The sorry state of Avira anti-virus heuristics
1–10 of 17 posts
Re: The sorry state of Avira anti-virus heuristics
#2Great example of why signature based detection for anti-virus is just a stopgap measure. You can be sure the anti-virus of the future (if there is one) will make limited to no use of malware signatures. I suppose it probably feels weird to most people to find out the AV product they pay a lot of money for is just a sophisticated version of grep.
Re: The sorry state of Avira anti-virus heuristics
#3I once had a totally benign website that triggered an anti-virus alert in Clam AV. There was an specific sequence of characters in the HTML that caused it.
One of the weirder bugs I've encountered.
Re: The sorry state of Avira anti-virus heuristics
#4Re: The sorry state of Avira anti-virus heuristics
#5Great example of why signature based detection for anti-virus is just a stopgap measure. You can be sure the anti-virus of the future (if there is one) will make limited to no use of malware signatures. I suppose it probably feels weird to most people to find out the AV product they pay a lot of money for is just a sophisticated version of grep.
I'm pretty sure the future of anti-viruses will involve signature matching one way or another, because there's no way around that.
Viruses are pretty similar to their biological counterparts ... they are pretty useless by themselves, but once they infect a host, they can use its mechanisms to multiply.
Antibiotics are targeting bacterial infections successfully because bacterial cells can be recognized (have their own specific shell, and aren't relying on a host for survival). That's why antibiotics work, because while different, all bacterial cells are alike. And antibiotics only attack bacterias, not normal cells.
With viruses it's different ... you can't attack viruses with a generic mechanism.
The only hope you have to treat a virus / stop it's reproduction is to identify a signature in its proteins, and target that. Vaccines are the most efficient because they give your immune system a heads-up, but once you caught it the only hope you have is for your immune system to fight back.
Computer viruses are pretty much alike ... you can't have a generic method for fighting back. You can only develop a specific treatment for a specific virus, otherwise you'll be in the same league as cancer treatment ... targeting cancerous cells efficiently, but doing enough of a damage in normal cells that your internal organs start failing (with a direct analogy being the loss of data).
Personally I never install anti-viruses. I'm just cautious about the sources of the materials I have to work with, and whenever I suspect my computer got infected (happens once in 2 years) I just save my data somewhere and do a fresh reinstall.
Re: The sorry state of Avira anti-virus heuristics
#6Great example of why signature based detection for anti-virus is just a stopgap measure. You can be sure the anti-virus of the future (if there is one) will make limited to no use of malware signatures. I suppose it probably feels weird to most people to find out the AV product they pay a lot of money for is just a sophisticated version of grep.
I'm pretty sure the future of anti-viruses will involve signature matching one way or another, because there's no way around that. Viruses are pretty similar to their biological counterparts ... they are pretty useless by themselves, but once they infect a host, they can use its mechanisms to multiply. Antibiotics are targeting bacterial infections successfully because bacterial cells can be recognized (have their ow…
When it comes to recognizing current infections we're always going to have to deal with signatures, though we have the ability to match on behavior as well as code. We might look for things that are run out of the users directories that modify system-wide settings, for example.
I think there's a fundamental difference and that is that we can have a central security mechanism in a computer. It's not too hard to link a program to its privileges. For example, you browser should not be writing system-wide settings after it is installed, it shouldn't be forking processes that aren't duplicates of itself, etc. We shouldn't allow a process to add code to another process unless the user deliberately gives the process a higher level of privilege.
To draw another parallel with biology, we have the ability to surround every organ with its own barrier mechanism, like the blood-brain barrier and plecental barrier (I don't actually know what I'm talking about, so it's it is a very loose parallel). Basically, we have the power to wrap each process in its own protective sheath which doesn't let things in or out unless we okay it ahead of time.
Virus prevention is the future. Newer operating systems are already making progress in this direction.
Re: The sorry state of Avira anti-virus heuristics
#7Great example of why signature based detection for anti-virus is just a stopgap measure. You can be sure the anti-virus of the future (if there is one) will make limited to no use of malware signatures. I suppose it probably feels weird to most people to find out the AV product they pay a lot of money for is just a sophisticated version of grep.
I'm pretty sure the future of anti-viruses will involve signature matching one way or another, because there's no way around that. Viruses are pretty similar to their biological counterparts ... they are pretty useless by themselves, but once they infect a host, they can use its mechanisms to multiply. Antibiotics are targeting bacterial infections successfully because bacterial cells can be recognized (have their ow…
Analogies between computer viruses and biological viruses are strained, overused, and abused. I'll just point out that our innate immune system doesn't use signature based detection, it uses a whitelist and behavioral/heuristic based detection. Where do you think transplant rejection comes from? It's not because the immune system has a virus signature that matches the foreign organ.
I'm pretty sure the future of anti-viruses will involve signature matching one way or another, because there's no way around that.
There are numerous ways around it. A whitelist is the simplest way. We have the technology to systematically verify the integrity of each piece of software on a computer (barring physical access) [1]. The current implementations of TPM have the potential for massive privacy violations and abuse, but I'm hopeful that projects like OpenCore will eventually lead to open source TPM designs. In any case, in such a system anti-virus is not even necessary.
More complex but less restrictive methods include:
(1) Building machine learning algorithms around a set of data that measures the normal operation of the machine. Because 99.9999999999% of the time Grandma's computer shouldn't be acting as a server.
(2) A feedback system built into your antivirsus where users report applications that don't work or have malicious behavior. Then Grandma can look up the greeting card creator she wants to install and see that 100 users have given the application 5/5 stars over a period of 6 months. Bonus points for open source applications where people will take the time to audit them for free.
There's tons of research in this area and I don't have time to reproduce a complete summery here. The point is that signature based detection is a method that is not sustainable in the long term because the number of unique malware variants is something that is growing exponentially. Most people don't even have anti-virus installed, and those that do have to deal with the fact that the AV slows the machine to a crawl.
Signature based AV is just a stopgap measure until we can properly implement our operating systems and detection methods. In the future we will have operating systems with trusted computing bases and detection methods based on behavior and crowd sourcing.
Re: The sorry state of Avira anti-virus heuristics
#8http://fraudit.wordpress.com/
Could a moderator please disable this account, it's spam.
Re: The sorry state of Avira anti-virus heuristics
#9Earlier quoted context omitted.
I'm pretty sure the future of anti-viruses will involve signature matching one way or another, because there's no way around that. Viruses are pretty similar to their biological counterparts ... they are pretty useless by themselves, but once they infect a host, they can use its mechanisms to multiply. Antibiotics are targeting bacterial infections successfully because bacterial cells can be recognized (have their ow…
Analogies between computer viruses and biological viruses are strained, overused, and abused. I'll just point out that our innate immune system doesn't use signature based detection, it uses a whitelist and behavioral/heuristic based detection. Where do you think transplant rejection comes from? It's not because the immune system has a virus signature that matches the foreign organ. I'm pretty sure the future of anti…
any idea where I could learn more about curent implementations of (1) ?
Re: The sorry state of Avira anti-virus heuristics
#10Earlier quoted context omitted.
Analogies between computer viruses and biological viruses are strained, overused, and abused. I'll just point out that our innate immune system doesn't use signature based detection, it uses a whitelist and behavioral/heuristic based detection. Where do you think transplant rejection comes from? It's not because the immune system has a virus signature that matches the foreign organ. I'm pretty sure the future of anti…
any idea where I could learn more about curent implementations of (1) ?
Find a video of this Blackhat talk from 2005. Pretty sure it's in the iTunes store in the podcast section. The video covers pretty much everything you need to know about the theory of such systems.
http://www.blackhat.com/html/bh-usa-05/bh-usa-05-speakers.ht...
As far as actual implementation, I'm not aware of a system that does this. Although honestly some researcher has probably implemented such a system in a paper somewhere. There's probably a commercial network IDS that does it too. I haven't been doing this long enough to be an expert in the field, so I can't confidently say what the true state of the art is in behavioral detection. I'm pretty sure there are no open source projects though if that's what you're asking.
If you're thinking about implementing your own, I'd say start at the network level and write a simple program that sets an alarm off when a specific host starts responding to HTTP requests. If you want to get complex, use Wireshark to log all your network traffic for a month. You can then use Bayesian learning to determine whether new traffic is out of the ordinary. SSH traffic is problematic, so if you need to allow such traffic you'll have some additional challenges to overcome.
Starting an open source project related to this is on my TODO list, but I'm focusing on demonstrating the hopelessness of signature based detection first.