Good for Symantec as they do not depend upon Google for data and have their own extensive collection of data
Software security suffers as startups lose access to Google’s virus data
11–20 of 27 posts
Re: Software security suffers as startups lose access to Google’s virus data
#12Why are they not contributing back? I fail to see any real competitive advantage to gain. Even if you happen to protect against a threat that is not publicly known, you can't really advertise that without a) making it publicly known b) making yourself sound like a jerk.
Because they have nothing to contribute. Snake oil. You can't share with VirusTotal the data you stole from them, which probably is the only one they have.
Re: Software security suffers as startups lose access to Google’s virus data
#13Key quote: "Marx of AV-TEST said that some newer companies secretly relied on data supplied by older companies while marketing themselves as a cut above the older technology. "They are using traditional methods, too," he said. Some of the newer companies said they do not share their evaluations for competitive reasons." The above sentiment may ring a bell for those of you who follow the news. It's the exact same beha…
secrety is the main smoking gun of bad behaviour.
Re: Software security suffers as startups lose access to Google’s virus data
#14I am a little confused. VirusTotal has public and private APIs. Are these companies losing access to those APIs? If so, what if you aren't a security company but want to use it for virus detection of uploaded files?
Re: Software security suffers as startups lose access to Google’s virus data
#15This only affects organisations that don't contribute back into the community - leechers in otherwords. Virustotal has always been a platform whose data is enriched by the community for the benefit of all and so Cylance, Crowdstrike, etc can frankly go suck balls if they don't want to contribute.
Sentinel One's position didn't make sense to me. > “We were more than willing to work with them, but they didn’t have a way for us,” said Tomer Weingarten, chief executive of SentinelOne, a firm that acknowledges it was cut off from the feed against its will. “This is a step back.” > Weingarten said SentinelOne had added a new data feed to replace VirusTotal and predicted that VirusTotal will become less relevant as…
SentinalOne probably approached VirusTotal with specific requirements about how they wanted to contribute back, and VirusTotal said 'you can contribute the same way everyone else does.' The rest is marketing BS.
Re: Software security suffers as startups lose access to Google’s virus data
#16I am a little confused. VirusTotal has public and private APIs. Are these companies losing access to those APIs? If so, what if you aren't a security company but want to use it for virus detection of uploaded files?
They are specifically targeting companies who follow VirusTotal's distribution feed, from what I can tell. This gives them all files submitted to VT and their corresponding reports, but they're not sharing their analysis of these files.
If you're not an AV and you just rely on VT reports, this shouldn't affect you.
Re: Software security suffers as startups lose access to Google’s virus data
#17This only affects organisations that don't contribute back into the community - leechers in otherwords. Virustotal has always been a platform whose data is enriched by the community for the benefit of all and so Cylance, Crowdstrike, etc can frankly go suck balls if they don't want to contribute.
Sentinel One's position didn't make sense to me. > “We were more than willing to work with them, but they didn’t have a way for us,” said Tomer Weingarten, chief executive of SentinelOne, a firm that acknowledges it was cut off from the feed against its will. “This is a step back.” > Weingarten said SentinelOne had added a new data feed to replace VirusTotal and predicted that VirusTotal will become less relevant as…
It's likely they are using an engine based almost entirely on run-time heuristics - that is, stopping malware when it behaves suspiciously. VirusTotal does "scan-time" analysis of files where the file is never run, only checked against AVs. If they have no "traditional" signatures, they wouldn't be compatible with this method.
Re: Software security suffers as startups lose access to Google’s virus data
#18Let me see if I can try to simplify the underlying problem here (I dabble in this space):
Little bit os background: writing pattern matching signatures is hard, adding a bunch of "known malicious" hashes to your malware database is easy.
So, company A with a staff of folks writing pattern matching signatures has its engine added to VirusTotal and virus total shares/sell hashes found by that engine to folks that pay for its API. Company B, without a staff of engineers writing pattern matching signatures, signs up for VirtualTotal API and creates its malware database based purely on the hashes other actual engines create.
Two important things to keep in mind, when this happens at the scale of VirusTotal (basically all real engines are participating) the end result "hash database" is, essentially, bullet proof since it's likely that any sample used to test its effectiveness will be run by VirusTotal first.
We (I run scanii.com a malware/content detection API service) run into this all the time with folks either abusing or just not understanding the reason VT exists.
Re: Software security suffers as startups lose access to Google’s virus data
#19How is an article that is clearly incredibly biased on top of the front page?
Leechers who don't contribute got cut off - that sounds incredibly fair... yet the article spins it to sound like it was malicious.
I guess the entitlement complex rolls all the way up to businesses, too...
Re: Software security suffers as startups lose access to Google’s virus data
#20How is an article that is clearly incredibly biased on top of the front page? Leechers who don't contribute got cut off - that sounds incredibly fair... yet the article spins it to sound like it was malicious. I guess the entitlement complex rolls all the way up to businesses, too...
The article may be biased (I'm in agreement, spin zone) but the policy change on Virus Total's part is real news. With all the security people around HN I'm not surprised to see that people want to discuss it.