Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Antivirus Makers Struggle to Adapt

nytimes.com

Post reply on HN
Print view View original

11–20 of 58 posts

Re: Antivirus Makers Struggle to Adapt

#11

Post by pixl97 »

If I had to think of anti-virus I would trust the most it would be this.

The computer would reboot in to a maintenance mode where it would boot in to a check mode. Hopefully off the network or some other source that couldn't be altered by a virus/malware.

The check mode would checksum all executable content and update its database, reporting all changed and added files. It could also check for known out of date executable files. All files would be checked against a A/V database too. If nothing fails the computer reboots back to the OS, else it is halted until repaired.

This still has two risks I can see, one is the BIOS is altered and subverted there. The other is non-executable content runs transient programs that do not survive reboot.

Re: Antivirus Makers Struggle to Adapt

#13

Post by jdangu »

Traditional A/V are broken for the web.

With dynamic languages like JS and ActionScript, their approach is to fingerprint 10 different strains of the same threat. Then the 11th strain can be generated in a few seconds with new obfuscation.

So the A/V only starts working if/when eventually a native code payload reaches the target.

Re: Antivirus Makers Struggle to Adapt

#15

Post by zanny »

enraged_camel wrote: post #8
macspoofing wrote: post #5

Earlier quoted context omitted.

You're being facetious, correct?

On the one hand, he must be facetious. Viruses existed long before Windows as an operating system was even conceptualized. Therefore it is ridiculous to claim that anti-virus software exists because of Windows alone. On the other hand, it is true that anti-virus software became a lot more popular as Windows gained market-share. The reason is simple: as we all know, for a long time Microsoft did not take security very…

I wouldn't call if facetious because today, the only reason any AV exists is because other software failed to sanitize itself against rogue agents. Viruses aren't some mystery or magic, you have to actively engage with a server that sends one to you (be it by actively engaging with the server, or having a vulnerable point of entry and a bad firewall), and either through vulnerabilities in the applications interacting over IP stacks, or through user ignorance in explicitly running a virus manually (and with enough escalated system privilege to do damage).

It is easier to whitelist than blacklist. It is stupidly easy to embed a cipher in a binary, encrypt the actual payload, and have the execution context decode it back into its viral form. If you do that, you can tweak a knob, get an entirely different looking binary, and keep shipping out the same virus over and over.

Re: Antivirus Makers Struggle to Adapt

#16

Post by josephagoss »

On windows I have been recommending people to use Microsoft Security Essentials, which is free. I understand Microsoft cannot bundle MSE because of that being a monopoly but I really wish they could, With MSE being pre-installed as opposed to Norton and McAfee trials being pre-installed and asking for money after 3 months.

Re: Antivirus Makers Struggle to Adapt

#17

Post by zanny »

lucian303 wrote: post #7
enraged_camel wrote: post #6

Earlier quoted context omitted.

Not sure why you are being downvoted, as anyone who deals with computers will be well aware that anti-virus software exists mostly as security theater. It can be useful against certain types of viruses, especially those who are widespread, but it is a very dangerous thing in and of itself because it states that the user's system is "protected," causing most people to gain a false sense of security and drop their guar…

People don't like to face the truth. No worries, downvoting, upvoting, I couldn't give a shit one way or the other. It's just a silly number.

But I thought my self worth was measured in internet points. Did Reddit lie to me? 😰

Re: Antivirus Makers Struggle to Adapt

#18

Post by alok-g »

Newbie questions (I have searched the Internet a bit, did not find information to answer these):

I understand that anti-viruses (AVs) maintain signatures of viruses (which as I understand are byte patterns present in that virus not present in non-infected software code). They also look for executables modifying others.

Questions:

1. If AVs have to match byte patterns for a very large number of known viruses (millions??), would this not make scanning each executable very slow? This seems to be O[e*v] operation where e is the number of executables and v is the number of viruses. Since it does not seen as slow intuitively, what is going on?

2. I presume AVs would also track check-sums of known executables so that these can be safe guarded against new viruses for which signatures are not yet available. Is this right?

Re: Antivirus Makers Struggle to Adapt

#19

Post by mattquiros »

nodesocket wrote: post #12

I am not trying to be an Apple fan-boy, but does anybody run anti-virus on their Mac's? AntiVirus these days seems like snake oil.

I actually have the same question. I just switched to a MacBook a few months ago and never felt the need to install an antivirus (I've always had Avira on my old Windows 7 PC, but primarily for scanning flash drives). But actually, even in my old PC, I never really had major problems with viruses. I've always thought you can only get them by irresponsibly downloading and installing untrusted software, and websites.

Re: Antivirus Makers Struggle to Adapt

#20

Post by miles »

josephagoss wrote: post #16

On windows I have been recommending people to use Microsoft Security Essentials, which is free. I understand Microsoft cannot bundle MSE because of that being a monopoly but I really wish they could, With MSE being pre-installed as opposed to Norton and McAfee trials being pre-installed and asking for money after 3 months.

I understand Microsoft cannot bundle MSE because of that being a monopoly but I really wish they could

They can and they have in Windows 8: http://www.lifehacker.com.au/2012/11/ask-lh-does-microsoft-s...

They've renamed it to Windows Defender (confusing, since this was a different product in earlier versions) but the interface is virtually identical to Security Essentials.

Post reply on HN