10 ms·
Netflix Is Dumping Anti-Virus, Presages Death of an Industry
- nso95 11y agoThis article is terrible...
- makeitsuckless 11y agoOTOH, excellent work by SentinalOne's marketing department. Probably cost them no more than a decent lunch while they dictated it to the hack who's name is in the byline.
- 0x4a42 11y agoIt's even worst if you are not fluent in english (like I am). There is so much noise and marketing words I had to read it twice just to get the idea.
- benbristow 11y agoWait until an employee gets some malware and some data gets leaked or lost. Then they'll be running back.
- blkhawk 11y agoif you read the linked article the you will notice that they don't dump AV - they just switched to a "AV" product that does away with the signature database completely and replacing it with heuristics - it also sounds like there is some white listing of processes involved as well. This is something AV products have been doing for quite some time now.
- OJFord 11y agobut...but.. this one is _post_-AV! It must be better!
- GordonS 11y agoI definitely agree that we need more than anti-virus these days - but I still think anti-virus has a part to play in a multi-layered approach to security. But in any case the content of the article is rather less sensational that the headline. It seems like Netflix is 'dumping' anti-virus for... well, another anti-virus tool! It's just that SentinelOne is not signature based, and relies on dynamically detecting dubious activities by processes (which some existing anti-virus tools already do, if to a lesser degree).
- sqldba 11y agoI'd like to know more about what it's doing and how it works. I can imagine a couple scenarios: 1) It might have a "baseline" time during which it allows and records everything, and then locks down anything outside of that (like the old ZoneAlarm did for firewalls). 2) Or it might only lock down certain APIs? File and registry and network access? Not sure where you'd stop with that. What about when it emails everyone in Outlook? Unless I'm completely off base.
- reviseddamage 11y ago>is not signature based, and relies on dynamically detecting dubious activities by processes Isn't that the main thesis of the attack-driven defense?
- pstadler 11y agoPhoto caption says: "Netflix is quitting anti-virus. Will its millions of users benefit?" Wat?
- OJFord 11y agoHa! That is totally nonsensical. I didn't agree at first, but this smells more and more like PR - there seems to be very little understanding of the news in the article. What is "the post-AV anti-malware game", and why on Earth would Netflix's end-users benefit from the company's staff computers entering said game?!
- probably_wrong 11y agoSo, Netflix is ditching anti-virus in favor of a software that was certified as doing what any other anti-virus can do. How is that "ditching anti-virus", then? Wouldn't a better title be "Netflix is switching anti-virus providers"?
- jasode 11y agoA more nuanced title would be: "To continue its fight against new viruses, Netflix is dumping classical disk-scanning-fingerprints software for newer technologies such as statistical analysis of anomalies." Netflix and whoever they hire (e.g. SentinelOne) is still fighting viruses. They're just doing it using more sophisticated algorithms instead of fingerprints. Traditional anti-virus software trying to match file signatures is not effective against 0-day attacks. What's newsworthy is that a vendor was able to convince important people (e.g. AV-TEST Institute) that algorithms scanning for anomalies is equivalent to, or stronger than, traditional disk-scanning. However, it doesn't look like they've convinced the credit-card industry yet. They're the ones who determine PCI DSS compliance. However, PCI DSS may not apply to Netflix. Interpreting the story as an ongoing progression of anti-virus technology, it means the industry won't "die" at all. They're just retooling themselves with more algorithmic approaches. Maybe Symantec will add algorithms and also be included in the changing industry of fighting viruses.
- dogma1138 11y agoPCI-DSS applies to Netflix very much, they probably still will have traditional AV in their CHD environment and any other system in scope of the certification (e.g. the desktops the sysadmins use to administer servers within the CHD environment). Also the PCI council doesn't define which AV is compliant or not, only states that you need anti-virus protection on all systems commonly affected by malicious software. It's up to the QSA and acquirer(if that one gets really bored) to accept the solution, neither of which care really. You can use Windows Defender, Clam or the most super duper expensive AV out there it's all the same for them. The requirement is also worded very carefully "on all systems commonly affected by malicious software" so people could make a case against installing AV on things that AV solutions are not common for, such as Mac's, Linux box's, and even Mainframes (yes there are mainframes in certain PCI-DSS scope's because the QSA wasn't smart enough to find a loop hole to keep it out of scope or the costumer is dumb enough to actually process or store credit cards on it).
- dr_zoidberg 11y agoI work in digital forensics, and running Volatility against the memory (either online or against a memory dump), helps give a far deeper insight and way higher probability at finding viruses than standard "antivirus" software. You can even find Advanced Persistent Threats (APTs) and "unidentified" viruses, because what you look for are the mechanisms by which a virus resides in memory: hidden processes, hooks to system calls, spurious DLLs, etc. Ever since I learned about memory analysis, I have considered almost every antivirus useless. I do have the Windows Defender antivirus active, but if I have a real doubt, I turn to memory analysis just to be sure (still clean luckily!).
- zamalek 11y agoIn general anti-virus is more useful for less educated users. For example, I'd never escalate (sudo, UAC, etc.) a process that I wouldn't expect to need the escalation. This severely limits the control a virus can take (stopping most in their tracks). The only people who really need AV are the type of idiots who run as root, or turn off UAC. The real concern are advanced worms. Most of these would likely infect a machine regardless of the presence of an AV, either because they are zero-day or because a machine does not have security patches installed. AVs, typically, would struggle to catch an e.g. malicious BIOS flash resulting from an escalation vulnerability. In the face of security patching, AVs are largely obsolete, irrespective of their detection rates: not 'completely' because human error does exist (which is why I still run one).
- tormeh 11y agoMany, many security patches are way late. AV software is nice when a vendor can't be bothered to update their software.
- zamalek 11y ago> Many, many security patches are way late. My main point was: a virus that uses a 0-day (or unpatched/unfixed 0-day) is likely going to cause problems for an AV: > AVs, typically, would struggle to catch an e.g. malicious BIOS flash resulting from an escalation vulnerability. Over-exaggerating to clarify: AVs are like bringing a knife to a gunfight. You might just be actually able to eliminate the weaker opponents (who also brought knives), but you're going nowhere against the veterans.
- dogma1138 11y agoIt takes about 5min to refactor the code of existing malware to avoid detection, heck playing around with compiler settings is enough in many cases. I've recompiled Netcat probably 200 times by now, small refactoring playing with compiler flags (compile with x64 profile, debug on, add some symbols etc..) and every time it avoids every AV out there. I usually use Virustotal which means that it will be short lived but i can do it over and over and over again ;)
- bitJericho 11y agoTldr: Netflix is dumping old antivirus for new antivirus
- thaumaturgy 11y agoI guess we're going to debate the merits of statements in a thinly-veiled bit of PR now? There's almost no news about this company until about a month ago (http://www.networkworld.com/article/2955017/security/endpoint-security-firm-sentinelone-challenges-traditional-anti-virus-software.html http://www.networkworld.com/article/2955017/security/endpoin...). They recently hired a new PR company (http://www.mgpr.info/ http://www.mgpr.info/) who's been spamming articles to Reuters on SentinelOne's behalf (https://www.google.com/?gws_rd=ssl#q=site:reuters.com+sentinelone https://www.google.com/?gws_rd=ssl#q=site:reuters.com+sentin...), and then reaching out to hacks to write submarine articles (http://paulgraham.com/submarine.html http://paulgraham.com/submarine.html) about the death of anti-virus -- which just happens to be the marketing lede of SentinelOne's endpoint protection product. Then they landed a big contract with Netflix and got a sucker at Forbes to write some PR like it was news, and now it's been picked up by HN and being discussed as though it had some substance.
- Sujan 11y agoGood thing is, people will Google for SentinelOne, find this thread, read the comments and learn a bit what HN thinks about it...
- deleted 11y ago[deleted]
- teh_klev 11y agoYes, I thought there was a PR smell about that article.
- davidcatalano 11y agoLink bait to paid article under cover of news courtesy of Forbes.
- TFoxBrewster 11y agoJust wanted to chime in to clarify that I contacted Netflix directly without having ever spoken to SentinelOne. When I contacted SentinelOne after the interview they said they couldn't even go on the record about the Netflix contract. Much love, Sucker at Forbes.
- kriro 11y agoI wonder how the equivalence is shown for the certification. Do they use something similar to bioequivalence tests (TOST etc.) over the mean number if infections/issues detected?
- nbevans 11y agoThe real question is why Netflix needs anti-virus at all. Whether it be the old signature style or the new (as of about 2002) heuristic analysis style. Presumably they're turning off UAC, giving out admin privs to everyone, disabling automatic updates, and hiring delinquents that run every .exe email attachment?
- UnoriginalGuy 11y agoThe trend in malware right now is not to even target administrator/root, and instead to steal information/blackmail/send spam+DDoS from the user's context.
- noondip 11y agoMost likely they are doing it for security standards compliance, like PCI DSS: > Use and regularly update anti-virus software on all systems commonly affected by malware
- douche 11y agoAnti-virus software is a scourge that I'd be happy to see disappear. For the most part, its business model is to prey on the ignorant - I can't even count how many times I've been asked why a computer is running slowly, only to discover that there are three or more competing anti-virus products running, every one of them hooked into every single file read or write. Just yesterday I had to turn off Windows Defender real-time scanning, because it had gone out to lunch and leaked memory to the tune of 2.1 GB. Hot garbage. It seems like the popular thing lately is to bitch and moan and question the morality of using ad-blockers, but using an ad-blocker is the single most important thing you can do to improve security on your machine for the average user. Blocking Flash, or, should you happen to still encounter it, Java, from autoplaying comes in second. Blacklisting SourceForge in your hosts file might be up there, if they are still bundling crapware with the few legitimate downloads that haven't moved elsewhere.
- Spooky23 11y agoI disagree. I used to run a huge population of PCs. AV isn't a silver bullet, and shouldn't be the only security measure in place. But it does catch stuff, and isn't a scourge if you're rolling it out correctly.
- notfoss 11y ago> Blacklisting SourceForge in your hosts file might be up there, if they are still bundling crapware with the few legitimate downloads that haven't moved elsewhere. ublock origin has a "Badware risks" filter list with sourceforge in it.
- upofadown 11y agoSo who cares what Netflix does for anti-virus? Their business is about running servers with almost read only data that can't normally propagate a virus infection.
- ams6110 11y agoThis is about what they're using on staff desktops, not their video-delivery systems.
- upofadown 11y agoRight, so this would of been just as relevant if it was about a local trucking company. They are dropping the wrong name if they actually want to promote the product.
- t2015_08_25 11y agoThank you. I was going mad trying to comprehend what the phrase "dumping anti-virus" means.
- justwannasing 11y ago> servers with almost read only data that can't normally propagate a virus infection. Those are FreeBSD servers so you are correct but something needs to prevent that data from being put on their by other OSes.
- d_theorist 11y agoOne of the most moronic articles I have read this week.
- UnoriginalGuy 11y agoFurther still, I'd describe it as an advert more than an article. Seems to lack substance and has a clickbait title, and the only purpose of the article is to sell you SentinelOne. The dumbest part is that the title isn't even right, Netflix still absolutely do anti-virus/anti-malware, they've just given up on ineffective signature scanning, and are moving to a dynamic scanning engine. I actually think signature based AV sucks and would be happy to see the industry move away from it, but cannot condone such dumb submarine articles as this.
- bigtunacan 11y ago<TL;DR> SentinelOne, creators of anti-virus software no one has heard of, don't use the term "anti-virus" for their anti-virus software. Somehow that landed a sucker at Forbes to write a shoddy PR article about the death of anti-virus software. End game; If their PR stunt is wildly successful then no one will need to buy SentinelOne's software either... Wat?!!
- profinger 11y agoPretty well summarized!
- stabilo 11y agoInterestingly, no matter what the user-agent string, I am not able to view this without Javascript. Precluding cautious web users from reading is somewhat ironic given that this article is about web security, if indeed that is what this is about. It's probably not intentional, just oversight on Forbes' part.
- scrumper 11y agoHijacking this: how does the ordinary solo user go about finding malware if AV is so bad at it? As a Mac user, I know there are rootkits and other nasties out there but I have no idea how to go about detection.
- bikeshack 11y agoI like tools that rather than scan for signatures (which can be polymorphic in nature and bypass AV), they can look for out-of-place behaviour on the OS. The Sysinternals Suite is great for malware hunting: https://technet.microsoft.com/en-us/sysinternals/bb842062 https://technet.microsoft.com/en-us/sysinternals/bb842062 And things like Reason Core are brilliant for nuking any rootkits that somehow get on to a system https://www.reasoncoresecurity.com/ https://www.reasoncoresecurity.com/ Malware has grown up and is now residing in hardware and can survive entire OS re-installs. I feel sorry for Windows users these days because malware has grown up and it is not as obvious you have malware. In the past there were obvious signs you were infected and the malware made itself known (sort of stupid when you're an attacker really). Also some of the 'second opinion' tools are interesting too: http://www.surfright.nl/en/hitmanpro http://www.surfright.nl/en/hitmanpro
- gadrfgaesgysd 11y ago.