what about NCC Group?
Symantec CEO says source code reviews by foreign states pose unacceptable risk
81–90 of 124 posts
Re: Symantec CEO says source code reviews by foreign states pose unacceptable risk
#82> “As a vendor here in the United States,” Clark said, “we are headquartered in a country where it is OK to say no.” Until the government comes knocking and can demand pretty much everything with your only option being a secret court that always sides with the government anyway. Is it too much tinfoil to think that this isn't so much about "putting security over sales" than it is about "making sure that NSA backdoor…
Just ask the former Qwest CEO about saying “no”.
what about Dreamhost (see yesterday's story)? Or about countless cases that end up with the government not getting what they want?
There are courts, and rules, and sometimes rules mean you hand things over, but sometimes they mean you can say no.
Re: Symantec CEO says source code reviews by foreign states pose unacceptable risk
#83Yeah, sure. Thats the company which according to Google (March) has a huge mess in own nest of Certification Authority resulting in google chrome removing their certs: https://arstechnica.com/information-technology/2017/03/googl...
Yup. The tire fire of the security industry is saying that letting other people look at the code is a security risk.
Personally, I think maybe they got scared that someone might figure out that their code is worse than everything else on the planet, and so they want to try to put the clothes back onto the Emperor.
Re: Symantec CEO says source code reviews by foreign states pose unacceptable risk
#84Anti-virus products are a huge security risk.
I have found it best to treat Anti-virus products like mal-ware themselves. They only get to live inside a VM for the sole purpose of antivirus scanning. This VM has access to several different antivirus products, and I use a battery of them (after updating signatures) to scan any file that I am leery of trusting. I delete the VM afterwards. This is not impractical for my situation, because I do not have a large thro…
There's also VirusTotal.
Re: Symantec CEO says source code reviews by foreign states pose unacceptable risk
#85Earlier quoted context omitted.
Some might think it is joke, but it is dead serious: https://googleprojectzero.blogspot.com/2016/06/how-to-compro... Unfortunately running an anti-virus is an overly broad requirement in some industries to pass certifications and audits. It's one of the cases where "security" mandates and requirements leads to insecurity.
Insurance company made us all install anti virus software
They didn't make you do anything. They either refused to insure you or would raise your rate if you didn't.
Re: Symantec CEO says source code reviews by foreign states pose unacceptable risk
#86Earlier quoted context omitted.
The Symantec CEO has been in that position only since Symantec acquired Blue Coat last year, where they were CEO previously. The Symantec CA happened well before their current term.
Blue Coat. Has problems with foreign governments being unfriendly? I guess what goes around comes around: http://surveillance.rsf.org/en/blue-coat-2/
What a fantastic website is that! To add to your point: Amazing how skewed ones morals can be if they believe they're doing the right thing by providing those countries these kinds of tools.
Re: Symantec CEO says source code reviews by foreign states pose unacceptable risk
#87Do you need to access source code in order to analyze software for backdoors? Shouldn't you be looking directly at the compiled machine code? There's no guarantee that the source code you are looking at matches the binaries that are being distributed isn't it?
> There's no guarantee that the source code you are looking at matches the binaries that are being distributed isn't it?
Couldn't one compile from source and then compare blobs?
Re: Symantec CEO says source code reviews by foreign states pose unacceptable risk
#88Earlier quoted context omitted.
What's the difference between vulnerabilities in code and vulnerabilities in virus detection? Isn't the virus detection done in code? Is security through obscurity valid for virus detection but not code?
I don't think the parent is talking about vulnerabilities, but the fact that if you know how the antivirus engine works it may be easier to write a virus able to avoid detection.
Sounds like a vulnerability. Isn't that how the argument went about source code? "If you know how the program works it may be easier to write an exploit." But then experience taught people that exposing source code to the bright sunlight by opening its source could actually make software more secure through many eyes finding holes. Why is this not applicable to virus detection algorithms?
Re: Symantec CEO says source code reviews by foreign states pose unacceptable risk
#89Do you need to access source code in order to analyze software for backdoors? Shouldn't you be looking directly at the compiled machine code? There's no guarantee that the source code you are looking at matches the binaries that are being distributed isn't it?
> There's no guarantee that the source code you are looking at matches the binaries that are being distributed isn't it? Couldn't one compile from source and then compare blobs?
I wonder how many commercial code bases/products can do that. Certainly an interesting proposal for verification purposes like this, but e.g. the recent Debian efforts show that it is not trivial.
Re: Symantec CEO says source code reviews by foreign states pose unacceptable risk
#90Earlier quoted context omitted.
What's the difference between vulnerabilities in code and vulnerabilities in virus detection? Isn't the virus detection done in code? Is security through obscurity valid for virus detection but not code?
I don't think the parent is talking about vulnerabilities, but the fact that if you know how the antivirus engine works it may be easier to write a virus able to avoid detection.
That makes sense, though I think there's still a large difference between the virus detection and ranking algorithm comparison. The entirety of the virus detection code is running on the client's PC; surely it can be reverse engineered and understood fairly successfully?
The same can't really be said of Google's algorithm, as it's essentially a hugely complex black box, and you can barely interact with it. That's kind of like reverse engineering a chip purely using its inputs / outputs.