31–40 of 85 posts
OR they could have just used the string from EICAR test file [1]. Since I don't use bitcoin, let me ask, does everyone have to download the whole blockchain to their computer in order to mine or receive/sent the coins? Wouldn't the blockchain be in XX GB size by now? [1] http://en.wikipedia.org/wiki/EICAR_test_file
Yes, they do. And yes its quite large! Over 10 GB.
MSE was top-notch when it was first released. It aced all the malware detection benchmarks, not to mention it was completely ad-free and extremely lightweight, which was unheard of in the free antivirus market. The high detection rate and low performance impact made lots of Windows users flock to MSE, myself included. Nowadays, MSE is still lightweight, but it sits at the bottom of every malware detection benchmark.…
It's sad. However instead of ditching it entirely I have moved to a combination of MSE for real-time protection and Malwarebytes as backup, which I run every month or so to get anything that might manage to slip through.
Maybe I should get the paid version of Malwarebytes that can also do realtime scans?
The simple solution is to not allow your anti-virus software to scan anything that cannot malware. There are exceptions to the rule of course such as MP3s that had executable code, but why does it need to scan every single file on your system? Full disclosure: I used to work for an AV software company and personally think that AV is a dead technology.
Given your background it's surprising you don't realize how many file formats are Turing-complete and thus capable of mischief.
Here's what typical AV scanners go looking for when running in their "optimal" settings:
http://community.landesk.com/support/docs/DOC-6651/diff?seco...
Not all Turing-complete languages are scanned. For example, CSS3 is Turing-complete but by default it is not looked at by AV scanners.
However, one can do some nasty things using CSS. An example would be when a troll was posted on a site that appeared to show some sort of Linux-based privilege escalation when in fact it had several tags scattered about that would have not shown up in the browser but did so when text was copied.
This sort of thing can however be defeated by just scanning the web content coming through (and most modern AV software has this already), but even then an attack like that isn't simply going to be just picked up so easily.
I am well aware of where files can create havoc Turing-complete or not (such as my MP3 example), but at the very same time you're going to have headaches if you decide to scan every single file.
This again goes back to my whole point of saying that AV is a dead technology because you really shouldn't trust any file but it is not effective to scan everything either.
Earlier quoted context omitted.
There are many articles describing why but really it comes down to this: malware authors can pump out so many copies of their software at once that signature-based detections in which the AV industry relies on are no longer reliable or effective. We're at a point now where what may have worked as a defence against stuff being found on floppy drives just isn't able to scale for today's modern infrastructure. AV is rea…
I'm not sure what should I not forget when I visit a hacked web forum which sends me to an exploit kit, that knows an unpatched, possible zero day, vulnerability from my browser? You're oversimplifying modern AV by acting like it's just a signature based file scanner. That's just a one defence of many in a good AV product.
What the problem described in the story is that files are being picked up by an overzealous AV scanner doing disk-based scanning. It's reading non-executable data as executable and throwing alerts or performing whatever actions are dictated as per policy.
AV is not there to stop zero-day attacks--if it were, I would not be having this conversation today.
What you're describing is web filtering and this can be achieved using methods either internal or external--an external example would be a solution from OpenDNS and an internal can be whatever appliance makes you happy. AV vendors have thrown in web filtering as a part of their suite, but it still relies on your system being up to date and not already infected. An external solution to your endpoint is a far better solution really.
I am not oversimplifying things when I say that AV is ineffective at stopping CryptoLocker because file-based detections are useless when there are thousands of copies of the malware generated every day.
AV is dead because there is not enough manpower and coverage to stop things like CryptoLocker. It is better to spend those resources trying to prevent the spread of malware using other methods.
OR they could have just used the string from EICAR test file [1]. Since I don't use bitcoin, let me ask, does everyone have to download the whole blockchain to their computer in order to mine or receive/sent the coins? Wouldn't the blockchain be in XX GB size by now? [1] http://en.wikipedia.org/wiki/EICAR_test_file
Unfortunately, it appears that AV software completely ignores files larger than 32 MBytes, so it won't notice them in the blockchain— just the chainstate. And so the grand idea of putting the triggers in coinbases didn't work there.
The other fun thing is that the EICAR test trigger is too long to easily stuff in a transaction. Unfortunately there are other "signatures" which are as short as 16 bytes.
So a joker decided to embed some Anti Virus bait in the blockchain, just a few bytes is enough to make the software go nuts deleting a whole lot of files the Bitcoin client needs. The solution the Bitcoin developers suggest is pure old-school malware style, XOR the blocks to hide it from the Anti Virus suites. Classic. https://github.com/bitcoin/bitcoin/issues/4069
Isn't this just an arms race, though? What's to stop people from doing this again?
Earlier quoted context omitted.
From a comment on that issue: >Just for fun, there's about 8000 reachable nodes on the network at the time of writing. Assuming that a large portion of the network is unreachable (NAT, filtering, intermittent, just not listening), it's probably safe to assume there's probably at least 50,000 nodes with the complete blockchain. If we XOR just the chainstate, we cause 50000 * 430 MB of disk writes, 50000 * 430 * 2 MB r…
Just 8000 bitcoin nodes? So much for the People's Distributed Currency.
Earlier quoted context omitted.
No they don't. Mining software that connects to pools is independent of having a blockchain copy. There are also several bitcoin wallet implementations that don't require a full copy of the blockchain.
Strictly speaking, that is hashing software. Mining software is what runs on the pool, and it absolutely must download and verify the blockchain.
Earlier quoted context omitted.
Just 8000 bitcoin nodes? So much for the People's Distributed Currency.
Those are probably 'full nodes' to participate in the network as a miner or casual user you don't need to run a full node.
It's possible I misunderstand, and overestimate the value of full nodes.
MSE was top-notch when it was first released. It aced all the malware detection benchmarks, not to mention it was completely ad-free and extremely lightweight, which was unheard of in the free antivirus market. The high detection rate and low performance impact made lots of Windows users flock to MSE, myself included. Nowadays, MSE is still lightweight, but it sits at the bottom of every malware detection benchmark.…
Running a multi GB backup with Microsoft's robocopy cmd utility crashes the MSE service. That's really annoying.
Given that "Microsoft Forefront" is a rebranded MSE (it can be controlled over the network), I wonder why its real-time scanner can't handle ~100MB/s IO for several hours.