5 ms·

I hate antivirus software with a passion. I've wasted too many weeks of my life hacking around bugs that antivirus programs introduced into my customers' system

I hate antivirus software with a passion. I've wasted too many weeks of my life hacking around bugs that antivirus programs introduced into my customers' systems. A couple I've dealt with in the last six months: McAfee Antivirus causes applications built with Unity 4 to fail when they call WWW.LoadFromCacheOrDownload() on a large asset bundle. This API call downloads a temp file and then renames the file to move it into the cache. But McAfee also opens the file for a virus scan. For a large file, the virus scan may not complete before Unity tries to rename the file, so the rename fails and you never get the asset bundle. For one client I fixed this by patching Unity's .exe file to add a retry loop on the rename call. Unity 5 also works around this issue with the same retry loop. AVG Antivirus causes updates to fail for applications that use wyUpdate. wyUpdate calls the CreateMutex() function in the Windows API to make sure another updater instance isn't already running. Bizarrely, when AVG is installed, CreateMutex() returns the wrong value, so wyUpdate thinks another instance is running and bails out. No updates for you! Going back a few years, I tried NOD32 after some friends recommended it. It seemed fine, except the Alt+Tab key no longer worked. It was a known bug, unfixed for some time. About 5-6 years ago, McAfee had a known bug - unfixed for nearly a year - than under some circumstances it would erase the entire hard drive. This was the ultimate in virus protection!

userbinator 11y ago
False positives are the other dark side of AV; here's AVG detecting completely innocuous "Hello World" programs as potential threats: http://www.cplusplus.com/forum/beginner/67634/ http://www.cplusplus.com/forum/beginner/67634/ https://groups.google.com/d/topic/mingwusers/kFrCqECTY_Y https://groups.google.com/d/topic/mingwusers/kFrCqECTY_Y Along the same lines, it's rather common that keygens/cracks/patches are detected as false positives too: http://underlore.com/anti-virus-community-creates-false-positives-for-fun-and-profit/ http://underlore.com/anti-virus-community-creates-false-posi...
- kbenson 11y ago
  Maybe the Ken Thompson Hack[1] is alive in the wild, or AVG just believes it is. ;) 1: Reflections on Trusting Trust: https://www.win.tue.nl/~aeb/linux/hh/thompson/trust.html https://www.win.tue.nl/~aeb/linux/hh/thompson/trust.html
  - mattkrea 11y ago
    That's exactly what XcodeGhost is/was
- PhasmaFelis 11y ago
  I think "detected as false positives" is too mildly put. It implies that it's an honest if bumbling mistake, rather than deliberate and malicious FUD.
- dspillett 11y ago
  > it's rather common that keygens/cracks/patches are detected as false positives That is unavoidable if the scanning engine is trying to apply heuristics to pick up on attacks (or variants thereof) that are not in its database yet, especially with cracks and other patches: changing the behaviour of executables the way they do is by its nature similar to what viruses and worms are attempting to do.
hvo 11y ago
+1 for your comment. I really can't stand antivirus software.Sometimes no antivirus is better than antivirus software.It is another area of software development that is broken and crying for a fix.Who is ready to up this challenge?
- tim333 11y ago
  The best fix would seem to be more secure OSs like iOS and Chromebooks.
mccracken 11y ago
I'm interested, how did you figure out that's what was happening (just the first example)?
- Stratoscope 11y ago
  For the issue with McAfee interfering with file move calls, Unity was logging an error message that said something like "Cannot move file into cache." That was a good clue that a file move operation was failing. So I ran the app under the amazing API Monitor [1] and enabled logging for MoveFileA(), MoveFileW(), MoveFileExA(), MoveFileExW(), and similar "move file" APIs. It showed a failure on a MoveFileExW() call with the address of the call. We'd found that Unity 5 didn't have the same problem (but we weren't ready to migrate to Unity 5 yet), so I also ran a Unity 5 test app under API Monitor and found the same failure on MoveFileExW(), along with several retries on the call until it succeeded. This told me just what I needed to patch the call for the Unity 4 app. For the issue with AVG and wyUpdate, since wyUpdate is open source I just ran it under the debugger, and as luck would have it, the failing mutex.WaitOne() call was near the beginning of Program::Main() in the C# code [2]. (I mentioned WinMain() and CreateMutex() previously - I was writing that from memory and double-checked it now.) [1] http://www.rohitab.com/apimonitor http://www.rohitab.com/apimonitor [2] https://github.com/geary/wyupdate/blob/master/Program.cs#L40 https://github.com/geary/wyupdate/blob/master/Program.cs#L40
  - mccracken 11y ago
    Pragmatic!
joe_the_user 11y ago
Years ago, I would have ended a similar rant with "what we need is designs that just don't do things like autorun and view-attachments-by-default" But now, the "attack surface" has expanded inexorably to the point where the alternative to AV appears to be... none. So this just seems to be the modern Internet, where the average user is more or less at the behest of rackets not much better than the rackets that control botnets if they aren't actually infected by them. I've heard some botnets patch the system and expel other intruders. Yes, now, "everything is free... infection and protection equally". Is there an alternative?
- ant6n 11y ago
  Don't use Windows
  - Moru 11y ago
    That only works until enough people use an alternative. Then it will be interesting to start searching for bugs and security holes in the alternative. Just look at all the webserver exploits lately. Nothing is bugfree.
    - tluyben2 11y ago
      Still works now though so it holds true. However for instance Android is used far more than Windows and iOS is getting close and those are still not close the misery Windows is in this regard.
      - kedean 11y ago
        We don't really have a reliable measure of how many attacks are happening on Android and iOS, though. Unlike with a PC, users are much more likely to attribute malware-related problems to 'my phone is just old, I need a new one'. I would attribute this to a mixture of phone commodification (iPhone's appear to be pretty cheap thanks to subsidy plans) and the effects of cloud infrastructure. Users have basically nothing to lose by swapping out phone hardware, because what'll you do, ransom their contact list?
Springtime 11y ago
Around 2008 or so I seem to remember Kaspersky writing metadata to every file on the OS when scanning, requiring more frequent (and longer) drive defragging. Nowadays I just use Defender on Windows 8, EMET and browser common sense. Occasionally firing up a sandbox for testing programs. Having NoScript enabled alone helps a great deal in preventing many exploits.

userbinator 11y ago

False positives are the other dark side of AV; here's AVG detecting completely innocuous "Hello World" programs as potential threats: http://www.cplusplus.com/forum/beginner/67634/ http://www.cplusplus.com/forum/beginner/67634/ https://groups.google.com/d/topic/mingwusers/kFrCqECTY_Y https://groups.google.com/d/topic/mingwusers/kFrCqECTY_Y Along the same lines, it's rather common that keygens/cracks/patches are detected as false positives too: http://underlore.com/anti-virus-community-creates-false-positives-for-fun-and-profit/ http://underlore.com/anti-virus-community-creates-false-posi...

kbenson 11y ago
Maybe the Ken Thompson Hack[1] is alive in the wild, or AVG just believes it is. ;) 1: Reflections on Trusting Trust: https://www.win.tue.nl/~aeb/linux/hh/thompson/trust.html https://www.win.tue.nl/~aeb/linux/hh/thompson/trust.html
- mattkrea 11y ago
  That's exactly what XcodeGhost is/was
PhasmaFelis 11y ago
I think "detected as false positives" is too mildly put. It implies that it's an honest if bumbling mistake, rather than deliberate and malicious FUD.
dspillett 11y ago
> it's rather common that keygens/cracks/patches are detected as false positives That is unavoidable if the scanning engine is trying to apply heuristics to pick up on attacks (or variants thereof) that are not in its database yet, especially with cracks and other patches: changing the behaviour of executables the way they do is by its nature similar to what viruses and worms are attempting to do.

hvo 11y ago

+1 for your comment. I really can't stand antivirus software.Sometimes no antivirus is better than antivirus software.It is another area of software development that is broken and crying for a fix.Who is ready to up this challenge?

tim333 11y ago
The best fix would seem to be more secure OSs like iOS and Chromebooks.

mccracken 11y ago

I'm interested, how did you figure out that's what was happening (just the first example)?

Stratoscope 11y ago
For the issue with McAfee interfering with file move calls, Unity was logging an error message that said something like "Cannot move file into cache." That was a good clue that a file move operation was failing. So I ran the app under the amazing API Monitor [1] and enabled logging for MoveFileA(), MoveFileW(), MoveFileExA(), MoveFileExW(), and similar "move file" APIs. It showed a failure on a MoveFileExW() call with the address of the call. We'd found that Unity 5 didn't have the same problem (but we weren't ready to migrate to Unity 5 yet), so I also ran a Unity 5 test app under API Monitor and found the same failure on MoveFileExW(), along with several retries on the call until it succeeded. This told me just what I needed to patch the call for the Unity 4 app. For the issue with AVG and wyUpdate, since wyUpdate is open source I just ran it under the debugger, and as luck would have it, the failing mutex.WaitOne() call was near the beginning of Program::Main() in the C# code [2]. (I mentioned WinMain() and CreateMutex() previously - I was writing that from memory and double-checked it now.) [1] http://www.rohitab.com/apimonitor http://www.rohitab.com/apimonitor [2] https://github.com/geary/wyupdate/blob/master/Program.cs#L40 https://github.com/geary/wyupdate/blob/master/Program.cs#L40
- mccracken 11y ago
  Pragmatic!

joe_the_user 11y ago

Years ago, I would have ended a similar rant with "what we need is designs that just don't do things like autorun and view-attachments-by-default" But now, the "attack surface" has expanded inexorably to the point where the alternative to AV appears to be... none. So this just seems to be the modern Internet, where the average user is more or less at the behest of rackets not much better than the rackets that control botnets if they aren't actually infected by them. I've heard some botnets patch the system and expel other intruders. Yes, now, "everything is free... infection and protection equally". Is there an alternative?

ant6n 11y ago
Don't use Windows
- Moru 11y ago
  That only works until enough people use an alternative. Then it will be interesting to start searching for bugs and security holes in the alternative. Just look at all the webserver exploits lately. Nothing is bugfree.
  - tluyben2 11y ago
    Still works now though so it holds true. However for instance Android is used far more than Windows and iOS is getting close and those are still not close the misery Windows is in this regard.
    - kedean 11y ago
      We don't really have a reliable measure of how many attacks are happening on Android and iOS, though. Unlike with a PC, users are much more likely to attribute malware-related problems to 'my phone is just old, I need a new one'. I would attribute this to a mixture of phone commodification (iPhone's appear to be pretty cheap thanks to subsidy plans) and the effects of cloud infrastructure. Users have basically nothing to lose by swapping out phone hardware, because what'll you do, ransom their contact list?

Springtime 11y ago

Around 2008 or so I seem to remember Kaspersky writing metadata to every file on the OS when scanning, requiring more frequent (and longer) drive defragging. Nowadays I just use Defender on Windows 8, EMET and browser common sense. Occasionally firing up a sandbox for testing programs. Having NoScript enabled alone helps a great deal in preventing many exploits.