Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Avoid Non-Microsoft Antivirus Software

robert.ocallahan.org

Post reply on HN
Print view View original

321–330 of 388 posts

Re: Avoid Non-Microsoft Antivirus Software

#321

Post by nugget »

freehunter wrote: post #272
arpa wrote: post #248

Earlier quoted context omitted.

Just to play the devils' advocate, I do think that the attitude of "never use AV products" could work in corporate environment, provided the administrators are competent and draconian enough to counter-weight the absolute incompetence of users (because, frankly, the largest attack surface is the incompetence of the user): use security policies of the domain to only allow whitelisted applications to be run; restrict i…

I work as a security consultant for a major tech company and my clients are almost always Fortune 500 (with some Fortune 100 companies, and at least one top-10 company). When they hire us, we get to learn everything about their security infrastructure. The trend is clear: AV is out, Carbon Black (or Crowdstrike, etc) is in. This is especially prominent in the financial industry. My wife works at a tiny local bank and…

Whitelist-only works until it doesn't. All an attacker has to do is compromise one of the whitelisted apps (e.g. a web browser) and they will have infiltrated the device and perhaps the network. Certain institutions can tolerate operating as a digital supermax prison (law firms, banks, Government). Most can't. The future is likely some mix of network defense, whitelist/blacklist management, traditional AV for each device, VMs (less effective with migration of apps to cloud), and lots of user education.

Re: Avoid Non-Microsoft Antivirus Software

#322

Post by WorldMaker »

tyingq wrote: post #318
WorldMaker wrote: post #304

Earlier quoted context omitted.

I still wish most companies knew/had a better "best practice" than just MITM interception certificates, because that is potentially brittle and is an threat to corporate security. If you already have all of your machines MITMed, then an attacker could gain access to the existing MITM certificate and who would ever know. I know I'm a relative minority in the corporate IT world, but as a software developer downloading/…

>because that is potentially brittle It is. I do work in a Fortune 500 occasionally, and have to use their MITM gateway (websense SSL intercept). They haven't yet fixed the internal cert to not use SHA-1. If you're using something other than a corporate windows desktop + browser, you have to install the root certificates manually. They have to make manual exceptions for sites that do certificate pinning. When they mi…

Similar anecdote: an internal intercept certificate that Firefox outright refused to install to a trusted store because the cert seemed suspicious/insecure. (Not caught by corporate IT because of a Chrome monoculture, which is a different problem.)

Re: Avoid Non-Microsoft Antivirus Software

#323

Post by taneq »

edejong wrote: post #250
slgeorge wrote: post #240

Earlier quoted context omitted.

No Ubuntu doesn't , and nor has it every done. It connects on-line and off-line searches, so it shows you the result in on-line locations. The underlying assumption was that users increasingly see on-line and off-line content as all part of the same world ("their content"). The commercial aspect was that it connected to places like Amazon. It made money for Canonical by using affiliate links if the user chose to make…

I'm sorry, but I think I trust Canonicals' privacy policy as a source more than you: "Unless you have opted out, we will also send your keystrokes as a search term to productsearch.ubuntu.com and selected third parties so that we may complement your search results with online search results from such third parties including: Facebook, Twitter, BBC and Amazon. Canonical and these selected third parties will collect yo…

Wow, that's yuck. Thanks for the heads up. :(

Re: Avoid Non-Microsoft Antivirus Software

#324

Post by nugget »

floatboth wrote: post #220
NameNickHN wrote: post #112

Earlier quoted context omitted.

Any AV software is better than having none but that's not the point of the article. It specifically recommends Microsoft's AV and to stay clear of all the others. I'm sure it's hard on all the AV vendors out there but with Microsoft Essentials and Windows Defender I don't see the need for a third party AV.

Forget even Windows Defender. The one and only "AV" a normal user will ever need is… Google Safe Browsing. Seriously. Anything you download is already checked with Google, why waste CPU cycles on checking it again locally?

Google runs the largest advertising network in the world. Plenty of malware slips through the cracks every day, both downloadable apps/software/extensions as well as ads that lead to obvious scams. Facebook, Microsoft, Yahoo etc all suffer the same problems. I think these problems are likely unavoidable at that kind of scale. But I would never rely on these companies as the only (or even primary) line of defense.

Re: Avoid Non-Microsoft Antivirus Software

#325

Post by lmm »

ivan_gammel wrote: post #306
lmm wrote: post #284

Earlier quoted context omitted.

> in many cases AV software was deliberately disabled by user Right, because the only way AV software can ever be effective is if it blocks things that legitimate programs also do (if a given piece of functionality has no legitimate uses it wouldn't be in the OS in the first place) - so users get in the habit of disabling it. Installing a piece of software that e.g. stops you running any downloaded .exe files is usel…

Example with .exe files isn't good one. Modern AVs may do better job than just blocking them. I use Norton AV, which shows a report summary on new downloaded files, based on which I can make informed decision on whether to launch it or not (I personally launch immediately only trusted executables and google for any issues of the rest). The same can be done with all threats: AVs warn, provide some details and let user…

> I use Norton AV, which shows a report summary on new downloaded files, based on which I can make informed decision on whether to launch it or not (I personally launch immediately only trusted executables and google for any issues of the rest).

Trusted in what sense? Does Norton maintain their own whitelist? Is there any reason to believe that whitelist would be any better than the digital signature check that's built into windows?

> based on which I can make informed decision on whether to launch it or not (I personally launch immediately only trusted executables and google for any issues of the rest). The same can be done with all threats: AVs warn, provide some details and let users decide what to do.

But what information can the AV offer that actually helps the user makes a better decision than they would have otherwise?

Re: Avoid Non-Microsoft Antivirus Software

#326

Post by lmm »

zamalek wrote: post #308
lmm wrote: post #286

Earlier quoted context omitted.

Is there any way to turn off Windows Defender without installing anything else?

Yeah, through the new Windows control panel ("Settings" -> "Update & Security" -> "Windows Defender"). Windows will hound you about that (and there is no way I know to turn off the nag).

I thought it didn't just nag but turned itself back on after a while?

Re: Avoid Non-Microsoft Antivirus Software

#327

Post by stephengillie »

bjd2385 wrote: post #92
tomaskafka wrote: post #90

Earlier quoted context omitted.

Yes. Also, let's finally start a public discussion about AV companies making money by selling data (they do, either all of them or most). Of course that being able to peek into https traffic gets them more data (specific urls, not just whole sites).

_Everyone_ is collecting our data nowadays. Who's left to sell it to?

_Everyone_ may be collecting data (I'm collecting steam player data, project pieces in alpha and beta stages), but not everyone has access to a lot of your data. I might be able to tie your player name to your identity, and know your work and sleep schedule, but this brings me no closer to your browser history.

Re: Avoid Non-Microsoft Antivirus Software

#328

Post by pjmlp »

emodendroket wrote: post #269
pjmlp wrote: post #94

Earlier quoted context omitted.

Not really, back in the MS-DOS, Atari, Amiga, Acorn, Mac OS days you surely need to first scan every single floppy before putting on the computer. The cracking scene was equally full of virus. Only in the very early days, during the genesis of the demoscene, it was as you describe.

As I recall the early virus guys were more like vandals who wanted to cause problems for the thrill of it than guys operating international rackets like they are now. When was the last time you heard of a virus that just formatted your hard drive or whatever?

Nowadays they encrypt it instead.

Re: Avoid Non-Microsoft Antivirus Software

#330

Post by ltowel »

ComodoHacker wrote: post #278
majewsky wrote: post #209

Earlier quoted context omitted.

Do you have any evidence for these claims? What's the concrete mechanism that allows AVs to observe and react to threats earlier than Google? (Since you allow up to 1 week of reaction time, I'll assume that you're not referring to heuristic detection methods.)

With cloud reputation service all AV user base (provided sufficiently large) turn into global sensor network, along with honeypots vendors maintain separately. This allows (at the cost of users' privacy) to detect new emerging threats within hours, then acquire samples, analyze them and deploy new signatures within days. Google can of course react equally fast. But "signal delay" may be much higher, as users report o…

Google owns VirusTotal, so they either alternatively have a strong set of tagged samples to work with, or an incentive to not disrupt their partnerships with exiting vendors.
Post reply on HN