Live data from Hacker News

Antivirus Makers Struggle to Adapt

nytimes.com

21–30 of 58 posts

Re: Antivirus Makers Struggle to Adapt

#21

On windows I have been recommending people to use Microsoft Security Essentials, which is free. I understand Microsoft cannot bundle MSE because of that being a monopoly but I really wish they could, With MSE being pre-installed as opposed to Norton and McAfee trials being pre-installed and asking for money after 3 months.

MSE is effectively bundled with Windows 8 as Windows Defender.

Re: Antivirus Makers Struggle to Adapt

#22
post #18

Newbie questions (I have searched the Internet a bit, did not find information to answer these): I understand that anti-viruses (AVs) maintain signatures of viruses (which as I understand are byte patterns present in that virus not present in non-infected software code). They also look for executables modifying others. Questions: 1. If AVs have to match byte patterns for a very large number of known viruses (millions…

First I don't really have an idea about security software. But to your first question:

The algorithm that is used is probably a variation of the Aho-Corasick algorithm. This is a string matching algorithm that can match k patterns in O(kn+m).

This is basically linear and doable.

Two your second question I can only point to a flaw in some virus scanner a couple years ago where it detected a false positive in an essential Windows file, removed the file and left Windows in an unbootable state. I do hope that there was some learned lesson.

Re: Antivirus Makers Struggle to Adapt

#23

I am not trying to be an Apple fan-boy, but does anybody run anti-virus on their Mac's? AntiVirus these days seems like snake oil.

I actually have the same question. I just switched to a MacBook a few months ago and never felt the need to install an antivirus (I've always had Avira on my old Windows 7 PC, but primarily for scanning flash drives). But actually, even in my old PC, I never really had major problems with viruses. I've always thought you can only get them by irresponsibly downloading and installing untrusted software, and websites.

Generally, my only real reason for running an anti-virus on the mac has been to check e-mail attachments so I don't spread something.

Re: Antivirus Makers Struggle to Adapt

#24
post #17

Earlier quoted context omitted.

People don't like to face the truth. No worries, downvoting, upvoting, I couldn't give a shit one way or the other. It's just a silly number.

But I thought my self worth was measured in internet points. Did Reddit lie to me? 😰

Reddit? Why Reddit never lies! ;-)

Re: Antivirus Makers Struggle to Adapt

#26

I am not trying to be an Apple fan-boy, but does anybody run anti-virus on their Mac's? AntiVirus these days seems like snake oil.

It's an unfortunate reality that the more people that ask this question, the more likely it is that we will need some form of defense.

Go back to Windows, I say!

Re: Antivirus Makers Struggle to Adapt

#27

I am not trying to be an Apple fan-boy, but does anybody run anti-virus on their Mac's? AntiVirus these days seems like snake oil.

This isn't because OSX is inherently more secure but because of the fact that virus/malware makers target Windows more than any other OS because it's the most widely deployed desktop OS. And yes, occasionally having AV software on a Mac will help a lot. But it's usually some fucked up program installing some stupid kext or similar non-kext kext that fucks up your OSX system.

Re: Antivirus Makers Struggle to Adapt

#28
post #13

Traditional A/V are broken for the web. With dynamic languages like JS and ActionScript, their approach is to fingerprint 10 different strains of the same threat. Then the 11th strain can be generated in a few seconds with new obfuscation. So the A/V only starts working if/when eventually a native code payload reaches the target.

no, it really dosent. native code can do the exact same sort of tricks.

a pretty standard tool in detection evasions bag of tricks is to write a custom virtual machine that generates code on the fly, which makes static, signature based analysis of payloads totally useless.

Re: Antivirus Makers Struggle to Adapt

#29
post #13

Traditional A/V are broken for the web. With dynamic languages like JS and ActionScript, their approach is to fingerprint 10 different strains of the same threat. Then the 11th strain can be generated in a few seconds with new obfuscation. So the A/V only starts working if/when eventually a native code payload reaches the target.

no, it really dosent. native code can do the exact same sort of tricks. a pretty standard tool in detection evasions bag of tricks is to write a custom virtual machine that generates code on the fly, which makes static, signature based analysis of payloads totally useless.

What keeps you from finger printing the VM just as easily?

Re: Antivirus Makers Struggle to Adapt

#30

No shit. This isn't news, it's a well known fact.

Not sure why you are being downvoted, as anyone who deals with computers will be well aware that anti-virus software exists mostly as security theater. It can be useful against certain types of viruses, especially those who are widespread, but it is a very dangerous thing in and of itself because it states that the user's system is "protected," causing most people to gain a false sense of security and drop their guar…

I do not think anti-viruses are pure security theater. They will not protect against zero day attacks, however, once a specific virus hits enough people, anti-viruses will be updated, preventing large scale infection. In order to avoid this, attackers need an attack vector that would allow them to change the virus binary at will. These definitely exist, but A/V does stop a non trivial amount of infections.
Post reply on HN