Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Avoid Non-Microsoft Antivirus Software

robert.ocallahan.org

Post reply on HN
Print view View original

91–100 of 388 posts

Re: Avoid Non-Microsoft Antivirus Software

#91

Post by ComodoHacker »

bad_user wrote: post #71
disiplus wrote: post #58

Earlier quoted context omitted.

i dont think you understand how this works. they install a root certicicate on your machine and do mitm "attack" so they can scan the urls, and block some attacks (i remember when some forum had embeded a pdf, that had some attack and antivirus blocked it ) also you have installed an application that has a root acces to the pc, if it was mallicius it could do allot more damage. it is ultimately a question of trust. i…

I don't think you understand how HTTPS works. > so they can scan the urls, and block some attacks The purpose of HTTPS is to provide a guarantee that your connection to Google is direct, with no intermediaries, such that (1) only Google knows your search query and (2) you get a guarantee that the received content is from Google. And you get this guarantee from certificate authorities that have a good reputation and t…

>The blocking of attacks reasoning is kind of bullshit

>I have yet to see evidence that AV software is doing a better job of catching those

I wouldn't be so one-sided. Imagine a fresh new variety of ransomware starts spreading. No one can catch it at 0-day, but good AV can catch it at 1-st day (OK, 1-st week) and neither Google nor uBlock or the likes can't.

Re: Avoid Non-Microsoft Antivirus Software

#92

Post by bjd2385 »

tomaskafka wrote: post #90
bad_user wrote: post #46

I also want to raise an alarm about a current AV practice, not mentioned in the article: AV products like Bitdefender will MITM your HTTPS connections by installing their own root certificates, by default and without warnings In the name of "security", this undermines the very purpose of what HTTPS is about, knowingly endangering their users. And consider that I, a highly technical and security conscious software dev…

Yes. Also, let's finally start a public discussion about AV companies making money by selling data (they do, either all of them or most). Of course that being able to peek into https traffic gets them more data (specific urls, not just whole sites).

_Everyone_ is collecting our data nowadays. Who's left to sell it to?

Re: Avoid Non-Microsoft Antivirus Software

#93

Post by disiplus »

bad_user wrote: post #71
disiplus wrote: post #58

Earlier quoted context omitted.

i dont think you understand how this works. they install a root certicicate on your machine and do mitm "attack" so they can scan the urls, and block some attacks (i remember when some forum had embeded a pdf, that had some attack and antivirus blocked it ) also you have installed an application that has a root acces to the pc, if it was mallicius it could do allot more damage. it is ultimately a question of trust. i…

I don't think you understand how HTTPS works. > so they can scan the urls, and block some attacks The purpose of HTTPS is to provide a guarantee that your connection to Google is direct, with no intermediaries, such that (1) only Google knows your search query and (2) you get a guarantee that the received content is from Google. And you get this guarantee from certificate authorities that have a good reputation and t…

There are no intermediaries, AV mitm the traffic because otherwise it cannot scan the content, nor the urls, if it was remote on the AV vendor server then i would understand it but its doing it on you local machine, and you can disable it if you dont want it. If i have a antivirus installed on my pc and get infected with one of those fly byes i would be furious because i was thinking that im protected.

I dont know where do you live but there is a TON of different javascript injections in the wild with ad networks that are not caught by browser vendors or are caught to late. Google does not do deep scan of the page or files it just has a blocklist of urls. If i host my code on another url or change a file slightly only AV is good in this situation.

And remember they have to get it right only one time.

Re: Avoid Non-Microsoft Antivirus Software

#94

Post by pjmlp »

antihero wrote: post #73
pjmlp wrote: post #30

Earlier quoted context omitted.

Users are to blame by pirating software. Of course, pirates don't do it for free.

Yes they do, the cracking scene ethos is all about technical one-upmanship and the thrill and glory of beating copy protection. Or at least it used to be. The really smart ones do it for their own enjoyment or ideological reasons.

Not really, back in the MS-DOS, Atari, Amiga, Acorn, Mac OS days you surely need to first scan every single floppy before putting on the computer.

The cracking scene was equally full of virus.

Only in the very early days, during the genesis of the demoscene, it was as you describe.

Re: Avoid Non-Microsoft Antivirus Software

#95

Post by hetfeld »

neko_koneko wrote: post #76

Ok, disclaimer first: I've previously worked at Kaspersky Lab (incident response division). Now, I want to say that many of the incidents that we have investigated, would have been prevented by anti-virus software (in many cases AV software was deliberately disabled by user). And I'm talking about incidents that resulted in million-dollar thefts - not just cases of some user getting cryptolocker on their home compute…

Russian antivirus? For corporation? No, thank you, komrade.

Re: Avoid Non-Microsoft Antivirus Software

#96

Post by pjmlp »

tracker1 wrote: post #62
pjmlp wrote: post #30

Earlier quoted context omitted.

Users are to blame by pirating software. Of course, pirates don't do it for free.

There are lots of attack vectors, not just pirated software, and viable ones depending on desired outcome can range from email, browser, and direct software spread (pirate games). MacOS isn't safe, and neither is Linux though the attack vectors will vary. If all you want is a DDoS, a fake advertising account can often deliver the desired effect without actually infecting anyone. It really depends on what the cost/ben…

Quite true, specially in the days of "curl | sh" fashion.

Re: Avoid Non-Microsoft Antivirus Software

#97

Post by kbart »

yAnonymous wrote: post #78
bad_user wrote: post #46

I also want to raise an alarm about a current AV practice, not mentioned in the article: AV products like Bitdefender will MITM your HTTPS connections by installing their own root certificates, by default and without warnings In the name of "security", this undermines the very purpose of what HTTPS is about, knowingly endangering their users. And consider that I, a highly technical and security conscious software dev…

Microsoft doesn't exactly have a great record with root certificates either. >Emergency Windows update revokes dozens of bogus Google, Yahoo SSL certificates https://arstechnica.com/security/2014/07/emergency-windows-u... They revoked certs like this silently in the past which makes it even worse.

You can manage pre-installed root certificates manually in Windows. As far as I've seen, there was nothing sinister in default Windows root CA list.

Re: Avoid Non-Microsoft Antivirus Software

#98

Post by tokenizerrr »

bad_user wrote: post #77
billpg wrote: post #65

Earlier quoted context omitted.

Don't most browsers have hooks for AV (and other plugins) to get into web traffic without having to mess with TLS?

No, I don't think so and if it does, please tell me which browser does it so I can keep away from it, because that defeats the purpose of TLS. Either way, Bitdefender installs their own root certificate and generates their own for google.com. I've got proof if you want.

Chrome, Firefox. Probably more. https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NS...

Re: Avoid Non-Microsoft Antivirus Software

#99

Post by pjmlp »

knotty66 wrote: post #56
pjmlp wrote: post #30

Earlier quoted context omitted.

Users are to blame by pirating software. Of course, pirates don't do it for free.

Don't they? Pirates have been around since long before viruses really became a problem. What was their motivation then?

Virus were already a problem on MS-DOS, Atari, Amiga, Acorn, Mac OS.

Probably only during the 8 bit computers it wasn't a problem.

Re: Avoid Non-Microsoft Antivirus Software

#100

Post by bad_user »

noemotion wrote: post #88
bad_user wrote: post #46

I also want to raise an alarm about a current AV practice, not mentioned in the article: AV products like Bitdefender will MITM your HTTPS connections by installing their own root certificates, by default and without warnings In the name of "security", this undermines the very purpose of what HTTPS is about, knowingly endangering their users. And consider that I, a highly technical and security conscious software dev…

I am not disagreeing with you, but I want to point out that, usually, the certificate is generated locally during setup and then installed in the trusted certificates store. So no one else should have that certificate. I also assume there is an option somewhere to disable the MITM scanner.

> I also assume there is an option somewhere to disable the MITM scanner.

By default this is ON and users don't have the competence to recognize that this is in fact increasing the surface area for attacks and to disable it. The mere existence of a setting that is ON by default doesn't absolve such AV companies.

But speaking of Bitdefender in particular, I installed it on my wife's computer, disabled that option, confirmed that it survived a restart, then one month later I discovered that it is ON again, probably due to an automatic update. It's also an "admin" setting and my wife's user account does not have admin privileges to turn it on or off.

So even with a setting in place, it's untrustworthy.

Post reply on HN