9 ms·

Antivirus software could make your company more vulnerable

102 points by r721 11y ago

nikbackm 11y ago
Well, if Microsoft applies their secure programming guidelines also to Windows Defender that might be the best (and default) choice if you're worrying about attacks like these.
deleted 11y ago
[deleted]
- sbarker 11y ago
  How does BitLocker help? It seems like it would just add overhead to your VMs... It also seems like PCoIP would be better then RDP. A firewall is going to do nothing unless it block out-bound traffic.
hiram112 11y ago
I avoided AV software for most of my life. Though, when I worked as a student admin, I would always install AV for the majority of my users. Most users (especially older) simply could never learn not to download that cool new 'freeware' app or game or not double click a downloaded exe (the fact that hidden extensions are still the default on Windows OS is absurd). As a more savvy user, I did not desire the typical AV bloatware (Norton, McAfee, etc) stealing up half my cycles and spinning the hard drive without pause. I knew enough not to try and 'open' resume.doc.exe. However, AV's have trimmed down, SSDs are becoming more common place, and it seems the biggest attack vector is browser based. For the last few years, I've run a few different AVs (Kaspersky, ESET, Bitdefender are decent). I run adblockers, don't install Flash games or Applets, but it is nearly impossible to stop all browser based attacks. I'm not sure the AVs have helped much, but they give some sort of psychological benefit, at least. There really is no good solution anymore unless you're willing to give up 90% of the web (via NoScript or using a primitive console based browser). I believe the future for tech-aware users will be browsers in some sort of container / VM that reset themselves upon each session, with absolutely no control to the file system or data from other sites.
- gtk40 11y ago
  Something like this? https://solutionexchange.vmware.com/store/products/browser-appliance https://solutionexchange.vmware.com/store/products/browser-a...
- ghrifter 11y ago
  >> the fact that hidden extensions are still the default on Windows OS is absurd Is this the case for Apple's OS well (Yosemite or whatever its called nowadays)?
  - reubenmorais 11y ago
    OS X is a UNIX, so file extensions don't matter a whole lot. You can double click a plain Mach-O executable file and it'll run it in a Terminal window. For application bundles (folder with name ending in .app), OS X will warn you if the file was downloaded/not signed by a key trusted by Apple.
    - chc 11y ago
      While it's true that they don't have meaning to the lower levels of the system, file extensions matter a whole lot to the higher-level frameworks and the GUI that ordinary people use.
    - ghrifter 11y ago
      Thanks, as someone who hasn't used a UNIX os since Highschool I am not very familiar with them. As an aside I am thinking about installing a light UNIX distro on my netbook. Win 7 is so painful with only 1GB of RAM. (I love being poor student). Now I got some money so I can either buy a new laptop for $350 or attempt to save some money by installing a light UNIX distro. Problem is, I dont want to learn another OS.
- NetStrikeForce 11y ago
  >> I'm not sure the AVs have helped much, but they give some sort of psychological benefit, at least. I find this a very dangerous way of thinking. You use the placebo (well, not even a placebo, just useless) and then you stop worrying that much about opening downloaded files, checking their hash if you trust the source, visiting dodgy websites... An analogy taken to the extreme, would be to smoke and binge drinking without worries because you're taking homeopathic "solutions" (sic).
johhnnnhyrocko 11y ago
If you guys are looking for a list of some decent AV heres one from this year http://no-adware.com/blog/best-malware-removal-tools-of-2016/ http://no-adware.com/blog/best-malware-removal-tools-of-2016... I am a huge MB fan myself.
- mox1 11y ago
  Mackeeper is listed as #2 on the list you linked to...[1] They aren't exactly a high quality AV product. 1. http://appleinsider.com/articles/15/08/10/mackeeper-to-pay-out-2m-in-proposed-class-action-settlement http://appleinsider.com/articles/15/08/10/mackeeper-to-pay-o...
tptacek 11y ago
Not "could". Does.
- AnimalMuppet 11y ago
  Do you think that AV, on net, makes you less secure? If so, can you provide any data?
  - tptacek 11y ago
    Yes, I do. AV is hairy systems code that hooks the OS in a bunch of places, and IT managers demand that it be very manageable, so it tends to have remote management and reporting UIs. The long and nasty history of RCE flaws, not just horrible stuff like this but subtler stuff buried in the file format parsers, is all the data I feel like I need.
  - drummer32 11y ago
    This[1] is on the very top of the fronpage right now. TrendMicro has a daemon listening on localhost that can execute arbitary commands. [1]https://news.ycombinator.com/item?id=10882563 https://news.ycombinator.com/item?id=10882563
    - AnimalMuppet 11y ago
      Right. (But that's one AV vendor. Others have the same possibility, of course.) But is it still better (more secure) to run without any AV at all? Something like this leaves you vulnerable to that flaw, but no AV leaves you vulnerable to everything (unless a firewall saves you).
      - tptacek 11y ago
        It is better to run with no AV at all.
  - zAy0LfpBZLC8mAC 11y ago
    Yes, unless you are clueless and execute any executable that manages to hop onto your machine. AV is complex code that handles huge amounts of untrusted data, so it's a major increase in attack surface. Also, it cannot work, as it's an instance of blacklist security, which never works. So, no upside, huge potential downside.
mikecb 11y ago
Application whitelisting much more productive.
bitwize 11y ago
Whitelisting is one of the only proven security technologies in a world where you can download and run arbitrary executables. Bit9 should be a requirement on office PCs.
caf 11y ago
...and it also recently introduced HVMI (Hypervisor-based Memory Introspection) technology that completely isolates the antimalware solution by deploying it in a Type 1 hypervisor outside of the operating system. "This kind of isolation separates the antimalware engines from rootkits or exploits running in the user environment," the company said. This completely misses the point. Yes, it protects the AV from exploits in other user software, but it makes exploits in the AV software itself even worse.
scottyates11 11y ago
Personally, I won't trust those AV software which are free but claims themselves have FULL function. There is no free lunch in the world. Sometimes, we make jokes on Qihoo 360, we say itself is already a virus. A lot of pop-ups, consuming computing resources. It is very annoying!
basicplus2 11y ago
Any views on Sofos? I use it to whitelist stuff as requested.. application by application.. seems pretty solid to me.

102 points by r721 11y ago

Well, if Microsoft applies their secure programming guidelines also to Windows Defender that might be the best (and default) choice if you're worrying about attacks like these.

deleted 11y ago

[deleted]

sbarker 11y ago
How does BitLocker help? It seems like it would just add overhead to your VMs... It also seems like PCoIP would be better then RDP. A firewall is going to do nothing unless it block out-bound traffic.

hiram112 11y ago

I avoided AV software for most of my life. Though, when I worked as a student admin, I would always install AV for the majority of my users. Most users (especially older) simply could never learn not to download that cool new 'freeware' app or game or not double click a downloaded exe (the fact that hidden extensions are still the default on Windows OS is absurd). As a more savvy user, I did not desire the typical AV bloatware (Norton, McAfee, etc) stealing up half my cycles and spinning the hard drive without pause. I knew enough not to try and 'open' resume.doc.exe. However, AV's have trimmed down, SSDs are becoming more common place, and it seems the biggest attack vector is browser based. For the last few years, I've run a few different AVs (Kaspersky, ESET, Bitdefender are decent). I run adblockers, don't install Flash games or Applets, but it is nearly impossible to stop all browser based attacks. I'm not sure the AVs have helped much, but they give some sort of psychological benefit, at least. There really is no good solution anymore unless you're willing to give up 90% of the web (via NoScript or using a primitive console based browser). I believe the future for tech-aware users will be browsers in some sort of container / VM that reset themselves upon each session, with absolutely no control to the file system or data from other sites.

gtk40 11y ago
Something like this? https://solutionexchange.vmware.com/store/products/browser-appliance https://solutionexchange.vmware.com/store/products/browser-a...
ghrifter 11y ago
>> the fact that hidden extensions are still the default on Windows OS is absurd Is this the case for Apple's OS well (Yosemite or whatever its called nowadays)?
- reubenmorais 11y ago
  OS X is a UNIX, so file extensions don't matter a whole lot. You can double click a plain Mach-O executable file and it'll run it in a Terminal window. For application bundles (folder with name ending in .app), OS X will warn you if the file was downloaded/not signed by a key trusted by Apple.
  - chc 11y ago
    While it's true that they don't have meaning to the lower levels of the system, file extensions matter a whole lot to the higher-level frameworks and the GUI that ordinary people use.
  - ghrifter 11y ago
    Thanks, as someone who hasn't used a UNIX os since Highschool I am not very familiar with them. As an aside I am thinking about installing a light UNIX distro on my netbook. Win 7 is so painful with only 1GB of RAM. (I love being poor student). Now I got some money so I can either buy a new laptop for $350 or attempt to save some money by installing a light UNIX distro. Problem is, I dont want to learn another OS.
NetStrikeForce 11y ago
>> I'm not sure the AVs have helped much, but they give some sort of psychological benefit, at least. I find this a very dangerous way of thinking. You use the placebo (well, not even a placebo, just useless) and then you stop worrying that much about opening downloaded files, checking their hash if you trust the source, visiting dodgy websites... An analogy taken to the extreme, would be to smoke and binge drinking without worries because you're taking homeopathic "solutions" (sic).

johhnnnhyrocko 11y ago

If you guys are looking for a list of some decent AV heres one from this year http://no-adware.com/blog/best-malware-removal-tools-of-2016/ http://no-adware.com/blog/best-malware-removal-tools-of-2016... I am a huge MB fan myself.

mox1 11y ago
Mackeeper is listed as #2 on the list you linked to...[1] They aren't exactly a high quality AV product. 1. http://appleinsider.com/articles/15/08/10/mackeeper-to-pay-out-2m-in-proposed-class-action-settlement http://appleinsider.com/articles/15/08/10/mackeeper-to-pay-o...

tptacek 11y ago

Not "could". Does.

AnimalMuppet 11y ago
Do you think that AV, on net, makes you less secure? If so, can you provide any data?
- tptacek 11y ago
  Yes, I do. AV is hairy systems code that hooks the OS in a bunch of places, and IT managers demand that it be very manageable, so it tends to have remote management and reporting UIs. The long and nasty history of RCE flaws, not just horrible stuff like this but subtler stuff buried in the file format parsers, is all the data I feel like I need.
- drummer32 11y ago
  This[1] is on the very top of the fronpage right now. TrendMicro has a daemon listening on localhost that can execute arbitary commands. [1]https://news.ycombinator.com/item?id=10882563 https://news.ycombinator.com/item?id=10882563
  - AnimalMuppet 11y ago
    Right. (But that's one AV vendor. Others have the same possibility, of course.) But is it still better (more secure) to run without any AV at all? Something like this leaves you vulnerable to that flaw, but no AV leaves you vulnerable to everything (unless a firewall saves you).
    - tptacek 11y ago
      It is better to run with no AV at all.
- zAy0LfpBZLC8mAC 11y ago
  Yes, unless you are clueless and execute any executable that manages to hop onto your machine. AV is complex code that handles huge amounts of untrusted data, so it's a major increase in attack surface. Also, it cannot work, as it's an instance of blacklist security, which never works. So, no upside, huge potential downside.

mikecb 11y ago

Application whitelisting much more productive.

bitwize 11y ago

Whitelisting is one of the only proven security technologies in a world where you can download and run arbitrary executables. Bit9 should be a requirement on office PCs.

caf 11y ago

...and it also recently introduced HVMI (Hypervisor-based Memory Introspection) technology that completely isolates the antimalware solution by deploying it in a Type 1 hypervisor outside of the operating system. "This kind of isolation separates the antimalware engines from rootkits or exploits running in the user environment," the company said. This completely misses the point. Yes, it protects the AV from exploits in other user software, but it makes exploits in the AV software itself even worse.

scottyates11 11y ago

Personally, I won't trust those AV software which are free but claims themselves have FULL function. There is no free lunch in the world. Sometimes, we make jokes on Qihoo 360, we say itself is already a virus. A lot of pop-ups, consuming computing resources. It is very annoying!

basicplus2 11y ago

Any views on Sofos? I use it to whitelist stuff as requested.. application by application.. seems pretty solid to me.