because I'm from Canada, and I realized this 20 years ago (while working as a tech support minion for a branch of the federal government, actually).

Re:No shit

[Desler]

"Smart surfing" only works in a world in which servers don't ever get breached. We don't live in such a world.

Re:What the fuck

[Yvan256]

How about "more better less decreasingly not anymore useful or less"?

Obligatory link

[Place a name here]

Enumerating badness is a lousy idea.

Re:Obligatory link

[tepples]

I agree. But in practice, how can an inexperienced PC owner understand how to enumerate goodness?

Re:Obligatory link

[Place a name here]

With properly constructed software, the inexperienced PC owner shouldn't have to. Consider cell phone OSes that ask you if you want some given app to access location data, etc. There's little reason for a web browser to access anything but the profile and its download directory. A picture viewer doesn't need to write to disk, and so on. That approach makes enumeration much less important because the system already assumes the worst (default deny instead of default permit).

In practice, until software is programmed more defensively, PC owners will have to get that experience. Hopefully indirectly. What the article says is that antivirus might be worse than nothing at all even on the way there.

Re:Obligatory link

[tepples]

There's little reason for a web browser to access anything but the profile and its download directory.

Looking through the permissions that Chrome for Android has, I can see a few little reasons:

• Obviously, a web browser needs to access the Internet.
• WebRTC requires microphone and camera access but allows things like voice search, product lookup by barcode, reverse image search, and voice and video chat.
• Geolocation API requires location access but allows not having to key in your street address every time when looking for stores near you.
• Web Notifications requires receiving cloud to device messages but allows a user to choose to let a web application get the user's attention.

A picture viewer doesn't need to write to disk

Unless it offers a feature for the user to rotate an image by 90 degrees and save the fact that it was rotated. (The cosine transform used in JPEG allows lossless rotation of images whose size is a multiple of the macroblock size, usually 16x16 pixels.)

Ad networks are currently juicier targets

[tepples]

Blocking ads doesn't directly block breach of a publisher. But I imagine that breach of a publisher is far less likely than breach of the ad network that the publisher uses because the return on investment for breaching an ad network is greater than that for breaching a publisher. A user who blocks ads is immune to breach of an ad network.

Re:Ad networks are currently juicier targets

[arth1]

It took me a while before I figured out that you've swallowed the PC pill and now refer to servers as publishers.
Sorry, the term server is ingrained, and not subject to change. It's also quite inaccurate, as many servers do not publish anything.

Re:Ad networks are currently juicier targets

[tepples]

In ad industry jargon, the publisher hosts an article, and the ad network hosts the ads embedded in the article. Both the publisher and the ad network operate servers. What's a more readily understood term meaning "site on which an advertisement is placed"?

Re:Ad networks are currently juicier targets

[Khyber]

"It took me a while before I figured out that you've swallowed the PC pill"

Spoken like a true console peasant.

Re:Ad networks are currently juicier targets

[Khyber]

You have no actual argument, which actually means I'm correct.

BTW, for all intents and purposes, Macs are consoles. They're not even worthy of PC status. PCs allow freedom, not walled gardens.

Comment removed

[account_deleted]

Comment removed based on user account deletion

Re:What the fuck

[Captain Splendid]

It's not possible to be increasingly useless.

Clearly someone wasn't around to witness eight years of George W Bush.

Confirmed

[YoungManKlaus]

The last three infections I had were all along the lines of "Virus detected" - "Attempting to remove virus" - [system hijacked]. Seriously, how hard is it to write a reliable and bug free quarantine -.-

Maybe antivirus companies should spend more time on that than adding fucking useless spyware features to their own products (like ssl interception)

Your anecdote is worthless

[s.petry]

I have been working in IT security for nearly 3 decades. Work for a mail hosting company or support large mail infrastructure if you want to find people infected by mail. I have, do, and can tell you that most business PCs are infected through email and attachments. For home PCs, you are right that most comes from malicious sites often hosting video. There is another very small set of hosts who get attacked quite differently. These are targeted service attacks generally masked by a massive DDOS. They are specific, crafted, and staffed with experts at exploiting systems.

You not having clients infected by means other than pr0n is purely due to a very shallow pool of clients.

Re:Your anecdote is worthless

[zenlessyank]

Thank you for reminding me that I am stuck in a house with a blown out back and just don't have the clients flowing through..... I always appreciate the sly underhanded comments on Slashdot. ...... Looking forward for more!!!

Re:Your anecdote is worthless

[thoromyr]

I'll see your anecdote and raise you: most are caused by malvertising from general web browsing. Perhaps you aren't seeing other infection vectors if your work focuses on the email side? I don't run the mail service or the network, but I'm responsible for security generally. Most of the unwanted email we see is spam, a bit of phishing, and of course login attempts from Nigeria. Email is normally how *accounts* are exploited here, but *system* compromises usually originate from malvertising.

Of course, we also likely have different user bases. If you have everything locked down and going through a proxy then email as a vector may get to the front. We certainly have seen our share of email delivered badness, but there is far more being stopped by blocking advertising and making use of blackhole DNS than is blocked by the email filtering.

Re:Your anecdote is worthless

[s.petry]

I did not discount that pr0n was an attack surface, I said that the majority of businesses are hit at surfaces other than pr0n. I don't work only in email, I work at the infrastructure layer so get the joy of seeing it all.

Re:Your anecdote is worthless

[PCM2]

My actual, literal first thought was: "WTF? Why doesn't he fix his damn house?"

I'll get the lights on my way out.

Came to that conculsion several years ago..

[FirstOne]

After a stream of viri made it past the dictionary lookuip and a low hit rate on new viri, I made a decision to not install anti-viris software on any newly built virt boxes.

To replace it, I added an execute permission restrictions policy, so that any thing a limited user downloaded or any file that resided in his/her directory/server file tree could NOT execute. 2nd, I hired a company called "spam experts" to filter incomming emails/ (primary infection path). Lastly and very important, setup a filter for any emails that remembered the old server IP address(open port 25) and bypassed spamexperts(MX reord) to be redirected into a offsite spam holding account.

Finally, added as much encryption as possible, TLS links between email clients and server, same goes for between email servers(TLS over port 25 comms)..

Re:Came to that conculsion several years ago..

[NotAPK]

Sorry to nitpick, but I think the plural of "virus" is "viruses".

There is no logic to this. Very broadly, in English the plural form often comes from the etymology of the original root, be it either latin or greek.

There's a good rant here about this.

However, how about the plural of "forum"? Here are some comments. So do we use "forums" or "fora". While the technically correct latin form is "fora" I just can't get my head around it, and prefer to say "forums".

Anyway, off topic, sorry...

Re:Most Clients Get Infected Looking For Free Movi

[chispito]

I dont even bother trying to figure out how they got the virus. you know they're going to lie so why bother. clean the machine, get my money and repeat in a couple months.

You could actually give them a better value for their money and offer to train them how to use their computer more wisely. Maybe they'll surprise you and seek more of your services outside of just reactionary repairs.

Re: No shit

[JustAnotherOldGuy]

I remember that shit being so bad that at one point I had to hunt-down a third party program just to remove it since it was clearly designed as a virus itself...

Yeah, Norton had to write a tool just to remove their own shit.

The "Norton Removal Tool" is still available from the Norton site, which should tell people all they need to know about Norton.

Re:Windows Problems

[avandesande]

Yes, I use windows antivirus and have never had any problems.

Re:What the fuck

[Anonymous Coward]

Except "uselessness" is a binary state, either something is of absolutely no use (useless) or has some quantity of usefulness. There is no gradient in between to be more or less useless.

Ha haaaa. Semantics.

Comparing closeness to a binary state

[tepples]

Let me explain this usage:

In prescriptivist theory, comparative words such as "more" or "increasingly" cannot be used with binary state words such as "unique" or "useless". But in practice, when a comparative word is used with a binary state word, the binary state word takes on the meaning of closeness to that state. So "more unique" means "closer to unique", and "increasingly useless" means "increasingly close to useless".

Re:Comparing closeness to a binary state

[fizzup]

It takes on the meaning of increasing closeness to that state.

Re:Comparing closeness to a binary state

[PCM2]

Which raises the question: Is the uselessness of /. editors a finite set?

Re:Comparing closeness to a binary state

[tepples]

Or decreasing: "SoylentNews editors have shown themselves less useless than Slashdot editors."

Re:Comparing closeness to a binary state

[cwsumner]

The problem is that there are not really any "binary words". The universe does not have anything like that, it is fractal.

So the poplular usage, in this case, is actually more accurate. Words like "unique" can not accuratly be used to describe anything real, they are imaginary states.
Except to mathematicians...

Someone should mod that up

[Anonymous Coward]

Defender works great for 99% of the stuff out there. For the other 1% that Defender may have problems with, I use MalwareBytes AntiMalware (free version) and Spybot Search & Destroy.

With those, I've never had a problem, nor has anyone I've recommended them to/installed for.

On the other hand, I've uninstalled Symantec from a number of machines for people. Same with Norton. And nobody has ever come back to me asking for that crapware back.

Re:Someone should mod that up

[GargamelSpaceman]

That works if you are careful. If you are not careful, you need Avast.

Seems appropriate, actually.

[DrYak]

A porte-manteau of:
"ill" and "increasingly"
seems strangely fitting to the subject.

Re:Best adblocker & more vs. threats online

[coastwalker]

You really ought to rewrite this occasionally you know. It reads like a spam advertisement by an African prince with a mental illness. I suppose that at least the way it is written we all know what it is and skip past it without bothering to read it. You are welcome for thanking me for my advice.

Re:No shit

[mlts]

For front-line Web browsing at home, I run a Windows instance in a VM and browse with that. Every so often, I roll back to a snapshot, and continue browsing from there. If the VM gets infected, since it sits behind a PFSense virtual router which is configured to block any traffic going anywhere but out the gateway, block outgoing port 25, and other sanity rules, the VM is limited of what damage it can do.

Re:This is the reason...

[mlts]

Even if malware gets your user account's context, it still can do a lot of damage. Ransomware only needs user access to do its dirty deeds, and botnets and BitCoin miners can run well without needing anything from the admin account.

I also recommend Sandboxie if one doesn't want to use a full virtual machine. If the browser gets compromised, it still is only in the sandbox. It can't get to a user context, much less one with admin rights. With the ability to redirect all writes to a separate filesystem, if malware decides to do something annoying like (mkdir foo, cd foo, repeat), you can just format that filesystem and be done with it.

chroot /var/empty; suid nobody

[emil]

Privilege separation and sandboxing are well-tested mitigation techniques that allow OpenBSD to assert "Only two remote holes in the default install, in a heck of a long time!" - this security record is far, far superior to the Windows OS and the virus scanners that run atop it.

What Microsoft still fails to grasp, even after Gates' force majeur with the XP-SP2 security redesign, is that all applications should default to a strong sandbox. When a developer pushes code outside the sandbox, it should trigger more aggressive audits prior to listing in the Windows store, and user warnings of increasing severity upon installation.

The pertinent question for developers and administrators, especially with regards to network-facing services, is "how strong can we build the cage, and how little can we let out?" Until OS-designers build from this focus, the security tsunami will continue.

Re:chroot /var/empty; suid nobody

[emil]

Well, of course, Microsoft could never use a sandbox in production code for the Windows desktop, because ease-of-use and compatibility would be compromised. Sandboxes are just for servers.

Re:What the fuck

[I4ko]

doubleplusunuseful

Re:Most Clients Get Infected Looking For Free Movi

[NetNed]

"I don't even look for porn/movies online" = "I look for movies and porn online all the time"

Funnier is some that I know are quite the church goers and then I find traces from "girl on girl" or "young sluts" on their computers. Wouldn't believe how fast they blame someone else.

Re: No shit

[Etcetera]

I remember that shit being so bad that at one point I had to hunt-down a third party program just to remove it since it was clearly designed as a virus itself...

Yeah, Norton had to write a tool just to remove their own shit.

The "Norton Removal Tool" is still available from the Norton site, which should tell people all they need to know about Norton.

Why is that a bad thing? I'd prefer a separate tool to fully remove, rather than the normal Windows Uninstall being programatically accessible. Hell, if I install my AV, I'd love for a specific YubiKey being needed by some authoritative process to remove it.

We shouldn't be trying to get the computer to do things for us, because that makes things more vulnerable to malicious cyberspace actors. Pumping that back into meatspace (hey, how about we bring DIP switches back and require them to be flipped to write to BIOS again) forces humans back into the loop. Physical security and intrusion detection is a hell of a lot more of a solved problem than IoT security.

Re:What the fuck

[sexconker]

You can't be "increasingly less useful" when comparing to yourself.
You can be "increasingly less useful" when comparing to something else, but it doesn't mean what they intended.

If A is increasingly less useful than B, then:
A is less useful than B.
A's usefulness is increasing.

If A is increasingly less useful (than A), then:
A is less useful than A (at some prior point in time).
A's usefulness is increasing (compared to A at that same prior point in time).

That's a contradiction. It makes no sense.

If you don't want increasingly to modify useful, you really need to use that hyphen and write "increasingly-less".
On the other hand, you would do well to write "increasingly and less useful" or "increasingly, less useful" to be more clear for the upward trend.

The best bet, however, is to write "decreasingly useful". The word "decreasing" contains the direction in it, so you don't need to try to negate "increasingly" with "less" and make a mess of things.

Re:Most Clients Get Infected Looking For Free Movi

[zenlessyank]

I should have added that the porn wasn't the usual porn that they were looking for. Usually animal and scat. Sometimes other things which I wont even speak of. I have had several clients call the police on their significant other also after seeing the list of filth right in front of their eyes.

Re:My Research is nearly ready to pay off!

[zenlessyank]

It's not funny to mock stutterers. I see what u did there.

News at 11 !

[stooo]

Antivirus is useless ? News at eleven.

"safe and effective"

[david.emery]

AV software should meet the standards for medical treatments, following the virus analogy. First, they should be clearly shown to be 'safe' - to not cause problems on the machine or introduce new vulnerabilities. Second, they should be shown to actually stop known viruses, be able to react to new infections, and in general do a better job than the OS vendor in rapidly adapting to threats.

Frankly, on Mac OS, I don't think any product meets these standards.

Re:Most Clients Get Infected Looking For Free Movi

[zenlessyank]

Yet if we saw all those people at school we would think someone is trying to steal some kids. The point being that eventually you graduate and leave school. These fuckers keep going for 20+ years!!! How much church schooling do you need???!!! There is only ONE FUCKING BOOK to read.

It's inferior in 3 areas... apk

[Anonymous Coward]

1st: It doesn't take advantage of speedup & security by hardcoded favorites (where you spend most time online) vs. DNS hijacks or being downed...

2nd: It has dependencies on others' libs - mine doesn't & is self-contained single .exe file code... if those libs like sqlite develop a bug, they have to wait out the fix - I don't.

3rd: It's 'stuck' in 32-bit, whereas by comparison, my program has a native true 64-bit version...

APK

P.S.=> Still a decent program, but it falls short of MINE in those 3 areas (adding it would be imitation @ this point of MY work)... apk

Are antivirus (especially free one) still relevant

[Eloking]

Here's what I wrote in Avast Acquiring AVG thread. It's even more relevant in here.

First off, all virus come from the internet nowadays. Yeah there's USB stick, but, in most case, you plug them between stuff at your house.

Add a good browser paired with ad-block kinda remove all threat from your usual website. Now even Chrome block you from entering website with reported attack. Even sending virus through email seems like a challenge with build-in antivirus check scanning the crap out of every byte in your attached file.

And, as a final layer of security, there's the new Microsoft antivirus (Defender, ex. Microsoft Security defender) that seem to give a decent security. And it's got the most importing feature that all others antivirus seem to lack, it's not a virus itself.

How many time I have checked a slow laptop only to uninstall Norton and see it running fine again? And what about the other free antivirus? When they don't put adware and trick you into giving them money, they just simply sell your data : http://www.pcmag.com/article2/...

So, back to my initial question, are antiviruses still relevant today?

Re: No shit

[JustAnotherOldGuy]

Why is that a bad thing?

Found the Norton user. Lol, just kidding. If you had Norton running you'd be unable to browse the web, let alone post on slashdot.

-

I'd prefer a separate tool to fully remove, rather than the normal Windows Uninstall being programatically accessible.

That just means the malware would have to find a way to spoof that. It's not a solution, it's a minor impediment as long as the system has write privileges.

-

(hey, how about we bring DIP switches back and require them to be flipped to write to BIOS again)

Actually I'd be all in favor of this, and I'm dead serious. For something like BIOS updates and changes, I'd very much like to have a physical switch that can't be manipulated by software no matter what it wants.

Unfortunately

[s.petry]

Pain medication may also induces paranoia. There was no "sly underhanded comment" at all, it was a very detailed response with a factually verifiable view of the world outside of your personal anecdote.

As a person who has had a full shoulder reconstruction (18 Mitek anchors collar bone, shoulder blade, ball joint), 3 knee surgeries (ACL and Kneecap once, MCL and meniscus twice), and 4 damaged disks (L1-4) I speak from experience in that category too. The Army was fun, but may also cause permanent injury.

Re:Unfortunately

[zenlessyank]

What pain medication? I would have to have some form of medical insurance to get pain medication. Dope ain't free.

Re:What the fuck

[TechyImmigrant]

It's not possible to be increasingly useless. They could be increasingly less useful, but useless already means that they are no longer useful in any way.

Unfortunately for us readers, they became useless years ago.

It was already useless. What has happened is that it has become more robustly useless. There are multiple ways in which is it useless and any one of those ways is sufficient. Making it partially useful required fixing all the problems that make it useless. By adding more problems that ensure it is useless, its uselessness is rendered more robust against attempt to fix or justify it.

Re:Windows Problems

[operagost]

Ever since I started carrying this rock, I have not been attacked by a single tiger.

Re:Most Clients Get Infected Looking For Free Movi

[thoromyr]

nice way to justify your voyeurism. Or is it a desire to look down on and belittle them?

Trawling through someone's browsing history and attributing an infection to "trying to download a movie" is about as robust as any other "pulled it out of my ass" explanation. People with the knowledge of how to track down a root infection cost more than a "rebuild my computer" effort is worth. And, frankly, the time spent is rarely worth it. If all you have is a dead file system (no RAM dumps, no packet captures, not even netflow traffic, no meaningful logging enabled on the end point, no DNS logging, etc.) then there will be a lot of dead ends.

At one time home infections were primarily caused by malicious links spread through instant messaging clients. You could ask about links being clicked on or just save your breath over the argument as to whether or not it was "something they had done" and just remind them to be cautious about links (was it expected? who sent it? hover before click; best practice is to type it in manually to avoid look-a-like domains). And that same advice then serves them well when the delivery method shifts to email.

Re:Windows Problems

[avandesande]

I've never had a virus on windows 7 and I suspect that's true about most competent users. What are you saying?

Re:Most Clients Get Infected Looking For Free Movi

[NetNed]

Ahhh isn't that true about any religion?? Unless I missed something.......

Can Antivirus do what a HOSTS FILE can do?

[allo]

Not only blocking viruses, but even ads and windows 10?

Re:Most Clients Get Infected Looking For Free Movi

[zenlessyank]

I thought the term 'Church' covered all the bases. Don't really feel like typing synagogue and temple and mosque and cowfield and morgue and all the other places man sits down with satan and breaks bread.

Re:What the fuck

[mschwanke97402]

You folks are just using too many syllables. How about "less useful" as in "less useful by the day".

Re: My hosts file program does both & more

[Anonymous Coward]

He must have accidentally added slashdot and it's subdomains to the hosts file on accident and just thought they closed up shop.

Re:Windows Problems

[secretsquirel]

"I've never had a virus on windows 7" ...that you knew about

Politically correct master race

[tepples]

BTW, for all intents and purposes, Macs are consoles. They're not even worthy of PC status.

I disagree. Macs are personal computers because the person who owns it controls what computing is done on it, even down to compiling apps from source code. What game console runs Xcode or even anything remotely like Xcode?

But back to topic: arth1 meant "politically correct", not "personal computer". He perceived "publisher" as a politically correct synonym for "server", unaware of its adtech sense "operator of a site on which an advertisement is placed". If ad networks are breached more often than publishers, measures to protect yourself from breached ad networks have a better payoff than measures to protect yourself from breached publishers.

Re:Politically correct master race

[Khyber]

"I disagree. Macs are personal computers because the person who owns it controls what computing is done on it"

Wrong. System Integrity Protection is a built-in Apple blacklist. That's SPECIFICALLY stopping you from controlling what computing you're doing. It even blacklists its own drivers.

Re:Politically correct master race

[tepples]

SIP is a driver whitelist and a lock on system directories analogous to Trusted Solaris or SELinux. At the high level, it doesn't block user mode execution of compiled source code or of executables obtained from third parties. (That's Gatekeeper, which can be turned off.) At the low level, it doesn't block the owner from turning it off in recovery console (which an article by Andrew Cunningham and Lee Hutchinson admits that 5 percent of users may have a good reason to do) or from installing another operating system. A console blocks all four of these.

CI is in addition to local testing

[tepples]

Continuous integration is in addition to local testing of local incremental builds of a local branch, not a replacement for it. Just because Netscape and Mozilla pioneered CI with the "Tinderbox" system doesn't mean engineers weren't also building Gecko on their own machines.

What else is new

[psycheitout]

Well I didn't need to read this to know Norton is garbage. Don't tell me McAfee is as well.

Re: Most Clients Get Infected Looking For Free Mov

[psycheitout]

Ain't that the truth. The closest I have seen to a virus transmitted by email was one idiot that got a browser hijacker off of a link he followed from a spam letter. On a related note he also had Norton installed on his pc.

Re: What the fuck

[TechyImmigrant]

How far does one have to go to get a funny mod around here?

Re:Windows Problems

[avandesande]

I've never had any strange behavior or unknown processes running on my machine and none of my online accounts have been hacked. What exactly should I be worried about?