Hence why I don't install rubbish virus checkers. It also gets
confused on those 4k demos (due to the packers they use probably)
Symantec throws up hurdles to independent software developers
21–30 of 45 posts
Re: Symantec throws up hurdles to independent software developers
#22Suppose Symantec started a program where companies were allowed to pay for their apps to be white listed would and precluded from this check. Could this be considered a protection racket under anti-trust rules?
No. There's nothing remotely resembling a monopoly here, just a garbage product.
Then prosecute them under Rico act. It has real teeth too.
Re: Symantec throws up hurdles to independent software developers
#23I worked at Symantec on the reputation team, tools I worked on directly generated the reputation behind the WS.Reputation.1 message. First: file a false positive report at https://submit.symantec.com/false_positive/ . (Options: "When downloading a file", "Norton Internet Security 2012 or Norton AntiVirus 2012", "Download Insight") This goes directly to the team and they should have your programs whitelisted within a…
Is it actually possible for everyone to sign their executables? Last time I did it, I had to fork over something like $250/yr for a signing key along with providing copies of various documents. This seems a little high for someone who just, say, wants to make free utilities available to the world. In the case of Firefox, one would think it would be possible for you guys to do something about it on your end, because y…
It's "easy" to build a program with the same length and md5 code than another program. The md5 hash is useful as a protection against accidental collision, but it is not secure enough as a protection against an attack.
http://en.wikipedia.org/wiki/MD5#Collision_vulnerabilities
Re: Symantec throws up hurdles to independent software developers
#24Earlier quoted context omitted.
Is it actually possible for everyone to sign their executables? Last time I did it, I had to fork over something like $250/yr for a signing key along with providing copies of various documents. This seems a little high for someone who just, say, wants to make free utilities available to the world. In the case of Firefox, one would think it would be possible for you guys to do something about it on your end, because y…
It's "easy" to build a program with the same length and md5 code than another program. The md5 hash is useful as a protection against accidental collision, but it is not secure enough as a protection against an attack. http://en.wikipedia.org/wiki/MD5#Collision_vulnerabilities
The fact, that MD5 is broken has nothing to do with building database of known-good binaries, because anyone would just use some other hash.
And also, current practical attacks on MD5 (and also on MD4) can be used to find two different strings with same digest (which is not so useful in this case), not string with same digest as some other predetermined string. For this to be exploitable, same organization would have to create two binaries, one trustworthy and one not. There is no reason to do that, as such code is mostly deemed trustworthy on the basis of who published it, not what it does.
Re: Symantec throws up hurdles to independent software developers
#25I worked at Symantec on the reputation team, tools I worked on directly generated the reputation behind the WS.Reputation.1 message. First: file a false positive report at https://submit.symantec.com/false_positive/ . (Options: "When downloading a file", "Norton Internet Security 2012 or Norton AntiVirus 2012", "Download Insight") This goes directly to the team and they should have your programs whitelisted within a…
Your steps sound nice but in reality it doesn't work out this way (speaking from multiple experiences with your reputation system).
First of all, EVERY piece of desktop software my company delivers to users is signed via a known and trusted authority. We knew that would be important and took steps before ever releasing our first piece of desktop software.
Secondly, the error message that users are presented with SCARES THEM. It's not clear why the software is being blocked, and in most cases the user just abandons the software instead of calling us to let us know there was an issue.
When we finally did discover the issue, it wasn't clear what to do. It took us quite a while to figure out where that "false positive" link was, and we weren't even sure that it was the right place to send it to. Even worse, you claim that they "should" have the programs whitelisted within a few business days. This is patently false and never happens that quickly. It took a month before the executable we submitted was whitelisted and you know what? It didn't help one bit.
Symantec seems to not take into account the fact that the executable will be updated, so by the time our first submission was whitelisted we had published 2 updates adding features and fixing bugs. Those updates were blocked even after the initial executable was whitelisted.
You may not be "out to squish the little guy" but honestly that doesn't mean you haven't done quite a bit of damage with your lack of clear messages to your users about why a piece of software is being blocked, and not allowing someone to easily choose to ignore your suggestion that something might not be safe just because symantec hasn't seen it before. (By the time our first symantec using user installed our software we had an installed base of over one hundred users)
Re: Symantec throws up hurdles to independent software developers
#26Suppose Symantec started a program where companies were allowed to pay for their apps to be white listed would and precluded from this check. Could this be considered a protection racket under anti-trust rules?
No. There's nothing remotely resembling a monopoly here, just a garbage product.
You don't need to be a monopoly to be a racketeer. They're completely different.
Re: Symantec throws up hurdles to independent software developers
#27Is there even much point in using AV software?
I ask this because I have never installed any on my computer (including on Windows) and I have only ever knowingly been infected once in the last 10 years (I think this happened because I didn't update Windows Media Player and it was still associated with a file type and somehow a rogue media file streamed from a website attacked it).
On the other hand people I know who have things like Norton etc installed seem to have way more problems with their computers than me (including fairly tech savvy people). For example programs randomly breaking, tracking cookies being flagged as "malware" , general slowness of the system , nonsensical warning messages etc. Besides that they still seem to end up infected with malware more often than me and usually re-format their systems once every few months.
On that one occasion that I did end up infected , I had to install 3 different AV programs and do full scans before it was even detected.
Mac and Linux users never bother having AV installed and as far as I am aware there is nothing inherently more secure about either of these systems than there is Windows 7.
If you are running a network , surely it would be simpler just to disallow any executable files apart from those explicitly whitelisted and to make sure security patches are installed?
Re: Symantec throws up hurdles to independent software developers
#28I once worked for a company that ran into this same problem, hence, I have a whole lot of sympathy. However, I also sympathize with Symantec.
The biggest problem with the AV world is that it tends to be reactive. A criminal releases a piece of malware, it infects computers and then there is a fix released. The problem is that there is a gap between release and fix and criminals exploit this gap to steal information.
Reputation analysis is one possible solution. Alas, when it fails, it fails big (and hurts primarily independent developers).
Re: Symantec throws up hurdles to independent software developers
#29Is there even much point in using AV software? I ask this because I have never installed any on my computer (including on Windows) and I have only ever knowingly been infected once in the last 10 years (I think this happened because I didn't update Windows Media Player and it was still associated with a file type and somehow a rogue media file streamed from a website attacked it). On the other hand people I know who…
In the past, on Windows and Macs (pre-OSX), it was pretty much a requirement unless your machine was really stand-alone and you never dealt with files from any untrusted sources.
These days, if you keep your system patched, use an unprivileged account for your normal activity, use a local firewall and/or NAT, and stay away from shady websites you are probably pretty safe.
I have similar experiences with a friend who's constantly getting malware even though he's running Windows 7 and Microsoft Security Essentials. The main vector seems to be PDF files; he deals with a lot of them via email as part of his job, and he's very much in the habit of just opening PDFs in email before he even really looks at who the sender is.
I agree that many AV programs slow the sytem way down, and in general cause problems, and don't seem to really guarantee that you won't get infected. And FUD is a huge part of how it's marketed. Even Windows itself will nag you with ominous warnings if you don't have any AV software installed.
Re: Symantec throws up hurdles to independent software developers
#30Norton has caused a large amount of frustration for our GitHub for Windows users - Symantec will basically block any EXE using MSys, because of its use of the CreateRemoteThread API. There is no way I am going to submit all of the 200+ EXEs that comprise MSysGit to that web form, though we will try signing all of the EXEs.