Did Virus Scanners Just Become Obsolete?
from the were-they-that-necessary-before? dept
It's become something of a joke when you look at just how many anti-something software products you need these days just to keep your computer safe (anti-virus, anti-spam, anti-spyware, firewall, anti-trojan, anti-phishing, anti-hijack, etc., etc., etc.), but the list usually begins with anti-virus software. According to one security researcher, though, anti-virus software may have just become a lot more insecure. Because the software needs to scan so many files so quickly, there are some programming shortcuts put into the products -- and the researcher has basically figured out a way to use those shortcuts to trick plenty of anti-virus products into completely skipping over malicious files. The claim, also, is that the only way to fix this is to really rewrite how the scanning works. Looks like, once again, people are going to need security software to protect themselves from their security software.
Thank you for reading this Techdirt post. With so many things competing for everyone’s attention these days, we really appreciate you giving us your time. We work hard every day to put quality content out there for our community.
Techdirt is one of the few remaining truly independent media outlets. We do not have a giant corporation behind us, and we rely heavily on our community to support us, in an age when advertisers are increasingly uninterested in sponsoring small, independent sites — especially a site like ours that is unwilling to pull punches in its reporting and analysis.
While other websites have resorted to paywalls, registration requirements, and increasingly annoying/intrusive advertising, we have always kept Techdirt open and available to anyone. But in order to continue doing so, we need your support. We offer a variety of ways for our readers to support us, from direct donations to special subscriptions and cool merchandise — and every little bit helps. Thank you.
–The Techdirt Team
Reader Comments
Subscribe: RSS
View by: Time | Thread
solve your virus problems!
[ link to this | view in chronology ]
Re: solve your virus problems!
Don't forget to rewrite all our financial software, convert all our databases and custom apps, set up remote networking across WAN's, VPN, and dial up, and Deliver a new e-mail system that doesn't change a thing about how users work.
Since it's so easy I'll expect it done ASAP.
How many more time do we have to see this uninteligent response from the "it just works" ditto-heads??
[ link to this | view in chronology ]
Re: solve your virus problems!
I'm no Win advocate either, though. I have a Wintel and a Mac at home. Assuming that the Mac is a more secure OS than Win, Win is more vulnerable to virus attacks because of its ubiquity. If Mac was 90%+ of the market, you'd see more viruses than you do now. It might be harder, but it's not impossible.
[ link to this | view in chronology ]
Re: solve your virus problems!
That's a narrow minded fallacy. I can't see the future, so I would definitely not try to say what would happen there.
It's possible though. History tends to repeat itself.
Maybe there will be a balance in the force.
[ link to this | view in chronology ]
Re: solve your virus problems!
You mean we might see 1 virus? That would be a lot more, because as of right now there are 0 viruses for OS X, 0 viruses for Linux, 0 viruses for Solaris and how many for Windows? Detect a pattern here? Its called Unix-based OS's.
[ link to this | view in chronology ]
Re: solve your virus problems!
A simple Google reveals that there are numerous Linux virii, numerous Mac virii, numerous Solaris virii.
They are not as prevalent as Windows virii, true, but that's sort of a no-brainer -- there are one hell of a lot more Windows machines than Max+Linux+Solaris put together.
But the point is valid: to some extent, Mac (et. al) is relying upon security through obscurity. If you reversed the situation, to where Mac was ~90% and Windows ~8%, you'd see Mac virii really take off. Even more so, in my opinion, because of the "it just works" attitude -- Mac users are trained to not want to think about what's happening behind the scenes, so as long as the machine doesn't crash, it could be spewing out billions of little virus copies and the Mac user would be happily clicking his shiny smiling icons.
But the "there are 0 viruses" comment is either a lie or flat out wrong. There are plenty of virii for Mac (and all flavors of Unix), and they would almost certainly take off in popularity if the Mac platform ever "took over."
[ link to this | view in chronology ]
Re: solve your virus problems!
[ link to this | view in chronology ]
Re: solve your virus problems!
What kind of system are you running that your desktops are intimately tied in an OS lock-step with your servers? That's hideously poor planning that went into that eggbasket, and for the sake of any shred of security you should decouple the clients from the servers.
.. and remove the hard drives from the clients too, but that's next quarter.
[ link to this | view in chronology ]
Re: solve your virus problems!
Mac is more intuitive, and any end-user with half a brain can look into the common windows tasks and find a quick and friendly solution.
Sure the "get a mac" arguement is getting old but, as a die-hard Windows user since 3.1, I gave it up a year ago for Mac.
what I can say is this: Windows is for folks who like to work on cars, and Mac is for people who like to drive.
Fharfernugen here.....
[ link to this | view in chronology ]
Re: solve your virus problems!
[ link to this | view in chronology ]
Re: solve your virus problems!
[ link to this | view in chronology ]
Re: solve your virus problems!
[ link to this | view in chronology ]
Re: solve your virus problems!
But seeing as a virus's soul purpose is to copy itself and spread, it doesn't actual need root prilivedges to do this.
The only solution to virii, worms, spyware etc. is basic common sense.It can be sumed up in 3 rules that have been know to many since before the Web was in common use.
1. Don't run an executable that you don't completely turst the source of.
2. Run every process with the minimum priviledges required to perform it's job.
3. Don't run any unnescessary services from your system.
Very basic rules that have keep me virii, worm and spyware free since 1985.
[ link to this | view in chronology ]
Re: solve your virus problems!
[ link to this | view in chronology ]
GoogleScan to the rescue?
[ link to this | view in chronology ]
What are they currently doing?
Why can't we just scan every file being created? Isn't that a fairly effective border guard? If a file has to be scanned immediately after being written to disk or into memory (some intelligence would be necessary to prevent scanning the loading of an old app vs something that your browser just pulled down), where is the potential for infection?
I don't claim to be an expert, but I see it as a pretty severe chokepoint when any new file is suspect and any citizens are not - even unzipping a file with a virus would be writing that new file somewhere, and then the scanner would pounce.
[ link to this | view in chronology ]
Re: What are they currently doing?
What would be so hard about windows having the antivirus capabilities built right in as a system process optimized to not bog down systems? It runs constantly and is always scanning; especially when CPU process is low (middle of night). This sounds like the best option that doesn't exist.
Microsoft already has 243982734987 patches released each week that users are required to update if they wanna avoid vulnerabilities. What's so hard about adding virus definitions to the mix?
[ link to this | view in chronology ]
Re: What are they currently doing?
The biggest names in antivirus software are all third-party vendors. Go bug them if you would like virus definition updates to be integrated with the main Windows Update that downloads Microsoft's updates du jour.
[ link to this | view in chronology ]
Re: What are they currently doing?
I'm just throwing stuff out there, but, i believe something needs to be done. Something new needs to be made and these threats to be either lessened, or more favorably, non-existent.Please, e-mail me if I am totally wrong or what i just said is allready true. I would like to know if this action has allready been taken, or its just something totally stupid.
[ link to this | view in chronology ]
Re: What are they currently doing?
[ link to this | view in chronology ]
THE ADS ARE IRONIC
[ link to this | view in chronology ]
Tamiflu
[ link to this | view in chronology ]
Re: Tamiflu
[ link to this | view in chronology ]
Virii arent easy to get
The 1, was a fairly complex virii, but Bullguard killed it before it did anything.
The 2, one of which a friend sent me because he was trying to fix it (don't ask, hes weird), Bullguard killed it before it was done downloading. The other, I had my friend remotely hack into my computer to show how secure it was. Took him a long time, and he only manage to give me the file, nothing happened. Then I enabled bullguard and it died :)
I said Bullguard a lot. Mainly because it is all that. There are 2 main types of software, those made to protect, and those made to profit. Norton, McAffee, and many others, are made to profit. The make the anti-virus software ASAP, and release it to sell it. Sure it gets some virii, but what it doesn't get is what really matters. Others, like Bullguard, are made to protect. These types of software usually have very few updates because they werent released half-assed to make a profit. They were made to be final.
I'm not saying Bullguard doesn't have updates. Infact, sometimes they have hourly virus definition updates, keeping you on the razor's edge of new definitions.
All in all, Bullguard isn't the only protection. Using Internet Explorer puts you at great risk for getting adware or other malicious software. Firefox seems to block most of anything you could ever get. ActiveX is the plugin of the devil.
[ link to this | view in chronology ]
The simple 'anti-' answer ...
[ link to this | view in chronology ]
Re: The simple 'anti-' answer ...
Although I really don't need to, I still run a NAT, SW Firewall, AV and the other "anti's" but it really doesn't matter if I get a virus because I started out with a clean install of XP and immediately froze the drive, so as soon as I reboot the PC loses any viruses or rootkits that install.
Whenever I need to update my PC (or write to my USB drive), I reboot to be sure it's clean and update it, then refreeze. It might sound like a hassle to some, but I'm so used to it now, I hardly notice the minor inconvenience, plus it's kind of empowering to know I can surf *anywhere* I want and know my PC can't be infected, (and I do surf everywhere and you should see the stuff that gets in even with all my “protection”).
[ link to this | view in chronology ]
McAffee Virus Scan (5 star???)
[ link to this | view in chronology ]