Antivirus software could make your company more vulnerable

http://www.csoonline.com/article/3020459/security/antivirus-software-could-make-your-company-more-vulnerable.html

by r721 • 11 years ago

102 44 11 years ago

nikbackm• 11 years ago

Well, if Microsoft applies their secure programming guidelines also to Windows Defender that might be the best (and default) choice if you're worrying about attacks like these.

hiram1122• 11 years ago

I avoided AV software for most of my life. Though, when I worked as a student admin, I would always install AV for the majority of my users. Most users (especially older) simply could never learn not to download that cool new 'freeware' app or game or not double click a downloaded exe (the fact that hidden extensions are still the default on Windows OS is absurd).

As a more savvy user, I did not desire the typical AV bloatware (Norton, McAfee, etc) stealing up half my cycles and spinning the hard drive without pause. I knew enough not to try and 'open' resume.doc.exe.

However, AV's have trimmed down, SSDs are becoming more common place, and it seems the biggest attack vector is browser based. For the last few years, I've run a few different AVs (Kaspersky, ESET, Bitdefender are decent).

I run adblockers, don't install Flash games or Applets, but it is nearly impossible to stop all browser based attacks. I'm not sure the AVs have helped much, but they give some sort of psychological benefit, at least.

There really is no good solution anymore unless you're willing to give up 90% of the web (via NoScript or using a primitive console based browser). I believe the future for tech-aware users will be browsers in some sort of container / VM that reset themselves upon each session, with absolutely no control to the file system or data from other sites.

gtk40• 11 years ago

Something like this? https://solutionexchange.vmware.com/store/products/browser-a...

ghrifter2• 11 years ago

> the fact that hidden extensions are still the default on Windows OS is absurd

Is this the case for Apple's OS well (Yosemite or whatever its called nowadays)?

reubenmorais• 11 years ago

OS X is a UNIX, so file extensions don't matter a whole lot. You can double click a plain Mach-O executable file and it'll run it in a Terminal window. For application bundles (folder with name ending in .app), OS X will warn you if the file was downloaded/not signed by a key trusted by Apple.

NetStrikeForce2• 11 years ago

> I'm not sure the AVs have helped much, but they give some sort of psychological benefit, at least.

I find this a very dangerous way of thinking. You use the placebo (well, not even a placebo, just useless) and then you stop worrying that much about opening downloaded files, checking their hash if you trust the source, visiting dodgy websites...

An analogy taken to the extreme, would be to smoke and binge drinking without worries because you're taking homeopathic "solutions" (sic).

jasonmp85• 11 years ago

I don't know if the OP actually exhibits this, but what you're describing is known as risk compensation: https://en.wikipedia.org/wiki/Risk_compensation

bonoboTP• 11 years ago

Not necessarily! It depends! It could be that the constant popups about updating the AV, about allowing access to trusted programs etc. constantly reminds him of the aspect of security and has this aspect in the back of his mind while browsing, so it may actually enhance security awareness. As in "I'm the sort of person who cares a lot about viruses, so much that I have an AV and adblocker etc., so I'm also the kind of person who doesn't just install any crap."

Installing an AV doesn't automatically reduce your defenses. Only if you over-trust it.

elorant• 11 years ago

> I believe the future for tech-aware users will be browsers in some sort of container / VM that reset themselves upon each session, with absolutely no control to the file system or data from other sites.

Or you could set-up a linux box just for web browsing.

PhasmaFelis• 11 years ago

Yeah, having to shuffle files between computers every single time you want to download or upload something sounds like loads of fun.

kgwxd• 11 years ago

NoScript with the occasional whitelist has been a perfect solution for me. I don't feel like I'm missing any part of the web, in fact, most of it is better without JS. At this point, sometimes I go weeks without having to add anything to the list. I don't think it would be a good solution for my mom but she only uses an iPad now so it doesn't matter.

dredmorbius• 11 years ago

Try uMatrix. It's Noscript and then some.

rpgmaker• 11 years ago

Another NoScript user here and the web is better because of this addon. It's amazing the quantity of websites that auto-play their videos, just by blocking those scripts alone NoScript has helped my blood pressure immensely.

voltagex_• 11 years ago

I found that NoScript required too much customisation for each site I visited - do you have some kind of default ruleset that makes this easier?

orionblastar2• 11 years ago

I used to use commercial antivirus products like McAfee and Norton and Trend Micro etc. I went with Avast Home for free. I scan with Emisoft Emergency Kit because it can fit on a USB drive and be portable.

No matter what you do eventually you will get infected by some exploit. Be it Flash, Java, some pop-up ad, or just an email sent to your email client that exploits it.

I got a lawyer still runs XP and Vista and uses ClamAV because it is free. I worry that her systems might be infected, but her husband runs the tech support for their firm. She used to have employees steal data via floppy disks, and these days a simple virus infection can steal data.

lfam2• 11 years ago

I got a lawyer still runs XP and Vista and uses ClamAV because it is free. I worry that her systems might be infected, but her husband runs the tech support for their firm.

Scary. Small law firms are a prime target for cryptolocker-type attacks. In that case you need a solid backup / restore system.

giancarlostoro• 11 years ago

You could always slap Linux on a USB thumb drive and not worry about malware while you browse the net.

lfam2• 11 years ago

using a primitive console based browser

Be careful which you choose. Some of them are extremely primitive compared to the major GUI browsers. For example, I was shocked to learn recently that there is no upstream for w3m, and that w3m doesn't do SSL out-of-the-box. And yet, w3m is used to render HTML by all sorts of other console-based applications.

akavel• 11 years ago

Regarding "future for tech-aware users will be browsers in [...] container/VM", see also Qubes OS:

https://www.qubes-os.org/screenshots/

https://www.qubes-os.org/

https://www.qubes-os.org/intro/

and the (microkernel-based) Genode OS with somewhat similar approach:

http://genode.org/documentation/release-notes/15.11#Rigid_se...

http://genode.org/documentation/release-notes/15.11#Genode_a...

http://genode.org/about/

and finally NixOS/Nix, which I hope will at some point become integrated in some way with the above OSes (as well as many others):

http://nixos.org/

hiram1122• 10 years ago

Thanks for the info! I'll take a look.

tim3332• 11 years ago

There really is no good solution anymore

Maybe a more secure os? I gather Chromebooks or Linux work quite well

I wonder if anyone's tried making something that looks like regular Windows but it actually Windows running in a VM under Linux. Might be a way to make something hard to hack but usable by people who only know Windows? Maybe it could have something like Git for versioning the Windows images so you could just roll back to when Cryptolocker got installed?

ChuckMcM• 11 years ago

At the moment the number of hypervisor escape exploits are fairly limited, so running a browser in a virtual machine where the system image is always destroyed has a certain cachet to it. I know a couple of people who have Chromebooks for browsing (at least one got the CB for free at Google I/O and they felt that was all it was good for :-)

When I get some time I'd like to clean up my air-gap browser, which was a webcam looking at a laptop with a browser open, where mouse and keyboard actions were translated at the Webcam into bluetooth messages which drove the laptop. Not very practical but wonderfully tin-hattish.

bigiain• 11 years ago

Nice, but for maximum tin-hatted-ness, can I suggest mechanical arms typing on the laptop keyboard and moving/clicking the mouse? Who knows what lurks in that Bluetooth stack and firmware? :-)

johhnnnhyrocko• 11 years ago

If you guys are looking for a list of some decent AV heres one from this year http://no-adware.com/blog/best-malware-removal-tools-of-2016... I am a huge MB fan myself.

mox1• 11 years ago

Mackeeper is listed as #2 on the list you linked to...[1] They aren't exactly a high quality AV product.

1. http://appleinsider.com/articles/15/08/10/mackeeper-to-pay-o...

tptacek3• 11 years ago

Not "could". Does.

AnimalMuppet2• 11 years ago

Do you think that AV, on net, makes you less secure? If so, can you provide any data?

tptacek3• 11 years ago

Yes, I do. AV is hairy systems code that hooks the OS in a bunch of places, and IT managers demand that it be very manageable, so it tends to have remote management and reporting UIs.

The long and nasty history of RCE flaws, not just horrible stuff like this but subtler stuff buried in the file format parsers, is all the data I feel like I need.

drummer32• 11 years ago

This[1] is on the very top of the fronpage right now. TrendMicro has a daemon listening on localhost that can execute arbitary commands.

[1]https://news.ycombinator.com/item?id=10882563

zAy0LfpBZLC8mAC• 11 years ago

Yes, unless you are clueless and execute any executable that manages to hop onto your machine.

AV is complex code that handles huge amounts of untrusted data, so it's a major increase in attack surface. Also, it cannot work, as it's an instance of blacklist security, which never works. So, no upside, huge potential downside.

mikecb• 11 years ago

Application whitelisting much more productive.

bitwize• 11 years ago

Whitelisting is one of the only proven security technologies in a world where you can download and run arbitrary executables. Bit9 should be a requirement on office PCs.

caf• 11 years ago

  ...and it also recently introduced HVMI (Hypervisor-based Memory Introspection)
  technology that completely isolates the antimalware solution by deploying it in
  a Type 1 hypervisor outside of the operating system.

  "This kind of isolation separates the antimalware engines from rootkits or
  exploits running in the user environment," the company said.

This completely misses the point. Yes, it protects the AV from exploits in other user software, but it makes exploits in the AV software itself even worse.

scottyates11• 11 years ago

Personally, I won't trust those AV software which are free but claims themselves have FULL function. There is no free lunch in the world. Sometimes, we make jokes on Qihoo 360, we say itself is already a virus. A lot of pop-ups, consuming computing resources. It is very annoying!

basicplus2• 11 years ago

Any views on Sofos? I use it to whitelist stuff as requested.. application by application.. seems pretty solid to me.

Antivirus software could make your company more vulnerable

Related Stories