Beta

×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

AV Software Isn't Dead, But It's Not Healthy

Hemos posted more than 7 years ago | from the i'm-not-dead-yet dept.

Security 162

dasButcher writes "Is a conventional signature-based antivirus technology dead? Trend Micro CEO Eva Chen says no, but more is needed. Her answer: reputational analysis. Not a bad idea, but many have tried and failed to make this type of approach work. We've seen it all before: RBLs, integrity grading, etc. What will make this different? If we're not careful, Trend Micro might give us all a bad Web reputation. "

cancel ×

162 comments

Sorry! There are no comments related to the filter you selected.

First! (-1, Troll)

Anonymous Coward | more than 7 years ago | (#18488349)

Booyah! Numero uno!

AV Software Isn't Dead... (5, Funny)

Anonymous Coward | more than 7 years ago | (#18488365)

...it's just pining for the fjords.

Re:AV Software Isn't Dead... (3, Funny)

Archangel Michael (180766) | more than 7 years ago | (#18488763)

Whoo-hoo-hoo, look who knows so much. It just so happens that your friend here is only MOSTLY dead.

Re:AV Software Isn't Dead... (2, Informative)

phoenixwade (997892) | more than 7 years ago | (#18489963)

...it's just pining for the fjords.
it's not pinin'! it's passed on! This software is no more! It has ceased to be! it's expired and gone to meet 'is maker! it's a stiff! Bereft of life, it rests in peace! If you hadn't nailed it to the perch it'd be pushing up the daisies! its metabolic processes are now history! it's off the twig! it's kicked the bucket, it's shuffled off its mortal coil, run down the curtain and joined the bleedin' choir invisibile!! THIS IS AN EX-SOFTWARE PRODUCT!!

(I love the opportunity to make a Monty Python Reference! Second only to South Park.... oh, yeah:)

They killed AV Software...... You Bastards!

The fewer the merrier (4, Insightful)

Reverse Gear (891207) | more than 7 years ago | (#18488387)

I sure am not a big security expert, so forgive my n00bish words here.

I don't remember where, but at some point I read somebody, probably a sys-admin, saying that if you really want security then what you need to do is disable all the things you do not need. Not by default to allow everything and then pick the things you do not want, but go the other way around and make the default to not allow anything and then enable the things you need.
I guess this is one of the reasons I like Gentoo so much, I know everything that is installed on the system and I can remove it if I don't like it.
I don't like to install all kinds of things that I do not know what is and do not know if I can trust. The more things I have installed the more vulnerabilities I also have.

One of my friends once ran a version of Windows XP that he had pretty much scraped everything of that didn't need to be there, I think he was a lot more secure than he would have been had he filled his computer with all kinds of AV and anti-malware programs, some of them seem to be causing more problems than they solve anyhow.

Re:The fewer the merrier (0)

Anonymous Coward | more than 7 years ago | (#18488525)

And for extra security, disable the things you do need! If you can't use the computer for anything, then THEY can't either.

The first 3 rules of computer security. (4, Insightful)

khasim (1285) | more than 7 years ago | (#18488541)

#1. There is no security without physical security.

#2. Run only what you absolutely need.

#3. Run it with the minimum rights possible.

The reason that Trend Micro's "new" approach will fail is ... rather long. Follow along for a moment.

a. Vulnerability is found and exploit is written.
b. Exploit needs to be distributed.
c. Exploit is distributed via a quick spam flood - they have no protection against this.
d. Exploit is posted on a web site - how do the bad people drive traffic to that site?
e. They use a compromised site. They hide the exploit in a directory that robots.txt says not to scan. Either Trend Micro violated robots.txt or it cannot find the exploit.
f. So Trend Micro will have to violate robots.txt and that behaviour should be noticeable. So the bad guys would hide that file from something that looks like a webcrawler that doesn't respect robots.txt.

And we're back at the beginning.

Re:The first 3 rules of computer security. (3, Funny)

voice_of_all_reason (926702) | more than 7 years ago | (#18488767)

#1. There is no security without physical security.

Hire a bodyguard to stand over your ethernet jack, then chase down and beat interlopers with a nightstick? I like the way you think...

Re:The first 3 rules of computer security. (1)

sjwoo (526878) | more than 7 years ago | (#18489279)

I thought the first two rules of computer security go like this:

1) You do not talk about computer security.
2) You do not talk about computer security.

Re:The first 3 rules of computer security. (1)

Ungrounded Lightning (62228) | more than 7 years ago | (#18491481)

1) You do not talk about computer security.

That's "security through obscurity" which has been shown to do more than buy you a (very) small amount of time, then fail catastriphically.

Re:The first 3 rules of computer security. (1)

shmlco (594907) | more than 7 years ago | (#18489665)

You forgot #4. Develop smarter systems.

In particular, outware facing software like mail clients and web browsers and feed-readers should automatically run with minimum rights (no matter what the user's rights) AND be sandboxed or virtualized such that malicious entities and hacks have no where to go.

In addition, any files saved across the boundary are automatically scanned and, if possible, validated. You may not know what some unknown virus signature looks like, but you sure as heck ought to know if an Excel document's format is valid or not. Develop a set of trusted validators for common formats (text, jpg, etc.) and require vendors to create them for their document types.

And layer the OS. Cycle-counters might not like it, but on a desktop system (heck, even on servers) putting rings around core kernel functions makes a lot of sense. Today's systems are fast enough that we can well afford to trade off a percentage point or two for security and stability. Be honest. If out of the box your new 4GHz quad-core computer was 1-2% slower, how would you even know? It would still seem light years faster that the 2Ghz single-core it was replacing.

As far as that goes, run the ENTIRE OS in a virtual layer. We seem to be heading there anyway...

Re:The first 3 rules of computer security. (1)

OriginalArlen (726444) | more than 7 years ago | (#18490717)

You forgot #4. Develop smarter systems.

Already done, thirty-five years ago [computer.org] .

Re:The first 3 rules of computer security. (0)

Anonymous Coward | more than 7 years ago | (#18491123)

Yeah and what's this entropy.bin? Random data? Sploit?
How about this thing with signature BZh? bzip2 archive, right? I suppose we have to look inside it to validate it. Oh, but that requires 2700K of RAM and nearly one second to unpack the first block so that you can even determine what it contains.

I also use another kind ending in .cs2. Only problem: there are *no* invalid .cs2 files that are longer than ten bytes.

Re:The first 3 rules of computer security. (1)

wolverine1999 (126497) | more than 7 years ago | (#18489675)

And it likely would be classified as a bad bot by scripts set up to detect them....

Your assumptions are not 100% correct (1)

winkydink (650484) | more than 7 years ago | (#18489819)

The reason that Trend Micro's "new" approach will fail is ... rather long. Follow along for a moment.

a. Vulnerability is found and exploit is written.
b. Exploit needs to be distributed.
c. Exploit is distributed via a quick spam flood - they have no protection against this.


Actually, they do. That's part of why the approach is novel.

d. Exploit is posted on a web site - how do the bad people drive traffic to that site?
e. They use a compromised site. They hide the exploit in a directory that robots.txt says not to scan. Either Trend Micro violated robots.txt or it cannot find the exploit.
f. So Trend Micro will have to violate robots.txt and that behaviour should be noticeable. So the bad guys would hide that file from something that looks like a webcrawler that doesn't respect robots.txt.


Actually, they can do this without scanning directories forbidden by robots.txt. Again, it's why the approach is novel.

Sorry, I can't say more as I'm under NDA. I'm sure the details will emerge soon.

Re:The fewer the merrier (2, Informative)

truthsearch (249536) | more than 7 years ago | (#18488571)

At the last place I worked, the IT department had their own XP distribution for the corporate desktops (ghost script or whatever). They started the process by deleting one DLL at a time and watching what broke. The problem was when my team created some new custom software we'd sometimes come across some fundametal problems because DLLs were missing. And these errors weren't always easy to track down.

Now you might say we'd run into this problem with any operating system. But when using Microsoft development tools on a Microsoft OS, the system makes the assumption that every basic dependancy which is built into the OS is there, which is reasonable. If it isn't things get flaky and hard to debug.

Windows (at least up to XP) simply isn't built for this level of customization. Therefore, if you want security through minimalism, Linux is the better way to go.

Re:The fewer the merrier (3, Informative)

Intron (870560) | more than 7 years ago | (#18488823)

Deleting DLLs is not the right way to "minimize the system". What you want to do is turn off unneeded services, not blow holes in your OS. Linux would fail just as badly if to turn off services you started deleting the contents of /usr/lib instead of disabling daemons in /etc/init.d.

Re:The fewer the merrier (1)

Billly Gates (198444) | more than 7 years ago | (#18488581)

My old man has a dieing windows98 system that he refuses to upgrade. It has a 3dfx vodoo1 card and the whole 9 yards.

Anyway guess how many times he had to reinstall windows98 during the last 6 years? 0!

Yes if you do not actually do anything but browse the web with firefox and occasionally run excel and word you will be fine even with the old win9x codebase.

Linux at least does not have this issue due to the nasty registry entries.

Re:The fewer the merrier (1)

billcopc (196330) | more than 7 years ago | (#18490347)

Seriously, what more does the average user do with a computer ? Just because I'm a code monkey, doesn't mean my whole family is too. They're quite happy doing web, email, excel and a few Popcap games. The whole idea of a 4gb operating system to do that is ludicrous.

Re:The fewer the merrier (1)

twistedsymphony (956982) | more than 7 years ago | (#18490735)

It's quite amazing how uninfected most people's computers are when they get rid of the crap they don't need and start using Firefox & a few extensions. I've got an IBM Thinkpad T20... it's a P3 533MHz, 256MB RAM, 12GB hard drive, 4MB S3 Video.. it's a beast I know.

it had Win98 on it when I got it back in 2000, I put Win2000 on it, and later XP once SP1 came out... after installing XP the DVD drive died... I use it for browsing, streaming media from my desktop, car diagnostics on track days, as well as a navigation system via a USB GPS device. It's got image tuning software for adjusting and tuning the image on my home theater screen. I take it on vacations with me to dump my digital camera data to, as well as manage some of my websites. And I even do a bit of web development on it (Graphics too Pain.net/GIMP run great) when I feel like taking a break from the office and heading to the coffee shop or even just trading in the desk chair for a couch. Since the disc drive died I couldn't install a new OS on it if I wanted to... but I've never had the need. I've stripped out all the crap I don't need in XP, and I run the bare minimum of applications to do what I need to do. I can't remember the last time it locked up on me, nor any other problems, and IIRC it was probably back when I had Win98 or 2000 on there. It runs quick for it's age, it's reliable and consistent.

I'm sure you could get the same kind of reliability using IE but the user needs to be activity diligent in keeping out malware and other internet nasties. FF+Adblock+Flashblock+Noscript does more for most people's computers then even the most advanced AV software on the market. As for the garbage applications that come pre-installed. I swear most computer companies are throwing that crap on there just help bog the system down and make people think they need another upgrade every year. Windows is no better, and Vista pushes new heights on the front of OS's pre-loaded with useless resource wasting garbage.

FWIW I use NOD32 for my AV needs

Re:The fewer the merrier (4, Interesting)

danpsmith (922127) | more than 7 years ago | (#18488585)

One of my friends once ran a version of Windows XP that he had pretty much scraped everything of that didn't need to be there, I think he was a lot more secure than he would have been had he filled his computer with all kinds of AV and anti-malware programs, some of them seem to be causing more problems than they solve anyhow.

I think you are right in this thinking. Windows XP's services that are enabled by default are ludicrous. That's one of the main security problems with XP. What I don't understand is why someone doesn't just allow the computer to start with absolutely no services enabled, and then gradually ramp up to what the computer actually needs, turning services on only as they are needed.

For instance, shutting down a service might make a certain set of USB gadgets might not work. But when you plug the USB device in, Windows itself (or the OS itself) could recognize that the service is needed for the device to function and automatically enable the service. Depending upon how much this costs it could automatically disable the service again if it isn't being utilized by anything else.

Maybe I'm being naive, but that doesn't seem like too much to ask. On really strange services you could prompt for password information in order to ramp up the ability to use them or something. Makes sense to me.

It seems to me that windows has everything enabled by default to be user friendly. But couldn't you do the same thing using this method? Instead of having a bunch of running services running at idle constantly, turn em on when you need em.

Re:The fewer the merrier (0)

Anonymous Coward | more than 7 years ago | (#18489137)

> It seems to me that windows has everything enabled by default to be user friendly.
> But couldn't you do the same thing using this method? Instead of having a bunch of
> running services running at idle constantly, turn em on when you need em.

Pardon me, but wouldn't you need a service to manage this functionality? And wouldn't that service be an even greater target for exploit-hunting?

Re:The fewer the merrier (3, Interesting)

Tanktalus (794810) | more than 7 years ago | (#18489143)

Er...? You've disabled IIS. The OS detects an incoming request on port 80. It enables IIS. Attacker leaves behind malware. IIS goes back down.

Other than that, I like your idea. If, for example, when it detected a service was needed, it popped up a nice dialog box saying something like, "Windows has detected an incoming request on port 80. is currently disabled. Enable? [ ] Don't ask this again. [Yes] [No]". And then, here's an important bit, if no response is detected within 30 seconds, assume "No", and continue. And log this in the system log. Maybe even email it to the user so they see it. (The email wouldn't happen for requests that were marked "Don't ask this again".)

I'm pretty sure a similar concept on Linux could apply - even if there's no user interface, just logging what comes in. In fact, I suspect some people have already set up iptables or ipchains or whatever to do exactly that: log all "intrusion" attempts. With a bit of work, I'm sure that some ports could be emailed (say, by default), with some trivial manner of masking ports (analogous to the "Don't ask this again" from above) to not receive notices about that port anymore. Possibly with netmasks - email me if someone comes in on 443 from 192.168.0.0/255.255.255.0, but not anyone else (ignore https requests from the internet completely).

In fact, I'm pretty sure someone has something like this already ... probably on sourceforge by now ;-)

Re:The fewer the merrier (1)

pkulak (815640) | more than 7 years ago | (#18489227)

So, at first telnet is not enabled, but when a request comes in on port 23 it's turned on? "Turned on by default" doesn't seem any different then having it on to begin with.

Re:The fewer the merrier (2, Insightful)

laffer1 (701823) | more than 7 years ago | (#18489259)

At first, this sounded like a good idea. Consider though that the OS still needs to have code to detect what the USB device is. So windows must see hey i've got a USB mouse or whatever and then load the service for it. That means the service is started later after scripts have time to bork the environment, and many services common on desktops will get triggered eventually anyway. So an attacker or rather his script may have to wait some time to get his malware executed but it will still occur. Since the service is not started early in the boot process, the environment could be tainted as well.

There is a balance between good security and flat out disabling valuable functionality. This balance is why Microsoft made Windows so open to begin with. They didn't see any threat and wanted users to be able to do whatever they wanted. (minus view the source code and customize at that level)

One problem with open source is that we don't have everything users want yet. A typical end user wants to be able to surf, edit photos, read email, IM, listen to music, watch DVDs and run office productivity software. Then you start getting to specialized groups like people who use financial software, play games, develop software, engineering apps, math apps, etc. At the same time, these users expect usb devices, sound cards, tv tuners, printers, and any other thing they plug-in to just work. Some linux distros have this down, but there is no consistency in applications. Many projects actually have to put up translation lists telling the user what the browser, im client and things are called. IE = firefox, MSN = gaim and so on. When you start disabling services, things start to break or become more difficult for the user. It doesn't mean everything should be on (who needs an echo server running).

So your idea may work for a subset of services or kernel modules, but we need other approaches to secure many services. Lets face it the approach may not be right, but trend micro is correct in assuming they need some new tricks. Vista is slightly more secure than previous versions of windows and as such malware authors are going to step up to the new challenge. So detection software must also improve. Its like the transition from telnet to ssh. For awhile, I felt *safe* using ssh because there were so many other targets on a clear channel to attack. As more people migrate to vista, or better systems the type of attacks will change.

Your idea requires validation that loading a service is really necessary and safe.

Re:The fewer the merrier (1)

bendodge (998616) | more than 7 years ago | (#18490237)

But when you plug the USB device in, Windows itself (or the OS itself) could recognize that the service is needed for the device to function and automatically enable the service.
Just set the service startup type to Manual and it will do that.

Re:The fewer the merrier (0)

Anonymous Coward | more than 7 years ago | (#18491943)

I'm not an expert, but wouldn't that require there to be services to monitor for when the parent service should be enabled?

Re:The fewer the merrier (0, Offtopic)

Chacham (981) | more than 7 years ago | (#18488633)

I sure am not a big security expert, so forgive my n00bish words here.

NAUGHTY BOY

Nor Are U Going To Yield Big Obfuscated Yucky acronyms

(It's a silent H...)

Re:The fewer the merrier (2, Funny)

stratjakt (596332) | more than 7 years ago | (#18488643)

Gentoo just crapped its pants on me in the middle of an "emerge -uD world", and now the box is borked. Won't boot, not even in single user mode. Reinstallation is a multi-day affair. Fuck that. At least you can flatten and rebuild a windows box in an afternoon.

But boy is it secure, it cant even spawn a tty.

Re:The fewer the merrier (1)

Reverse Gear (891207) | more than 7 years ago | (#18488783)

Well if you want to reinstall then that I am not going to stop you, but repairing a messed up installation usually isn't that hard if you know a bit about the system or go get a bit of support on the Gentoo Forums [gentoo.org] .
Just use a bootable CD and chroot into the system and get whatever fails on you fixed.
If it is a hardware failure then that is something totally different and it should not in the first place be blamed on Gentoo (even though compiling can be tough for the HD)

Re:The fewer the merrier (1)

brunascle (994197) | more than 7 years ago | (#18489941)

I don't remember where, but at some point I read somebody, probably a sys-admin, saying that if you really want security then what you need to do is disable all the things you do not need.
not sure who said it first, but this month's Linux Journal attributed this quote to Marcus Ranum [ranum.com] :

that which is not expressly permitted is forbidden

Re:The fewer the merrier (1)

sconeu (64226) | more than 7 years ago | (#18490437)

I believe that one's from E.B. White's "The Once and Future King" when the Wart goes with the ants.

Re:The fewer the merrier (1)

BlackEmperor (213615) | more than 7 years ago | (#18490559)

I've been using PC's for awhile, since about 1988 and connected to the net since 1994 and I have *never* ever installed any AV software on any of the PC's I have owned. I believe it's simply a scam based on scare tactics.

The only virus I've ever actually seen was the bouncing ball virus, which was a floppy boot sector virus back around 1989/90, and it wasn't on my PC.

I do however today run windows defender on my xp machines, plus firewalls etc... as this *is* important, but AV software? Meh.

Can I be the first to say it? (3, Interesting)

zappepcs (820751) | more than 7 years ago | (#18488391)

We need a new word to deal with this technology:

Webutation; The reputation an entity has, stemming from its web presence.

Re:Can I be the first to say it? (0)

Anonymous Coward | more than 7 years ago | (#18488437)

And it would be easier to pronounce for non-English speakers who have trouble with the letter 'R'

Re:Can I be the first to say it? (1)

jimstapleton (999106) | more than 7 years ago | (#18488659)

Ooh, lets patent it! Don't tell the slashdotters though, they might get mad...

*looks around*

*runs*

Re:Can I be the first to say it? (1)

hal9000(jr) (316943) | more than 7 years ago | (#18489003)

Somebody slap zappepcs, please. :)

Re:Can I be the first to say it? (0)

Anonymous Coward | more than 7 years ago | (#18489181)

Die, marketdroid.

Re:Can I be the first to say it? (1)

Digital Vomit (891734) | more than 7 years ago | (#18489289)

I suggest the phrase "online reputation" instead.

I'm esick to ideath of words being made up to describe the same old thing only ONLINE ZOMG!!!1!

Re:Can I be the first to say it? (2, Funny)

Xtravar (725372) | more than 7 years ago | (#18490015)

Brilliant! Let me have a try!

I'm e-sick to iDeath of WRDZ being webhanced to .Sell morenet of the360 blueSame VoIPOOP.

JAVA!!!

Re:Can I be the first to say it? (1)

DeadChobi (740395) | more than 7 years ago | (#18489949)

And then we can coin a new word for the security journal of this era! We'll call them "Webutationlog" or Weblog for short. It'll be brilliant and not at all stupid-sounding!

Bad Rep...? (1)

creimer (824291) | more than 7 years ago | (#18488429)

If we're not careful, Trend Micro might give us all a bad Web reputation.

Who is Trend Micro and why should I care if they give me "a bad Web reputation"? Considering that this is Slashdot, I'm not sure how someone's Web reputation can get any worse.

Re:Bad Rep...? (1)

drinkypoo (153816) | more than 7 years ago | (#18489557)

Who is Trend Micro and why should I care if they give me "a bad Web reputation"?

Trend Micro is a company that makes a variety of mediocre software that is constantly lauded as being superior to all others by ignoramuses who don't keep up with the modern world.

Among these products, unfortunately, is a system built into various Cisco security appliances. It is used to classify software. For example it is certain that various password sniffing utilities are trojans/malware. I was trying to save the IT department from having to reset my email password but I couldn't download mailpv because they were sure it was a trojan.

As such Trend Micro is already preventing legitimate security tools from being downloaded in businesses around the world...

Re: AV Software Isn't Dead (0)

Anonymous Coward | more than 7 years ago | (#18488453)

AV software?

Why should someone use something else than MPlayer http://www.mplayerhq.hu/ [mplayerhq.hu] for Audio/Video playback?

Trivial answer! (5, Insightful)

VincenzoRomano (881055) | more than 7 years ago | (#18488459)

Is a conventional signature-based antivirus technology dead? Trend Micro CEO Eva Chen says no.
If you ask an Oil company whether oil derived fuel engines are dead, they'll answer the same way.

OMG! Viruses of Mass Distruction?? (0)

Anonymous Coward | more than 7 years ago | (#18488611)

Is a conventional signature-based antivirus technology dead? Trend Micro CEO Eva Chen says no.

If you ask an Oil company whether oil derived fuel engines are dead, they'll answer the same way.


Please tell me that the AV companies don't also own a crazed lunatic world mis-leader!

Reutational analysis roblematic (2, Interesting)

Anonymous Coward | more than 7 years ago | (#18488475)

If eople want to use reutational analysis on this roblem, there's lenty of others I'd ersonally trust over Trend Micro.

Oh the stories I could tell as a former emloyee of this comany. Not only the missing "p" problem; there was the time they used a telephone number as a phishing signature (too bad it was the actual phone number of one of the largest banks in the US--and that all that bank's legitimate email to customers was trashed)--that was one big account they lost the next day. Or what about the time that a bad signature file took down about 80% of PCs in Japan. Or when it turned out that the library that scans for viruses was actually a vulnerability. Or the time...

Soooo glad I don't work for those guys any more.

Take it from me... (2, Funny)

Spudtrooper (1073512) | more than 7 years ago | (#18488535)

I said, "Mom, what are you doin'? You'll ruin my rep."
She said, "You're only 16, you don't have a rep yet."

I read it the other way around (2, Informative)

Billly Gates (198444) | more than 7 years ago | (#18488537)

AV software is alive more than ever thanks to crackers on the internet and buffer overflow malware ads on webpages.

PRoblem is the software is not healthy indeed and can screw up a whole system. ITs like their approach to neutralizing a hammer is to encapsulate the whole thing. Every i/o transaction is read and maybe even virtualized.

Does it stop virii? Hell no. I worked help desk at a gaming company which uses the IE sdk for some code on the logon screen. Anyway it wont load if any viruses or keyboard monitoring programs are installing which use the IE sdk. I get many callers saying "WTF. I have norton. What do you mean my system is infected!?". I then clean the system with some cheesy app that is not an antivirus program.

This is why reliance on AV software is dangerous (4, Informative)

Alioth (221270) | more than 7 years ago | (#18488543)

Funnily enough, I just wrote about this:

http://slashdot.org/~Alioth/journal/167405 [slashdot.org] - includes a link to a major study of a piece of malware which went undetected by the AV companies for months.

Or just go to http://www.secureworks.com/research/threats/gozi/ [secureworks.com] if you don't want to read my crap.

I've personally witnessed two malware infections where the malware arrived up to a week before the AV companies had updated their definitions.

Re:This is why reliance on AV software is dangerou (2, Interesting)

saddlark (96399) | more than 7 years ago | (#18488903)

Two times, I've observed that the opensource AV software ClamAV [clamav.net] nailed new email virii
about 6 and 12 hours before the commercial alternatives got signatures for them (3-4 examples, names left out to protect the guilty).

Of course, this doesn't always happen, but it's still an interesting observation.

Re:This is why reliance on AV software is dangerou (1)

justasecond (789358) | more than 7 years ago | (#18489467)

Two times, I've observed that the opensource AV software ClamAV nailed new email virii about 6 and 12 hours before the commercial alternatives got signatures for them (3-4 examples, names left out to protect the guilty).

So for every new virus but two the commercial alternatives got their signatures updated quicker? Guess I know which I'd choose...

Re:This is why reliance on AV software is dangerou (0)

Anonymous Coward | more than 7 years ago | (#18489791)

> virii

I just though you should know that no one on either side of the virus industry calls them "virii", only poseur faux-intellectuals.

a bigger problem (1)

JeanBaptiste (537955) | more than 7 years ago | (#18488547)

is the ABSOLUTE CRAP that is either norton/symantec or mcaffee.

I'm old enough to remember when both softwares were fantastic, it sucks to see what they have become. They cause more problems than they fix, bloated crapware. And don't even think about trying to un-install them, your better off reformatting and reloading.

rant over.

Re:a bigger problem (1)

SamMichaels (213605) | more than 7 years ago | (#18488691)

licensed/321

Ahh the good 'ole days :)

Re:a bigger problem (1)

Esion Modnar (632431) | more than 7 years ago | (#18489443)

Try SymNRT. Symantec publishes it to remove their software that is too borked up to uninstall the normal way. Go to www.symantec.com/symnrt.

Botnet (2, Funny)

daeg (828071) | more than 7 years ago | (#18488575)

So to defend against botnets, Trend Micro will make a massive spidering botnet capable of indexing and cataloging 100 million domains. If Morissette were available, I'd quiz her if this situation qualifies as ironic.

So help me if they don't honor robots.txt.

You have to trust something (4, Interesting)

starseeker (141897) | more than 7 years ago | (#18488591)

At a certain point, networking requires trust in order to realise it's potential benefits. Open source wouldn't work if everyone had to read every line of source code before running a program, so various organizations and projects develop trust and reputations. We know Debian, Fedora, Gentoo, etc. are OK and can proceed to use them with minimal trouble. A brand new Linux distribution must climb that hill, in addition to providing sufficient incentive for people to find out if they can be trusted. That's tough.

The anonymous nature of the web is what allows things like virus writers to succeed - if they couldn't hide, they wouldn't assume the responsibility for what they're doing (well OK a few nut cases would, but the same is true in real life.) However, forcing unique identities on people opens up a host of other problems, some of them more serious than the ones we have today.

So we must operate in the twilight world of making networks which cannot be successfully attacked by bad actors. There are a wide variety of intermediate solutions, like today's anti-spam techniques, wikipedia's system and even slashdot's own moderation system. But none are perfect and none can be perfect - the problem is not solvable in general. Open source actually helps this in one major way - the community controls that operate in the real world to keep human social systems functional also operate (to some degree) in small scale projects. There the individual traits of interested parties become known over time, and recognition and trust can be built up based on more than just a name or email address. It is not perfectly robust, but then no system to date has been.

Virus problems will continue as long as there are people wanting to write viruses, as they are simply an electronic version of spray painting walls, defacing monuments, or other useless and harmful activities that have persisted since the beginnings of civilization. We must rely on community, the most robust tools we can devise, and (finally) building our own web of trust based on things we have found to work. These issues are fundamental to the human condition and (like all social problems) cannot be resolved by technology. The fact that spam emails can be identified at all, for example, is really just an indication of the lack of skill of spam writers. Likewise, someone really wanting to distribute a virus can just make a freeware program that actually does something real and useful long enough to build a reputation, and then when it is widely distributed trashes every system it is installed on. There are always ways to attack a target, if enough effort is put into the planning. The trick is to be fault tolerent and recover quickly. In specific cases better security can be achieved (classified information, etc.) but for the general case it will always come down to dealing with the consequences of antisocial behavior as it happens.

Re:You have to trust something (1)

starseeker (141897) | more than 7 years ago | (#18488615)

beg pardon, that should be "realize its" not "realise it's" - sorry.

Re:You have to trust something (2, Interesting)

99BottlesOfBeerInMyF (813746) | more than 7 years ago | (#18488919)

At a certain point, networking requires trust in order to realise it's potential benefits... We must rely on community, the most robust tools we can devise, and (finally) building our own web of trust based on things we have found to work. These issues are fundamental to the human condition and (like all social problems) cannot be resolved by technology.

I agree with most of your comment, at least in principal. I think one of the most important ways the industry needs to jump if it is going to make the malware problem a minor inconvenience or a rarity, is to build tools to harness the intelligence and trust of others, be they communities, formal organizations, or commercial enterprises.

OS's need to start relying upon the amount of trust given to a piece of software or network service and restricting them appropriately based upon that level of trust. Channels for "voting" on how much some software or service should be trusted need to be made open and user configurable. And by "voting" I don't mean individual people should be voting on if some software is reliable. I mean the user should be subscribing to intelligence feeds from malware watchdog groups, commercial anti-malware services, OS vendor provided services, and online communities. The end user should be responsible for deciding who they trust and the OS should be responsible for translating that trust into one consolidated policy for restricting the access given to Web sites, applications, network services, etc.

I want to be able to get a random executable in my e-mail inbox, double click on it to run it, and have the OS discover if it is signed, if it is certified, if it matches any malware signatures, and what level of trust it should be given based upon a merge of several different information sources to which I have subscribed. Then I want the OS to automatically apply an ACL to that executable or even run it in a VM, based upon the ACL included in the application (if present) the ACL my OS has specified for that trust level/app type, and the ACL suggestions from said information services. I want all this to happen more or less in the background with me just double clicking it.

I honestly think that until such a system is build into mainstream OS's the malware problem will continue, full speed ahead. The problem with this is only Microsoft is in a position to really do this because of their monopoly and their position as the only real target for current malware. Further, I don't think they are capable of doing it because of the way they are organized. They don't lose enough money when their users are compromised because of their monopoly. Their entire business is built on lock-in instead of quality, so they would almost certainly implement a signing/certifying system that locked user into them, and thus provided mostly useless information since there would be no competition among providers. They have repeatedly shown themselves incapable of taking security seriously and when UI is a vital part of security they have never, ever shipped anything that was not a disaster.

My only real hope for the malware situation to be contained is encroaching OS X on the desktop and encroaching Linux in business that might break their choke hold long enough for someone else to do it right, or for MS to be forced to compete to survive, resulting in a real change in Redmond. Without antitrust laws being enforced, however, it is a long shot.

Re:You have to trust something (1)

Phroggy (441) | more than 7 years ago | (#18489299)

Virus problems will continue as long as there are people wanting to write viruses, as they are simply an electronic version of spray painting walls, defacing monuments, or other useless and harmful activities that have persisted since the beginnings of civilization.
Sure, that used to be the case. Now, I think most viruses are delivery agents for botnet software that can be used to send spam. It's all about the money now, and botnets are where the money is.

Re:You have to trust something (1)

OriginalArlen (726444) | more than 7 years ago | (#18490811)

Virus problems will continue as long as there are people wanting to write viruses, as they are simply an electronic version of spray painting walls, defacing monuments, or other useless and harmful activities that have persisted since the beginnings of civilization
A nit-pick with an otherwise interesting comment: very few virus writers are doing it for fame and 1337ness points these days. They're here for the money. Anyone capable of writing an effective virus (and who doesn't mind dealing with full-on criminals) can cash in quite successfully.

Wont work (2, Interesting)

cyberbob2351 (1075435) | more than 7 years ago | (#18488601)

The newly released OfficeScan 8.0 will include endpoint security features that will block access to Web sites that have a reputation as sources for malicious activity.


Considering the fact that the infestation could be due to either a worm infection, or could come about by accessing a webserver that is in actuality a compromised botnet drone, how on earth is such a reputation system supposed to be effective?

Most of your issues will not come from the same sites over and over. The only exception to this is crack and warez sites, but we already have similar reputation systems implemented.

network service (0)

Anonymous Coward | more than 7 years ago | (#18488629)

Point your DNS at $vendor and let them deal with the crap, with the unexpected doubling of volumes overnight (as happened towards the end of last year), etc.

I can't name vendors as I work for one, but Google is your friend.

The main reasons this works better than traditional end-point a/v:

  1. the sample size is much bigger than desktop vendors see
  2. we can spend a LONG time (compared to trad a/v) running paranoid heuristics against anything we're not sure about. Desktop anti-virus has to be as fast as possible to not spoil the user experience.

Of course this isn't a silver bullet for all malware, but it kills spam virtually stone dead, and cleans a lot of crap from your inbound mail feed.

tro7l (-1, Flamebait)

Anonymous Coward | more than 7 years ago | (#18488639)

Incomplete solution (0)

Anonymous Coward | more than 7 years ago | (#18488649)

This [wikipedia.org] is the only way to be sure.

It's just too much... (0)

Anonymous Coward | more than 7 years ago | (#18488679)

The old barn door begins to give way under the weight of all the locks.

Why reputation-based approaches suck big time (1)

MikeRT (947531) | more than 7 years ago | (#18488685)

All it takes is for a user to get pissed off at your software and mark it down on the list for the ball to get rolling. Same thing applies to spam. I know people who cannot be bothered to unsubscribe from mailing lists. Instead, they just mark it all as spam, not even caring that they signed up for the stuff in the first place!

Re:Why reputation-based approaches suck big time (1)

Nivoset (607957) | more than 7 years ago | (#18488951)

I would say if people signed up for spam its ok. but how do you tell for sure? some places all but hide the fact that you really are, or use criptic wording to make you get it unless you really read it all.

And i know half the unsubscribe links i ever got seemed to be more of links to say "hey, this is a valid email!" than ever stopping the spam. i now just block anything with it in the body

Reputation does not prevent spread of viruses... (4, Insightful)

Dr. Zowie (109983) | more than 7 years ago | (#18488699)

... otherwise there would be no syphilis in the world.

Seriously, there is a pretty direct analogy between (digital epidemiology, computer viruses) and (real epidemiology, real germs). If there were a simple answer to the digital problem, it's a good bet that some population or other would have adopted the analogous strategy to the real epidemiology problem.

STDs offer a good analogy for digital viruses with a Trojan-style (no snickers, please) strategy. In both cases sharing of {data|fluids} yields immediate benefit at some risk. In both cases, populations have adopted reputational strategies to avoid spreading/contracting viruses. In neither case do those strategies work.

Even with near-perfect "antivirus software" (the antibiotic penicillin), the old monsters of syphilis and gonorrhea still remain on the planet, and penicillin-resistant strains have even evolved. One problem is that reputations are hard to establish and not necessarily accurate; another is that most humans tend to discount future risks in favor of immediate benefits.

Interestingly, the reason that the traditional venereal diseases are treated with penicillin injections (and not an oral course) is that, statistically, patients are unlikely to finish the oral course -- a properly completed oral course of penicillin is as effective as the traditional three injections. There is perhaps a lesson to be learned there about how effective corporate data-hygiene strategies are likely to be.

Re:Reputation does not prevent spread of viruses.. (1)

xtracto (837672) | more than 7 years ago | (#18488947)

And here is where you think that if people would not take care of their own bodies how could you expect for them to care about a darn computer...

As you said, the main issue is the "immediate benefits." whereas it is a nice orgasm, or winning the Nigerian lottery or anything else, lots of people do not know the risks, and lots of people do not care about the risks even if they know them.

Re:Reputation does not prevent spread of viruses.. (1)

winkydink (650484) | more than 7 years ago | (#18490125)

Is your desire to surf the web as great as your sex drive? Your analogy is deeply flawed.

Web Surfing and Sex Drive (1)

Slashdot Parent (995749) | more than 7 years ago | (#18490739)

Is your desire to surf the web as great as your sex drive?
Isn't the average slashdotter's drive to surf the web little more than the slashdotter's sex drive, itself?

with apologies to Freedy Johnston (2, Funny)

sammy baby (14909) | more than 7 years ago | (#18488807)

What will make this different? If we're not careful, Trend Micro might give us all a bad Web reputation.


(Sung to the tune of "Bad Reputation", by Freedy Johnston)

I know, I've got a bad reputation:
and it isn't just W32/Delbot.
If I could only keep this damn malware
out of my inbox.

I could have had a normal conversation,
if it wasn't for this firewall.
If it deletes zip files with passwords,
then they're worth fuck-all.

Suddenly, my mail gateway is hosed,
malware is being
installed by the truckload,
keeps breaking down.
Can you help me now? Can you help me now?

This is Crazy Making! (2, Interesting)

mpapet (761907) | more than 7 years ago | (#18488835)

Why, in this day and age, are we having a conversation about anti-virus anything?

Instead of accommodating Microsoft's severely broken security model, now updated with "are you sure you want to do this?" Just flush that windows partition and install your linux distro of choice, or install linux on the PC and give it away, or get a Mac.

No, sysadmins like me won't be doing this at work anytime soon. Ever since I told family and friends who needed computer support I won't fix windows and gave them the option of buying a mac or switching to Linux, I'm having much more fun on my days off.

The extra benefit is I don't have to discover some of the ummm, unusual, tastes-and-preferences in my friends cache.

Re:This is Crazy Making! (1)

Red Flayer (890720) | more than 7 years ago | (#18489603)

Why, in this day and age, are we having a conversation about anti-virus anything?
Because with mass installations of Linux distros, we'll still be facing the same problems -- just with a different OS. Don't think that Linux has no holes.

The biggest security advantage wrt viruses etc that Linux has now is small market share. If 90 % of the world used Linux, then I'd bet that *Windows* would be effectively (not inherently) more secure than Linux.

I'm sure that Windows is inherently less secure than Linux -- but it wouldn't really matter if it were the Linux holes being exploited by the majority of malware.

Re:This is Crazy Making! (1)

exp(pi*sqrt(163)) (613870) | more than 7 years ago | (#18489715)

If 90 % of the world used Linux, then I'd bet that *Windows* would be effectively (not inherently) more secure than Linux.
But that doesn't mean the advice is bad. If 33% of people used Linux, 33% MacOS X and 33% Windows then we'd no longer have an OS monoculture and it'd be harder for viruses to spread than if 95% of machines ran the same OS.

Re:This is Crazy Making! (1)

Red Flayer (890720) | more than 7 years ago | (#18490935)

You're right, but would this change in install base mean that discussing AV is pointless?

AV will always be necessary, and the more it's discussed, the better - particularly when it needs to adapt to changing malware techniques.

Logical Fallacy (1)

mpapet (761907) | more than 7 years ago | (#18490977)

The biggest security advantage wrt viruses etc that Linux has now is small market share.

Wrong.

Windows security model and the *nix security model is a false analogy. In no way are they comparable.

Instead of making false analogies, why don't you install a Linux distro and discover all of the benefits of running a sensibly designed, though hardly perfect, OS. Yes, you trade anti-virus subscriptions, anti-spyware software and Microsoft treating you like a criminal with their WGA software for some hardware incompatibility.

Overall, you get to concentrate much more on using rather than taking care of the PC.

Re:Logical Fallacy (1)

Red Flayer (890720) | more than 7 years ago | (#18491567)

Are you claiming that the Linux security model is unbreachable and, if adopted by everyone, will obviate the both need for AV and the need for discussions about AV?

As much as Linux's security model is better than Windows', the need for AV will never disappear.

Analogy? Where is there an analogy? There is simply a comparison, which is something completely different.

Do they compare equitably? No, as I state in my OP, which you simply ignored.

Does market share, and therefore targeting of malware affect total harm from malware? You bet.

Is it safe to assume that more malware would be written to target Linux if Linux had a much greater marketshare? Yes, since there would be a greater financial incentive to do so.

So we still end up with a situation where AV is necessary, and discussion of AV is necessary.

Please think about this. Changing over to Linux does not remove the necessity of thinking about security -- that is a very dangerous step to take.

Re:This is Crazy Making! (1)

99BottlesOfBeerInMyF (813746) | more than 7 years ago | (#18491869)

Because with mass installations of Linux distros, we'll still be facing the same problems -- just with a different OS. Don't think that Linux has no holes. The biggest security advantage wrt viruses etc that Linux has now is small market share. If 90 % of the world used Linux, then I'd bet that *Windows* would be effectively (not inherently) more secure than Linux.

I think you're dead wrong on all points. Sure Linux benefits from having a small market share, but that is not the main factor. The biggest problem with Windows security is that MS has a monopoly on desktop OS's. As such, MS has no real motivation to respond to and solve users' security problems. When a user's Windows box gets infected, they don't look at other options because every computer in the store is running Windows. If somehow the user finds out about Linux, the chances are they still have to buy a copy of Windows to get their hardware and that means MS got paid. If MS lost customers and hence money because of the malware problem, they would solve it.

Linux, even if it had 90% of the market, would never wield monopoly influence in the market because of the licensing. If there was one Linux distro with all that share and malware on Linux got terrible and the developers ignored the problem, someone would fork it and solve the problem and nothing would stop users from moving to the new, secure distro because it is free and the software still works and there is no lock-in.

I'm sure that Windows is inherently less secure than Linux -- but it wouldn't really matter if it were the Linux holes being exploited by the majority of malware.

It would matter a great deal because Linux would adapt to solve the problem by adding layers of security and granularity of security and new services and technologies. Signing, certification services and blacklists, MACLs, active scanning, whatever it takes Linux developers would do it because those developers have a direct financial interest in securing the boxes. MS has no such financial incentive. The idea is called a capitalist free market, which brings competition and innovation. The base problem with Windows security is not their design principals, it is that they have broken capitalism with a monopoly and like the former soviet union, the consumers are suffering for it.

Re:This is Crazy Making! (4, Funny)

Mister Whirly (964219) | more than 7 years ago | (#18489787)

"Ever since I told family and friends who needed computer support I won't fix windows and gave them the option of buying a mac or switching to Linux, I'm having much more fun on my days off."

Walking my family through command line installs of libraries and helping them chmod permissions so they can access the files they saved. I love the fact that all my dumbshit realtives are now running Linux, I mean who needs time off on weekends anyways!!! Now when my mom wants to install a new printer, insead of just plugging it in, now we get a 3 hour long session fighting with generic Gimp drivers and it still won't print 100% correctly. And my parents were really stoked that the thousands of dollars they had spent on Windows software was now mostly worthless! Yep, if there is one thing Grandma really loves digging into it's compiling her own Linux kernel - she really just can't get enough of it! All and all I'd say that an OS designed for geeks who really love tinkering with their systems is working out terrific for the average computer illiterate masses...

Right. Because Linux is perfect... (1)

msimm (580077) | more than 7 years ago | (#18490013)

Sys admins like *me* prefer variety and get a little tired of the messiah complex some people have regarding religious OS of [choice].

Blaming Windows on security problems cart-blanc seems pretty ridiculous (they get credit, but all the credit?). Especially right before jabbing them for improving it a little (it's annoying, but *as* a systems admin I'm sure you know the security/usability trade-off).

Do you think because Linux distro's do things slightly differently that with mainstream adoption they would have such an easier time or simply become a more mainstream target? Sounds kind a cavalier to me. *If* Linux picked up steam or Windows suddenly ceased to be, whatever replaced it would be the new focus of script kiddies and security experts. I'd probably move straight to OpenBSD or Solaris. But until that happens (I don't see why it would) I certainly won't start trying to strong-arm my friends and family into using *my* operating system of choice. I'd rather have them follow a few basic security measures that they can take with them across operating systems (say, like how AV products are good and keeping them up-to-date can help or using anti-adware software...).

But if you're friends/family like being brow-beat, what the hell. I should try that here at the office (of course the CEO would probably get cranky, but hey, it's Monday!).

Re:Right. Because Linux is perfect... (1)

mpapet (761907) | more than 7 years ago | (#18490803)

o you think because Linux distro's do things slightly differently

The security models are _not_ comparable. At all. Yes, Microsoft is trying to emulate unix-ish security model on the surface, below that the whole Microsoft security objects model is a complicated mess that culminates in "Are you sure you want to do this?"

Blaming Windows on security problems cart-blanc seems pretty ridiculous (they get credit, but all the credit?).
While they are running on 98% of all PC's yes, I give them all the credit.

I certainly won't start trying to strong-arm my friends and family
This statement is an attempt to marginalize a different choice in operating systems. Please examine your motives carefully and get back to me when you and I are in the same room talking to my friends and family.

I'd rather have them follow a few basic security measures
Yes, and Windows is still broadcasting (!) open ports, users run as administrator, and zero-day attacks remain a very low priority for Microsoft while Windows Media Player DRM patching is a high priority. End result: they still get malware.

Windows is a broken user security model. I encourage you to expand your horizon.

Simplifiction.. (1)

msimm (580077) | more than 7 years ago | (#18491411)

So you think your family/friends would go from using Windows with no security to using Linux better? Because Linux distros install no unneeded services by default? And of course your computer challenged friends will then be sure to apt-get update/yum update/etc and they'll check their crontab to be sure freshclam is running nightly.

You can get all pissy with me if you want. My horizons won't be hurt. I work with what you advocate every day. I just don't particularly care for that unrealistly cavalier attitude. It reminds me of myself when Linux was new to me. After 8 or 9 years Linux is good, but things don't seem so black and white anymore.

an attempt to marginalize a different choice in operating systems.
Sure. Because I hate Linux/Mac/Solaris/BSD...oh snap! I don't. My motives are simple: let people work on whatever they find productive. Maybe I don't mind helping the friend/family member as much? (wasn't that your motive?)

Basic security is still your best bet. But you can argue with me all you like.

Re:This is Crazy Making! (1)

OriginalArlen (726444) | more than 7 years ago | (#18490861)

Unfortunately malware will be with us as long as we have the mark 1 human sitting in front of the keyboard. All the attacker has to do is convince the user to install $evil_binary and boom, game over. If you've got a patch for human stupidity, send code!

AV are Dead (2, Informative)

smist08 (1059006) | more than 7 years ago | (#18488843)

I stopped realtime scanning when I realized that over 50% of my CPU was going to scanning virus's. Now that it is turned off, things run much faster. E-mail seems to be the main source of virus's, but most email servers scan for virus's so doing a local realtime scan is just a waste of time. Otherwise just avoid memory keys, and disks which is fairly easy. I find Spyware a bigger problem than virus's but just running Spybot every now and then to clean off things installed by other software like webcams seems good enough. Certainly my PC runs much faster and more reliably with AV turned off. Still do a system scan now and then, but haven't found a virus in like five years.

Re:AV are Dead (1)

MontyApollo (849862) | more than 7 years ago | (#18490553)

I haven't detected a virus on my home computer in over 5 years as well. McAfee has become so bloated, I'm trying to decide whether to just remove it totally or just keep it turned off except for the occasional scan. It also seemed like in the past it was a lot easier to disable McAfee temporarily (right clicking the icon in the quick start toolbar), while now it is a lot more trouble to toggle it on or off.

Re:AV are Dead (0)

Anonymous Coward | more than 7 years ago | (#18491311)

It's viruses, not virus's.

SiteAdvisor (2, Interesting)

Strilanc (1077197) | more than 7 years ago | (#18488859)

Wow, this is the same thing as Site Advisor; except it doesn't warn you about bad websites, it just tells you to fuck off. How hard could it be to modify the site advisor extension to do that?

Trend Micro? (1)

Skythe (921438) | more than 7 years ago | (#18488915)

Queue PC-cillin bashing.

A more naive self once had it as virus protection several years ago.
Ended up causing a multitude of problems that it shouldn't have.

Signature-Less Anti Virus (1, Interesting)

Anonymous Coward | more than 7 years ago | (#18489309)

At http://www.calyptix.com/ [calyptix.com] we have a lot of success with our signature less inspection engine, DyVax. This includes stopping the Storm Trojan and Nuwar malware hours before the big vendors saw samples on their honeypots. Reliance on signatures creates costly downtime, we are trying to eliminate that.

Effort going in the wrong places (2, Interesting)

Animats (122034) | more than 7 years ago | (#18490419)

If all the effort spent on security approaches we know won't work, like looking for known attacks, were spent on approaches that can work, like fixing operating systems and applications so external content runs in jails that work, and developing reliable means for sanitizing content, we'd be much further along.

Think about it. Symantec is a billion dollar company selling a product that barely works. Nobody is spending that kind of money making operating systems more secure.

The problem with all this so-called "virus security" is that it's aimed against bulk attacks that are mostly annoyances. It won't detect focused attacks aimed at a business or government site intended to steal serious money or information.

Military security people are trained to make that distinction. Some effort has to be devoted to chasing off kids throwing rocks over the fence, but they're not a real threat. The real threats are subtle, until it's too late. The commercial computer security industry does not get this at all, and doesn't want to.

yes you're dead on (1)

gelfling (6534) | more than 7 years ago | (#18490747)

Screw AV it's dead end. Take all that time and resource and brainpower and focus on making the OS stronger and hackproof. Windows has become a titanium armored soldier with seriously bad heart disease. Making the armor stronger isn't going to help anything in the end.

Re:Effort going in the wrong places (2, Insightful)

OriginalArlen (726444) | more than 7 years ago | (#18490937)

Think about it. Symantec is a billion dollar company selling a product that barely works. Nobody is spending that kind of money making operating systems more secure.
Now far be it from me to defend the great satan, but to be fair Microsoft have spent a lot more than that on improving security since Bill "got it" and sent his memo back in, what was it, 2003? They still haven't trained themselves to make the right call when it comes to usability vs functionality (see UAC, and so on and on) but Vista is a lot more secure out of the box than XP SP2 - which itself was an improvment over 2000. (Which, admittedly, was worse than NT4 which was worse than 3.51, but that's beside the point.)

It probably won't show up in the botnet stats even once Vista is ubiquitous, though, as you still have to allow the user to install arbitrary binaries, which means the attacker just has to fool them. And they've had a lot of practice with that over the last few years. There IS no technical solution to this, unless you completely close the ecosystem - prevent the user installing arbitrary executables, shut down the internet as we know it -- or find an infalliable on-demand method of deducing what a given program is going to do; and if you've got a solution to the halting problem, I'm sure we'd ALL like to hear it ;)

Re:Effort going in the wrong places (1)

99BottlesOfBeerInMyF (813746) | more than 7 years ago | (#18491731)

Think about it. Symantec is a billion dollar company selling a product that barely works. Nobody is spending that kind of money making operating systems more secure.

Symantec is a billion dollar company spending money to make money. MS has not such motivation to fix their OS since if it is insecure, people have to buy it anyway... it is the only thing in Walmart or K-mart or 90% of all stores.

The real threats are subtle, until it's too late. The commercial computer security industry does not get this at all, and doesn't want to.

The commercial "security" industry has given up Windows as a lost cause. No credible security person who wants a secure server or workstation considers Windows a viable option. There is plenty of work being done on real security, like SELinux based solutions. The problem is you're looking at the "fixing the worst of Windows insecurity" market instead of the security market.

GEEK SQUAD WOO HOO!! (1)

Danzigism (881294) | more than 7 years ago | (#18490699)

I'm personally sick and tired of these retarded Geek Squad bastards installing Norton or Mcafee on these horrible Hewletts with 256mb of RAM attempting to run XP.. Old people have no freakin' clue what to do or what they're buying, so it ends up ruining their computers even more than what they already are..

AV should seriously die a horrible death in my opinion because there's always going to be the need for bigger and better security, and the low-end computers that everyone buys because they're $300 at Walmart, aren't going to be able to handle it.. leave it up to the operating system to be secure, and leave it up to the computer experts to remove bad viruses if and when they do come around.. face it, when is the last time your AV software actually got rid of bad virus? the only program that even comes close to operating correctly without hogging up tons and tons worth of precious resources is Panda AV anyway..

People that have a decent expert opinion with computers typically don't even use AV software.. and if you do, you must be one lazy bastard and don't care how fast your system operates.. you should be using hijackthis, autoruns, killbox, and some of the other nifty utilities out there..

I will say that I've been a little impressed with Vista's CPU prioritization of certain tasks.. Maybe if they make new AV software that operates similarly to the way Vista indexes, and can scan your computer all the time using a lower CPU priority, then I think it will be more worth while for the regular user..

as for now, customers rather pay me $40 in-shop labor for removing all the horrible spyware and viruses from their computers every few months, than have to deal with slow computers running AV software and having them prompt them every 10 seconds regarding something they don't even understand..

Re:GEEK SQUAD WOO HOO!! (1)

DragonTHC (208439) | more than 7 years ago | (#18491277)

People that have a decent expert opinion with computers typically don't even use AV software.. and if you do, you must be one lazy bastard and don't care how fast your system operates..
You sir, are a moron.

Only a moron doesn't run AV software.

a simple utility will not block a nasty virus which uses an exploit in your operating system to propagate.

You can't stop it alone. We all know you're not sitting in your mom's basement writing your own windows patches.

Use kaspersky or avira

Japan (1)

minus_273 (174041) | more than 7 years ago | (#18491227)

Last i checked AV software was doing fine in Japan. Just look at the H game section..
Load More Comments
Slashdot Login

Need an Account?

Forgot your password?
or Connect with...

Don't worry, we never post anything without your permission.

Submission Text Formatting Tips

We support a small subset of HTML, namely these tags:

  • b
  • i
  • p
  • br
  • a
  • ol
  • ul
  • li
  • dl
  • dt
  • dd
  • em
  • strong
  • tt
  • blockquote
  • div
  • quote
  • ecode

"ecode" can be used for code snippets, for example:

<ecode>    while(1) { do_something(); } </ecode>