Antivirus software could make your company more vulnerable • Hacker News Board

Re: Antivirus software could make your company more vulnerable

#31

Post by akavel » Tue, Jan 12, 2016, 12:45 AM UTC

hiram112 wrote: post #4

I avoided AV software for most of my life. Though, when I worked as a student admin, I would always install AV for the majority of my users. Most users (especially older) simply could never learn not to download that cool new 'freeware' app or game or not double click a downloaded exe (the fact that hidden extensions are still the default on Windows OS is absurd). As a more savvy user, I did not desire the typical AV…

Regarding "future for tech-aware users will be browsers in [...] container/VM", see also Qubes OS:

https://www.qubes-os.org/screenshots/

https://www.qubes-os.org/

https://www.qubes-os.org/intro/

and the (microkernel-based) Genode OS with somewhat similar approach:

http://genode.org/documentation/release-notes/15.11#Rigid_se...

http://genode.org/documentation/release-notes/15.11#Genode_a...

http://genode.org/about/

and finally NixOS/Nix, which I hope will at some point become integrated in some way with the above OSes (as well as many others):

http://nixos.org/

Re: Antivirus software could make your company more vulnerable

#32

Post by caf » Tue, Jan 12, 2016, 12:51 AM UTC

  ...and it also recently introduced HVMI (Hypervisor-based Memory Introspection)
  technology that completely isolates the antimalware solution by deploying it in
  a Type 1 hypervisor outside of the operating system.

  "This kind of isolation separates the antimalware engines from rootkits or
  exploits running in the user environment," the company said.

This completely misses the point. Yes, it protects the AV from exploits in other user software, but it makes exploits in the AV software itself even worse.

Re: Antivirus software could make your company more vulnerable

#33

Post by AnimalMuppet » Tue, Jan 12, 2016, 1:08 AM UTC

drummer32 wrote: post #28

AnimalMuppet wrote: post #21

Earlier quoted context omitted.

Do you think that AV, on net, makes you less secure? If so, can you provide any data?

This[1] is on the very top of the fronpage right now. TrendMicro has a daemon listening on localhost that can execute arbitary commands. [1] https://news.ycombinator.com/item?id=10882563

Right. (But that's one AV vendor. Others have the same possibility, of course.) But is it still better (more secure) to run without any AV at all? Something like this leaves you vulnerable to that flaw, but no AV leaves you vulnerable to everything (unless a firewall saves you).

Re: Antivirus software could make your company more vulnerable

#34

Post by tim333 » Tue, Jan 12, 2016, 1:45 AM UTC

hiram112 wrote: post #4

I avoided AV software for most of my life. Though, when I worked as a student admin, I would always install AV for the majority of my users. Most users (especially older) simply could never learn not to download that cool new 'freeware' app or game or not double click a downloaded exe (the fact that hidden extensions are still the default on Windows OS is absurd). As a more savvy user, I did not desire the typical AV…

>There really is no good solution anymore

Maybe a more secure os? I gather Chromebooks or Linux work quite well

I wonder if anyone's tried making something that looks like regular Windows but it actually Windows running in a VM under Linux. Might be a way to make something hard to hack but usable by people who only know Windows? Maybe it could have something like Git for versioning the Windows images so you could just roll back to when Cryptolocker got installed?

Re: Antivirus software could make your company more vulnerable

#35

Post by Redoubts » Tue, Jan 12, 2016, 1:52 AM UTC

voltagex_ wrote: post #20

rpgmaker wrote: post #16

Earlier quoted context omitted.

Another NoScript user here and the web is better because of this addon. It's amazing the quantity of websites that auto-play their videos, just by blocking those scripts alone NoScript has helped my blood pressure immensely.

I found that NoScript required too much customisation for each site I visited - do you have some kind of default ruleset that makes this easier?

Usually setting the global whitelist to allow *.$currentpage.tld and maybe 10 to 20 others, that become obvious as you go, is more than enough to get 99% of the way there.

Re: Antivirus software could make your company more vulnerable

#36

Post by tim333 » Tue, Jan 12, 2016, 1:54 AM UTC

voltagex_ wrote: post #20

rpgmaker wrote: post #16

Earlier quoted context omitted.

Another NoScript user here and the web is better because of this addon. It's amazing the quantity of websites that auto-play their videos, just by blocking those scripts alone NoScript has helped my blood pressure immensely.

I found that NoScript required too much customisation for each site I visited - do you have some kind of default ruleset that makes this easier?

I use Flashcontrol on Chrome which stops the autoplays but doesn't have much other effect

Re: Antivirus software could make your company more vulnerable

#37

Post by PhasmaFelis » Tue, Jan 12, 2016, 2:08 AM UTC

elorant wrote: post #12

hiram112 wrote: post #4

I avoided AV software for most of my life. Though, when I worked as a student admin, I would always install AV for the majority of my users. Most users (especially older) simply could never learn not to download that cool new 'freeware' app or game or not double click a downloaded exe (the fact that hidden extensions are still the default on Windows OS is absurd). As a more savvy user, I did not desire the typical AV…

>> I believe the future for tech-aware users will be browsers in some sort of container / VM that reset themselves upon each session, with absolutely no control to the file system or data from other sites. Or you could set-up a linux box just for web browsing.

Yeah, having to shuffle files between computers every single time you want to download or upload something sounds like loads of fun.

Re: Antivirus software could make your company more vulnerable

#38

Post by ChuckMcM » Tue, Jan 12, 2016, 2:46 AM UTC

hiram112 wrote: post #4

I avoided AV software for most of my life. Though, when I worked as a student admin, I would always install AV for the majority of my users. Most users (especially older) simply could never learn not to download that cool new 'freeware' app or game or not double click a downloaded exe (the fact that hidden extensions are still the default on Windows OS is absurd). As a more savvy user, I did not desire the typical AV…

At the moment the number of hypervisor escape exploits are fairly limited, so running a browser in a virtual machine where the system image is always destroyed has a certain cachet to it. I know a couple of people who have Chromebooks for browsing (at least one got the CB for free at Google I/O and they felt that was all it was good for :-)

When I get some time I'd like to clean up my air-gap browser, which was a webcam looking at a laptop with a browser open, where mouse and keyboard actions were translated at the Webcam into bluetooth messages which drove the laptop. Not very practical but wonderfully tin-hattish.

Re: Antivirus software could make your company more vulnerable

#39

Post by dakth » Tue, Jan 12, 2016, 4:35 AM UTC

PhasmaFelis wrote: post #37

elorant wrote: post #12

Earlier quoted context omitted.

>> I believe the future for tech-aware users will be browsers in some sort of container / VM that reset themselves upon each session, with absolutely no control to the file system or data from other sites. Or you could set-up a linux box just for web browsing.

Yeah, having to shuffle files between computers every single time you want to download or upload something sounds like loads of fun.

Dropbox?

Re: Antivirus software could make your company more vulnerable

#40

Post by zAy0LfpBZLC8mAC » Tue, Jan 12, 2016, 4:43 AM UTC

AnimalMuppet wrote: post #21

tptacek wrote: post #9

Not "could". Does.

Do you think that AV, on net, makes you less secure? If so, can you provide any data?

Yes, unless you are clueless and execute any executable that manages to hop onto your machine.

AV is complex code that handles huge amounts of untrusted data, so it's a major increase in attack surface. Also, it cannot work, as it's an instance of blacklist security, which never works. So, no upside, huge potential downside.