Antivirus Makers Struggle to Adapt • Hacker News Board

Re: Antivirus Makers Struggle to Adapt

#41

Post by lucian303 » Tue, Jan 01, 2013, 9:21 AM UTC

jimbobimbo wrote: post #32

talleyrand wrote: post #3

I thought antivirus software existed merely to deal with flaws in Windows...

While I understand that Windows' past does make it a convenient target for such remarks, most "viruses" now are not really viruses, but malware that either exploit holes in (mostly) third-party software, or goes after a human factor. Stricter security practices from Vista onwards (UAC, low-privileged user accounts by default, etc.) make Windows no easier target than Mac or *x, if social engineering involved. No anti-…

The mass adoption (and with it, the mass misunderstanding/misconfiguration) of Windows makes it a much easier target than UNIX based platforms like OSX, GNU/Linux, FreeBSD, etc.

That along with the horrible architecture of Windows systems that just about invites malware. Vista failed miserably in both architecture and privileges and in an attempt to fix that in Windows 7, the privilege of accounts is nullified as it was in XP.

Speaking of XP, it's still the target of most malware and probably will be for some time as most Windows computers still run it (as opposed to 7/Vista/8).

Re: Antivirus Makers Struggle to Adapt

#42

Post by lucian303 » Tue, Jan 01, 2013, 9:22 AM UTC

revelation wrote: post #4

The data security firm recently found that antivirus software programs perform poorly against new viruses. The remainder of the article provides similar enlightenment.

Enlightenment? Lol. If you are enlightened by this article, you really don't understand software.

Re: Antivirus Makers Struggle to Adapt

#43

Post by lucian303 » Tue, Jan 01, 2013, 9:26 AM UTC

josephagoss wrote: post #16

On windows I have been recommending people to use Microsoft Security Essentials, which is free. I understand Microsoft cannot bundle MSE because of that being a monopoly but I really wish they could, With MSE being pre-installed as opposed to Norton and McAfee trials being pre-installed and asking for money after 3 months.

Better software exists (for free). A little research will lead you to it.

Re: Antivirus Makers Struggle to Adapt

#44

Post by lucian303 » Tue, Jan 01, 2013, 9:29 AM UTC

oskarpearson wrote: post #34

revelation wrote: post #4

The data security firm recently found that antivirus software programs perform poorly against new viruses. The remainder of the article provides similar enlightenment.

The article basically adds a few interviews and photos to an Imperva press release: http://investors.imperva.com/phoenix.zhtml?c=247116&p=ir... Aside: this reminded me of PG's article "The Suit is Back": http://www.paulgraham.com/submarine.html That, at least, is well worth a read. So I guess Imperva might be a company to watch - at least we now know they have a good PR firm :)

There's anti-virus and then there are the programs that fill in the gap where the AV program lack. A simple google search will yield you the results.

Re: Antivirus Makers Struggle to Adapt

#45

Post by beagle3 » Tue, Jan 01, 2013, 12:56 PM UTC

throwaway2048 wrote: post #28

jdangu wrote: post #13

Traditional A/V are broken for the web. With dynamic languages like JS and ActionScript, their approach is to fingerprint 10 different strains of the same threat. Then the 11th strain can be generated in a few seconds with new obfuscation. So the A/V only starts working if/when eventually a native code payload reaches the target.

no, it really dosent. native code can do the exact same sort of tricks. a pretty standard tool in detection evasions bag of tricks is to write a custom virtual machine that generates code on the fly, which makes static, signature based analysis of payloads totally useless.

And yet, when I was working on an antivirus, back in 1989 (yes, that's 1989), we already had these viruses, and we were detecting them without problems - it wasn't just a static signature, granted, and back then we wrote a recognizer for each polymorphic virus (a quick first stage would have been served by a regular language back then, but we didn't use them for speed reasons; the whole program was assembly!)

Re: Antivirus Makers Struggle to Adapt

#46

Post by beagle3 » Tue, Jan 01, 2013, 12:59 PM UTC

jimbobimbo wrote: post #32

talleyrand wrote: post #3

I thought antivirus software existed merely to deal with flaws in Windows...

While I understand that Windows' past does make it a convenient target for such remarks, most "viruses" now are not really viruses, but malware that either exploit holes in (mostly) third-party software, or goes after a human factor. Stricter security practices from Vista onwards (UAC, low-privileged user accounts by default, etc.) make Windows no easier target than Mac or *x, if social engineering involved. No anti-…

If a site gets you to download an executable, it's now 3 mouse clicks to get it to run on an average desktop setup (As opposed to 0 in the Win2K days and 1 in the early XP days).

In Unixes, it's still "open an xterm and chmod a+x executable". There's still a huge difference.

Re: Antivirus Makers Struggle to Adapt

#47

Post by delinka » Tue, Jan 01, 2013, 1:03 PM UTC

lucian303 wrote: post #42

revelation wrote: post #4

The data security firm recently found that antivirus software programs perform poorly against new viruses. The remainder of the article provides similar enlightenment.

Enlightenment? Lol. If you are enlightened by this article, you really don't understand software.

Or perhaps you missed the irony.

Re: Antivirus Makers Struggle to Adapt

#48

Post by DanBC » Tue, Jan 01, 2013, 1:18 PM UTC

lucian303 wrote: post #43

josephagoss wrote: post #16

On windows I have been recommending people to use Microsoft Security Essentials, which is free. I understand Microsoft cannot bundle MSE because of that being a monopoly but I really wish they could, With MSE being pre-installed as opposed to Norton and McAfee trials being pre-installed and asking for money after 3 months.

Better software exists (for free). A little research will lead you to it.

Why the coyness?

What is that better software?

Some people might have weird definitions of "better", so it might also be handy to say why that software is better.

Re: Antivirus Makers Struggle to Adapt

#49

Post by msluyter » Tue, Jan 01, 2013, 2:28 PM UTC

Given that these A/V products are only marginally effective, does anyone have any suggestions for what might be the best bang for the buck in terms of protection a Win7 machine? My preference would be just not to run windows, but it's my mom's system, and she needs certain windows based accounting packages...

Re: Antivirus Makers Struggle to Adapt

#50

Post by lucian303 » Tue, Jan 01, 2013, 6:32 PM UTC

DanBC wrote: post #48

lucian303 wrote: post #43

Earlier quoted context omitted.

Better software exists (for free). A little research will lead you to it.

Why the coyness? What is that better software? Some people might have weird definitions of "better", so it might also be handy to say why that software is better.

Exactly for that reason.