11 ms·

Avast: a Chromium fork with critical security checks removed

232 points by andygambles 11y ago

willvarfar 11y ago
Why does anyone use any third-party anti-virus programs these days? Why not just use the Microsoft ones that are free?
- lqdc13 11y ago
  You mean security essentials?
- temp 11y ago
  >Why not just use the Microsoft ones that are free? reply For one thing, last time I checked benchmarks they showed that Microsoft's anti-virus not only has worse detection results but also worse performance than some of the free alternatives.
  - infogulch 11y ago
    I am very interested in seeing these benchmarks, as my anecdotal experience is the complete opposite.
    - karyon 11y ago
      On my two machines (with SSDs) I regularly find that copying lots of small files is severely slowed down by Windows Defender. It utilizes one core to the max and when disabling it, the copy operation gets a lot faster. I don't know about other antivirus software though.
      - ferongr 11y ago
        I can mirror this experience too. Properly working Intel SSD fwiw. Mine impacts not only file copys but also all small file I/O like listing directories (explorer would hang for 1 second entering a new directory) and the like.
        versteegen 11y ago
        I've had a couple users complain that my program started running really slowly while they were using Microsoft Security Essentials. It turns out that if a file contains a "suspicious" pattern of bytes (which in these two cases were two different user-drawn bitmaps), SE will do some time consuming heuristics every time you open the file. So opening, reading, closing a file 10 times in a row is really bad.
  - noja 11y ago
    I don't know why this comment is being downvoted. A quick google will show the results. Page 9 of the latest report: http://www.av-comparatives.org/summary-reports/ http://www.av-comparatives.org/summary-reports/
    - cwyers 11y ago
      Yes. Microsoft, alone among AV vendors, shares any signatures it finds with every other major AV vendor, so everyone is going to find everything Microsoft does, plus what their own research turns up. That said, I don't think it matters enough to bother with the problems for-pay anti-virus vendors bring.
      - noja 11y ago
        Did you read the document? The Microsoft product is quite good, but many of the paid ones are better. I don't know what problems you are talking about (I don't have any) - but that's a personal anecdote, we are discussing a proper comparison.
        cwyers 11y ago
        I skimmed it, I didn't see anything I haven't seen before. Notably they aren't grading on stuff like "number of popups that I have to click through to get it to quit nagging me." There's also been privilege elevation exploits using antivirus software. EDIT: And there's anti-virus software that's messing with your system's root certificates so it can MitM all your HTTPS traffic to scan it: http://www.securityweek.com/antivirus-software-has-negative-impact-https-security-researcher http://www.securityweek.com/antivirus-software-has-negative-...
        pilif 11y ago
        > I don't know what problems you are talking about (I don't have any) the glaring security holes opened by them month after month? The HN link you're posting a comment to is about the 5th bad exploit in third-party AV this year alone. So far nothing seems to have been found in the MS built-in one. Installing third-party AV means that you expose yourself to targeted attacks and, if this goes on like it currently does, to drive-by attacks too as by now malware authors must have gotten the hint that searching for vulnerabilities in those various AV products is a very worthwile effort. In general, AV products provide a HUGE attack surface: They don't just need to support natively many more file formats than any other piece of software, they also have to harden their support against exploit code purposefully written to be malicious. And compared to many exploitable user-space applications, these AV products normally run in kernel-space, so an attacker doesn't just gain remote code execution, they gain remote code execution with admin privileges.
  - ryanlol 11y ago
    Yeah, but the detection rates suck for every single AV. Slightly better snake oil is still snake oil.
  - Nutmog 11y ago
    Why is "worse" not OK but "better" is? Neither can be perfect and both will be far better than nothing. Just making up some numbers, but if the Windows AV can detect 80% of viruses and Norton can detect 90%, then you're still vulnerable to that last 10% whatever you do. You're also still protected from the majority of viruses whatever you do too.
- stephengillie 11y ago
  Every antivirus has exploits. Having one installed just opens more doors for attackers to hit your PC.
  - ordinary 11y ago
    It closes some too. Anti-virus software does not have to be perfectly secure (not to be confused with providing perfect detection!). To have a net positive impact on computer security, all anti-virus software has to be is quite literally better than nothing. That's by no means a given, but neither is the opposite: that using anti-virus is by definition worse than not using it.
- untog 11y ago
  For one, because they come preinstalled. I bought a normal Windows laptop for a relative recently, it came with a 30 day trial of McAfee (I think) pre-installed. Once you install any anti-virus, the MS one is automatically disabled, so new users are given the impression that they need to fork out for a subscription once the 30 days is up, or lose virus protection. It's an utter racket.
  - heywire 11y ago
    Even more, Microsoft and the OEMs don't really go out of their way to explain this choice to customers. I work with a senior software engineer who recently came to me for help with his new PC after having purchased the full version of the included anti-virus software. He seemed surprised when I asked why he wouldn't just stick with the built in software from Microsoft. So I sent him a link from Microsoft's site explaining about Windows Firewall and Defender. He later told me he felt stupid for having been convinced that he had to purchase the full version of what came on the system or else he would be unprotected. I think it is Microsoft who is stupid for not pushing this message harder, especially in light of the recent developments such as this one. In some of these cases, we're seeing that by installing a third-party anti-virus suite, you're actually reducing the security of your system. I think Microsoft should be concerned that these companies are actually hurting their reputation further.
    - PeCaN 11y ago
      I assume Microsoft couldn't push their own solution because of the anti-trust restrictions. Now that those have expired, perhaps they could unless they're afraid they'll get lawsuits against them again.
      - sbarre 11y ago
        Is the PC & OS market still as MS-centric as it was back then? I know they still own the majority of the desktop, but with OS X out there, and more fragmentation to mobile, it feels like it would be much much harder to build an anti-trust case against Microsoft.
- anon4 11y ago
  From what people I've talked to have told me - they don't trust Microsoft to secure the OS. Plus, e.g. Comodo gives you a firewall. While I know that Windows has a perfectly good firewall, it doesn't come with a systray icon with a button labeled "protection from active network probes: active" or whatever. Personally, I just have a router between me and the big bad internet and use Security Essentials plus Common Sense 2012.
  - jmnicolas 11y ago
    Warning your Common Sense 2012 is outdated, you should buy the new 2016 version ;-)
- douche 11y ago
  They can't be bothered to do things that are actually effective, like reading installation dialogs fully, installing an ad-blocker, and avoiding the downloads from the sketchiest of porn and torrent sites.
  - untog 11y ago
    It isn't (just) laziness. A friend of mine downloaded Google Chrome because they knew it was a secure browser to use... except that the search result page provided them with a poisoned installed full of malware. If you're not technically inclined there are minefields everywhere.
    - syntheticnature 11y ago
      I bought my father-in-law a new laptop, wiped it and installed it with just what said he needed. Only to watch him say "I want to get vlc," type vlc into Google, skip over the VideoLAN - downloads link, and click some virus-infested link further down because the title of the link was "Get vlc."
      - fixermark 11y ago
        "What's VideoLAN?" ~ The not technically-focused. This is why the scams work.
        marvy 11y ago
        The top result for me is: VideoLAN - Official page for VLC media player, the Open ... The other results are all either directly or almost directly associated with VLC. I get no scam sites in the top 10 results. Have the search results improved? Is this the effect of search personalization? What gives?
        syntheticnature 11y ago
        That was the top result for him, but the problem was it didn't say "VLC" right up front. I believe he grabbed what looks to be the 12th link when I use a private browser, but who knows what search personalization he'd picked up along the way, since he had logged into Google. I know it was at least half-way down.
- 21 11y ago
  I'll give you an interesting example. I was one day coding a keylogger for testing purposes. 100% original C++ code written by me based on Win32 API docs. Compiled and ran the code and immediately Bitdefender blocked the program and put up a "Keylogger detected" message. Microsoft built in antivirus doesn't have this kind of behavioral detection protections.
  - throwaway2048 11y ago
    the reason this is mostly useless is malware writers can do the same test with every AV and just evade the heuristics.
    - 21 11y ago
      It does raise the bar significantly. There are 3-4 ways for system level keyboard monitoring, and all were detected. So a malware writer has to either disable the AV first, or hook individual applications one at a time instead of the whole system (and this exposes it to injection detection heuristics).
  - AnthonyMouse 11y ago
    > Compiled and ran the code and immediately Bitdefender blocked the program and put up a "Keylogger detected" message. Which is quite problematic because it was a false positive. You knew and wanted that program to log key presses. That's the trouble with aggressive heuristics. Users are going to have a program that translates keyboard layouts by hooking the key presses. Or software that comes with some fancy input device. Then the antivirus says it's a keylogger even though they know it isn't and the user is taught to expect good rather than bad things when they press "allow" against a something-is-wrong prompt.
    - fphhotchips 11y ago
      That's not problematic at all. If I want the thing to run, I'll whitelist it and move on. Constant false positives would probably be a bad thing, sure, but any user advanced enough to be installing a keylogger deliberately is probably advanced enough to know the difference. The alternative is that we don't see when a keylogger is being installed non-deliberately, and that would be worse IMO.
- drzaiusapelord 11y ago
  MS Security Essentials detection rates are pretty poor, historically. Considering excellent products like Avast are free for the home user, I don't see why we'd recommend the MS one. To be fair, MS has recognized this and has been steadily improving detection rates. It has only recently been able to outdo Avast or AVG. Hopefully, this trend will continue. I imagine MS is under a lot of pressure to contain the Cryptolocker-type infections and the bad press of the past couple years is probably a motivator. http://www.alphr.com/security/6745/best-free-antivirus-of-2016-this-is-the-best-free-internet-security-software-you-can http://www.alphr.com/security/6745/best-free-antivirus-of-20...
  - ubercow13 11y ago
    >excellent products like Avast Isn't this claim somewhat refuted by the very article you are posting against? There are other comments in this thread that explain why this doesn't make any sense eg pilif's above[1] [1] https://news.ycombinator.com/item?id=11058688 https://news.ycombinator.com/item?id=11058688
    - drzaiusapelord 11y ago
      They both have detection rates in the high 90s, which is considered excellent, in general, and certainly so for a no-cost product. MSE only just edged out Avast. The comment you listed cites nothing, not sure why its so authoritative to you. All software has vulnerabilities, but where's the big attack on AV? What CVEs are we seeing in the wild, if any?
AdmiralAsshat 11y ago
You ever noticed that these "secure" forks of browsers put out by antivirus companies are usually security trainwrecks? cf: "Chromodo" and the vulnerabilities disclosed by this same researcher[0] [0] https://code.google.com/p/google-security-research/issues/detail?id=704 https://code.google.com/p/google-security-research/issues/de... EDIT: And let's not forget TrendMicro's recent blunder with the enabled-by-default HTTP server for "Password Manager" that is installed as part of their antivirus program.[1] [1] https://code.google.com/p/google-security-research/issues/detail?id=693 https://code.google.com/p/google-security-research/issues/de...
- mrweasel 11y ago
  Which makes you wonder about the quality of the products they develop 100% in-house. In the case of the browsers, it "only" the bits they tampered with that's more insecure. For their own stuff, anti-virus, firewall and what not, they've "tampered" with the entire code base.
  - jacquesm 11y ago
    Worse still, that stuff hooks into you OS at just about every level.
  - jpgvm 11y ago
    In my experience non-OSS security software is not worth having. There are some exceptions but they are exactly that, exceptions. More often then not by installing this garbage you are putting yourself in a worse position than not having it at all.
    - georgemcbay 11y ago
      The (closed-source) security software Microsoft ships with modern Windows is quite good. I don't think OSS/non-OSS is the real dividing line, but rather motivation of the vendor is. In the case of Microsoft, their motivation is to make Windows work better, in the case of OSS the motivation is often to scratch personal itches, both of these motivations trend towards positive results. In the case of 3rd party security software vendors, their motivation is usually to upsell you from whatever version you are using to a higher level of "security", so it is in their best interest to go nuts with false positive reports (eg. finding some browser cookies in a scan, posting up such severe looking warnings that you'd think your system is rooted), bog your system down, etc.
sarciszewski 11y ago
http://www.sevagas.com/IMG/pdf/BypassAVDynamics.pdf http://www.sevagas.com/IMG/pdf/BypassAVDynamics.pdf Anti-Virus is little more than snake oil. If you need to secure a Windows box, get EMET and read http://decentsecurity.com http://decentsecurity.com and you'll eliminate most of your attack surface. Everyone can be secure. It is with those four words this website is founded. Computer, smartphone, and online security does not require a degree or years of experience. All it requires is someone show you the way. You've been sold a lie. You can't buy computer security. It is something obtained through configuration and knowledge. Tragically, these aren't even hard to do or obscure to learn. But no one makes money telling you how to use what you already have. What you need is someone who doesn't care about your money or looking smart by spouting off fancy words of no consequence - just that you not be a victim. It pains me to see people who distrust and fear their computers, and who feel powerless in that fear. Because that's not what I see when I look at computers and phones and websites. I see tools I trust with the story of my life, and the secrets I leave out when I tell that story to others. Everyone should be able to feel like that. This site does not sell anything. This site does not take donations. This site has no one's name on it. This site is to fix what is broken. Which is how we teach security. If you were wondering because it looked familiar, it's run by the same person behind @SwiftOnSecurity.
- deleted 11y ago
  [deleted]
- sanderjd 11y ago
  > You can't buy computer security. It is something obtained through configuration and knowledge. Tragically, I believe this is true. But it isn't a great and noble thing that people must gain knowledge to overcome their powerless fear of computer technology, it is a failure of technology creators to provide people with simple tools that they can use without fear. The problem isn't how we teach security, because hardly anybody should have to learn security in the first place. That the mainstream public is even aware of a concern called "security" having to do with their computing tools is already a failure. I can't think of any other mainstream products that people have to be so careful with, where they are told it is their fault that they just haven't gained the expertise necessary to use it without problems.
roddux 11y ago
I advise my techie and non-techie friends alike not to bother with antivirus, but rather to ensure that their files are backed up and their software is up to date. Those are the most important parts, assuming the user is above the level of downloading and executing malware by themselves.
- RIMR 11y ago
  I would recommend using a business-class antivirus rather than the consumer editions. Also, don't use their browser plugins if offered. At least that protects you from theft. I can keep all my files backed up, but that doesn't protect the data in them from being compromised. If anything, you need to start recommending encryption to your friends if they aren't going to use an Antivirus.
  - ceejayoz 11y ago
    It's highly likely that "business-class" antivirus is the same code sold at 100x the price. It's also highly unlikely that the teams putting out shitty consumer-facing antivirus magically write awesome code for the enterprise versions.
    - schwap 11y ago
      Generally the AV engine will be the same, but the management tools are more corporate-friendly (remote management and group policies, etc.)
  - Karunamon 11y ago
    Antivirus nowadays only tells you that you're already screwed, rather than preventing it from happening. The nastiest of the nasty stuff that's going to log keys, steal info, and so on, tends to be zero days. And after that article that showed how dismal the design of the popular antivirus apps is, there's an argument to be made that using them reduces your security.
  - busterarm 11y ago
    I used to work for an antivirus vendor and I would not recommend this. The antivirus engine is the same and the only differences are how it's packaged. They're still shoveling obtrusive, crap software onto your system, just being less obvious about it. The only reason to have Symantec Corporate Edition Antivirus installed on your system is because your company signed a deal to use Cisco VPN & Endpoint Protection and you're literally forced to use it. What mostly everyone fails to understand is that antivirus software is not effective as a _preventative_ measure. What they are good at is detecting that you're already infected, but they all have terrible rates of false-positives. Nothing out there is much effective at protecting you from 0-day, despite industry claims to the contrary. User training/habit modification is the only effective measure at preventing infection (besides being behind a default-deny firewall, but that's not something consumers will do). 99.9999% of infections require user interaction (and the ones that don't require it become instant international news). Adblockers get you most of the way there and do a better job at prevention than antivirus software. Flaws in AV software have been exploited by rootkits before. AV software is just another point of failure.
helper 11y ago
Tavis is beast when comes to finding these exploits. Its always fun reading his write ups.
- komaromy 11y ago
  I get more excitement from seeing his avatar in my Twitter timeline than any other.
ep103 11y ago
Aw, I got all excited that someone had actually made a Chromium fork with basic things, like JS's script security context completely ripped out. No HTTPs validity checking, etc.
jhspaybar 11y ago
Aren't these sorts of zero days worth a LOT of money? He didn't go all the way to RCE, but he probably could have gotten there. It makes you wonder how many people are out there with Tavis' skills who just farm these things and sell them to the highest bidder instead of making us safer.
- sarciszewski 11y ago
  Fortunately there aren't many with Tavis's skills, but you don't need to be that legendary to find these sort of vulnerabilities. Assuming you can identify (skill) and safely sell (anonymity expertise and market savvy) a zero day, the demand for them is quite limited. (The only reason the price is so high is that the supply is just even lower.) Additionally, if you have the market savvy to extract the maximum value for a 0day, you will quickly realize the feast-or-famine nature of unsavory income isn't great for a stable home life. You might eventually want a day job, and you can't exactly say "Oh, I helped that virus penetrate your network three years ago that you just detected last month." So most people with Tavis's skill levels typically aren't in a hurry to go rogue. And the ones that do are more interested in compromising bitcoin exchanges and drug marketplaces on Tor Hidden Services than they are in spreading malware to end users. (That's the advertising industry's shtick.)
- TACIXAT 11y ago
  Yea, I'd also have to say very few. A researcher of that skill level is pulling a very comfortable salary. A lot of the work that comes with that salary requires you to have an above board reputation. If a company is hiring you (or your parent company) to find vulnerabilities in their product, they need to be sure you don't have a conflict of interest.
ambrop7 11y ago
My machine is running CUPS on 127.0.0.1:631 (the local HTTP interface). Does this mean any web site can print with my printer?
- mey 11y ago
  Potentially depending on how it is secured (if it is), but it warrants further investigation.
smcnally 11y ago
Interesting posts from Avast explaining how they supply data to their marketing analytics product from their AntiVirus products: https://forum.avast.com/index.php?topic=171725.0 https://forum.avast.com/index.php?topic=171725.0 https://blog.avast.com/2015/05/29/avast-data-drives-new-analytics-engine/ https://blog.avast.com/2015/05/29/avast-data-drives-new-anal...

232 points by andygambles 11y ago

willvarfar 11y ago

Why does anyone use any third-party anti-virus programs these days? Why not just use the Microsoft ones that are free?

lqdc13 11y ago
You mean security essentials?
temp 11y ago
>Why not just use the Microsoft ones that are free? reply For one thing, last time I checked benchmarks they showed that Microsoft's anti-virus not only has worse detection results but also worse performance than some of the free alternatives.
- infogulch 11y ago
  I am very interested in seeing these benchmarks, as my anecdotal experience is the complete opposite.
  - karyon 11y ago
    On my two machines (with SSDs) I regularly find that copying lots of small files is severely slowed down by Windows Defender. It utilizes one core to the max and when disabling it, the copy operation gets a lot faster. I don't know about other antivirus software though.
    - ferongr 11y ago
      I can mirror this experience too. Properly working Intel SSD fwiw. Mine impacts not only file copys but also all small file I/O like listing directories (explorer would hang for 1 second entering a new directory) and the like.
      - versteegen 11y ago
        I've had a couple users complain that my program started running really slowly while they were using Microsoft Security Essentials. It turns out that if a file contains a "suspicious" pattern of bytes (which in these two cases were two different user-drawn bitmaps), SE will do some time consuming heuristics every time you open the file. So opening, reading, closing a file 10 times in a row is really bad.
- noja 11y ago
  I don't know why this comment is being downvoted. A quick google will show the results. Page 9 of the latest report: http://www.av-comparatives.org/summary-reports/ http://www.av-comparatives.org/summary-reports/
  - cwyers 11y ago
    Yes. Microsoft, alone among AV vendors, shares any signatures it finds with every other major AV vendor, so everyone is going to find everything Microsoft does, plus what their own research turns up. That said, I don't think it matters enough to bother with the problems for-pay anti-virus vendors bring.
    - noja 11y ago
      Did you read the document? The Microsoft product is quite good, but many of the paid ones are better. I don't know what problems you are talking about (I don't have any) - but that's a personal anecdote, we are discussing a proper comparison.
      - cwyers 11y ago
        I skimmed it, I didn't see anything I haven't seen before. Notably they aren't grading on stuff like "number of popups that I have to click through to get it to quit nagging me." There's also been privilege elevation exploits using antivirus software. EDIT: And there's anti-virus software that's messing with your system's root certificates so it can MitM all your HTTPS traffic to scan it: http://www.securityweek.com/antivirus-software-has-negative-impact-https-security-researcher http://www.securityweek.com/antivirus-software-has-negative-...
      - pilif 11y ago
        > I don't know what problems you are talking about (I don't have any) the glaring security holes opened by them month after month? The HN link you're posting a comment to is about the 5th bad exploit in third-party AV this year alone. So far nothing seems to have been found in the MS built-in one. Installing third-party AV means that you expose yourself to targeted attacks and, if this goes on like it currently does, to drive-by attacks too as by now malware authors must have gotten the hint that searching for vulnerabilities in those various AV products is a very worthwile effort. In general, AV products provide a HUGE attack surface: They don't just need to support natively many more file formats than any other piece of software, they also have to harden their support against exploit code purposefully written to be malicious. And compared to many exploitable user-space applications, these AV products normally run in kernel-space, so an attacker doesn't just gain remote code execution, they gain remote code execution with admin privileges.
- ryanlol 11y ago
  Yeah, but the detection rates suck for every single AV. Slightly better snake oil is still snake oil.
- Nutmog 11y ago
  Why is "worse" not OK but "better" is? Neither can be perfect and both will be far better than nothing. Just making up some numbers, but if the Windows AV can detect 80% of viruses and Norton can detect 90%, then you're still vulnerable to that last 10% whatever you do. You're also still protected from the majority of viruses whatever you do too.
stephengillie 11y ago
Every antivirus has exploits. Having one installed just opens more doors for attackers to hit your PC.
- ordinary 11y ago
  It closes some too. Anti-virus software does not have to be perfectly secure (not to be confused with providing perfect detection!). To have a net positive impact on computer security, all anti-virus software has to be is quite literally better than nothing. That's by no means a given, but neither is the opposite: that using anti-virus is by definition worse than not using it.
untog 11y ago
For one, because they come preinstalled. I bought a normal Windows laptop for a relative recently, it came with a 30 day trial of McAfee (I think) pre-installed. Once you install any anti-virus, the MS one is automatically disabled, so new users are given the impression that they need to fork out for a subscription once the 30 days is up, or lose virus protection. It's an utter racket.
- heywire 11y ago
  Even more, Microsoft and the OEMs don't really go out of their way to explain this choice to customers. I work with a senior software engineer who recently came to me for help with his new PC after having purchased the full version of the included anti-virus software. He seemed surprised when I asked why he wouldn't just stick with the built in software from Microsoft. So I sent him a link from Microsoft's site explaining about Windows Firewall and Defender. He later told me he felt stupid for having been convinced that he had to purchase the full version of what came on the system or else he would be unprotected. I think it is Microsoft who is stupid for not pushing this message harder, especially in light of the recent developments such as this one. In some of these cases, we're seeing that by installing a third-party anti-virus suite, you're actually reducing the security of your system. I think Microsoft should be concerned that these companies are actually hurting their reputation further.
  - PeCaN 11y ago
    I assume Microsoft couldn't push their own solution because of the anti-trust restrictions. Now that those have expired, perhaps they could unless they're afraid they'll get lawsuits against them again.
    - sbarre 11y ago
      Is the PC & OS market still as MS-centric as it was back then? I know they still own the majority of the desktop, but with OS X out there, and more fragmentation to mobile, it feels like it would be much much harder to build an anti-trust case against Microsoft.
anon4 11y ago
From what people I've talked to have told me - they don't trust Microsoft to secure the OS. Plus, e.g. Comodo gives you a firewall. While I know that Windows has a perfectly good firewall, it doesn't come with a systray icon with a button labeled "protection from active network probes: active" or whatever. Personally, I just have a router between me and the big bad internet and use Security Essentials plus Common Sense 2012.
- jmnicolas 11y ago
  Warning your Common Sense 2012 is outdated, you should buy the new 2016 version ;-)
douche 11y ago
They can't be bothered to do things that are actually effective, like reading installation dialogs fully, installing an ad-blocker, and avoiding the downloads from the sketchiest of porn and torrent sites.
- untog 11y ago
  It isn't (just) laziness. A friend of mine downloaded Google Chrome because they knew it was a secure browser to use... except that the search result page provided them with a poisoned installed full of malware. If you're not technically inclined there are minefields everywhere.
  - syntheticnature 11y ago
    I bought my father-in-law a new laptop, wiped it and installed it with just what said he needed. Only to watch him say "I want to get vlc," type vlc into Google, skip over the VideoLAN - downloads link, and click some virus-infested link further down because the title of the link was "Get vlc."
    - fixermark 11y ago
      "What's VideoLAN?" ~ The not technically-focused. This is why the scams work.
      - marvy 11y ago
        The top result for me is: VideoLAN - Official page for VLC media player, the Open ... The other results are all either directly or almost directly associated with VLC. I get no scam sites in the top 10 results. Have the search results improved? Is this the effect of search personalization? What gives?
        syntheticnature 11y ago
        That was the top result for him, but the problem was it didn't say "VLC" right up front. I believe he grabbed what looks to be the 12th link when I use a private browser, but who knows what search personalization he'd picked up along the way, since he had logged into Google. I know it was at least half-way down.
21 11y ago
I'll give you an interesting example. I was one day coding a keylogger for testing purposes. 100% original C++ code written by me based on Win32 API docs. Compiled and ran the code and immediately Bitdefender blocked the program and put up a "Keylogger detected" message. Microsoft built in antivirus doesn't have this kind of behavioral detection protections.
- throwaway2048 11y ago
  the reason this is mostly useless is malware writers can do the same test with every AV and just evade the heuristics.
  - 21 11y ago
    It does raise the bar significantly. There are 3-4 ways for system level keyboard monitoring, and all were detected. So a malware writer has to either disable the AV first, or hook individual applications one at a time instead of the whole system (and this exposes it to injection detection heuristics).
- AnthonyMouse 11y ago
  > Compiled and ran the code and immediately Bitdefender blocked the program and put up a "Keylogger detected" message. Which is quite problematic because it was a false positive. You knew and wanted that program to log key presses. That's the trouble with aggressive heuristics. Users are going to have a program that translates keyboard layouts by hooking the key presses. Or software that comes with some fancy input device. Then the antivirus says it's a keylogger even though they know it isn't and the user is taught to expect good rather than bad things when they press "allow" against a something-is-wrong prompt.
  - fphhotchips 11y ago
    That's not problematic at all. If I want the thing to run, I'll whitelist it and move on. Constant false positives would probably be a bad thing, sure, but any user advanced enough to be installing a keylogger deliberately is probably advanced enough to know the difference. The alternative is that we don't see when a keylogger is being installed non-deliberately, and that would be worse IMO.
drzaiusapelord 11y ago
MS Security Essentials detection rates are pretty poor, historically. Considering excellent products like Avast are free for the home user, I don't see why we'd recommend the MS one. To be fair, MS has recognized this and has been steadily improving detection rates. It has only recently been able to outdo Avast or AVG. Hopefully, this trend will continue. I imagine MS is under a lot of pressure to contain the Cryptolocker-type infections and the bad press of the past couple years is probably a motivator. http://www.alphr.com/security/6745/best-free-antivirus-of-2016-this-is-the-best-free-internet-security-software-you-can http://www.alphr.com/security/6745/best-free-antivirus-of-20...
- ubercow13 11y ago
  >excellent products like Avast Isn't this claim somewhat refuted by the very article you are posting against? There are other comments in this thread that explain why this doesn't make any sense eg pilif's above[1] [1] https://news.ycombinator.com/item?id=11058688 https://news.ycombinator.com/item?id=11058688
  - drzaiusapelord 11y ago
    They both have detection rates in the high 90s, which is considered excellent, in general, and certainly so for a no-cost product. MSE only just edged out Avast. The comment you listed cites nothing, not sure why its so authoritative to you. All software has vulnerabilities, but where's the big attack on AV? What CVEs are we seeing in the wild, if any?

AdmiralAsshat 11y ago

You ever noticed that these "secure" forks of browsers put out by antivirus companies are usually security trainwrecks? cf: "Chromodo" and the vulnerabilities disclosed by this same researcher[0] [0] https://code.google.com/p/google-security-research/issues/detail?id=704 https://code.google.com/p/google-security-research/issues/de... EDIT: And let's not forget TrendMicro's recent blunder with the enabled-by-default HTTP server for "Password Manager" that is installed as part of their antivirus program.[1] [1] https://code.google.com/p/google-security-research/issues/detail?id=693 https://code.google.com/p/google-security-research/issues/de...

mrweasel 11y ago
Which makes you wonder about the quality of the products they develop 100% in-house. In the case of the browsers, it "only" the bits they tampered with that's more insecure. For their own stuff, anti-virus, firewall and what not, they've "tampered" with the entire code base.
- jacquesm 11y ago
  Worse still, that stuff hooks into you OS at just about every level.
- jpgvm 11y ago
  In my experience non-OSS security software is not worth having. There are some exceptions but they are exactly that, exceptions. More often then not by installing this garbage you are putting yourself in a worse position than not having it at all.
  - georgemcbay 11y ago
    The (closed-source) security software Microsoft ships with modern Windows is quite good. I don't think OSS/non-OSS is the real dividing line, but rather motivation of the vendor is. In the case of Microsoft, their motivation is to make Windows work better, in the case of OSS the motivation is often to scratch personal itches, both of these motivations trend towards positive results. In the case of 3rd party security software vendors, their motivation is usually to upsell you from whatever version you are using to a higher level of "security", so it is in their best interest to go nuts with false positive reports (eg. finding some browser cookies in a scan, posting up such severe looking warnings that you'd think your system is rooted), bog your system down, etc.

sarciszewski 11y ago

http://www.sevagas.com/IMG/pdf/BypassAVDynamics.pdf http://www.sevagas.com/IMG/pdf/BypassAVDynamics.pdf Anti-Virus is little more than snake oil. If you need to secure a Windows box, get EMET and read http://decentsecurity.com http://decentsecurity.com and you'll eliminate most of your attack surface. Everyone can be secure. It is with those four words this website is founded. Computer, smartphone, and online security does not require a degree or years of experience. All it requires is someone show you the way. You've been sold a lie. You can't buy computer security. It is something obtained through configuration and knowledge. Tragically, these aren't even hard to do or obscure to learn. But no one makes money telling you how to use what you already have. What you need is someone who doesn't care about your money or looking smart by spouting off fancy words of no consequence - just that you not be a victim. It pains me to see people who distrust and fear their computers, and who feel powerless in that fear. Because that's not what I see when I look at computers and phones and websites. I see tools I trust with the story of my life, and the secrets I leave out when I tell that story to others. Everyone should be able to feel like that. This site does not sell anything. This site does not take donations. This site has no one's name on it. This site is to fix what is broken. Which is how we teach security. If you were wondering because it looked familiar, it's run by the same person behind @SwiftOnSecurity.

deleted 11y ago
[deleted]
sanderjd 11y ago
> You can't buy computer security. It is something obtained through configuration and knowledge. Tragically, I believe this is true. But it isn't a great and noble thing that people must gain knowledge to overcome their powerless fear of computer technology, it is a failure of technology creators to provide people with simple tools that they can use without fear. The problem isn't how we teach security, because hardly anybody should have to learn security in the first place. That the mainstream public is even aware of a concern called "security" having to do with their computing tools is already a failure. I can't think of any other mainstream products that people have to be so careful with, where they are told it is their fault that they just haven't gained the expertise necessary to use it without problems.

roddux 11y ago

I advise my techie and non-techie friends alike not to bother with antivirus, but rather to ensure that their files are backed up and their software is up to date. Those are the most important parts, assuming the user is above the level of downloading and executing malware by themselves.

RIMR 11y ago
I would recommend using a business-class antivirus rather than the consumer editions. Also, don't use their browser plugins if offered. At least that protects you from theft. I can keep all my files backed up, but that doesn't protect the data in them from being compromised. If anything, you need to start recommending encryption to your friends if they aren't going to use an Antivirus.
- ceejayoz 11y ago
  It's highly likely that "business-class" antivirus is the same code sold at 100x the price. It's also highly unlikely that the teams putting out shitty consumer-facing antivirus magically write awesome code for the enterprise versions.
  - schwap 11y ago
    Generally the AV engine will be the same, but the management tools are more corporate-friendly (remote management and group policies, etc.)
- Karunamon 11y ago
  Antivirus nowadays only tells you that you're already screwed, rather than preventing it from happening. The nastiest of the nasty stuff that's going to log keys, steal info, and so on, tends to be zero days. And after that article that showed how dismal the design of the popular antivirus apps is, there's an argument to be made that using them reduces your security.
- busterarm 11y ago
  I used to work for an antivirus vendor and I would not recommend this. The antivirus engine is the same and the only differences are how it's packaged. They're still shoveling obtrusive, crap software onto your system, just being less obvious about it. The only reason to have Symantec Corporate Edition Antivirus installed on your system is because your company signed a deal to use Cisco VPN & Endpoint Protection and you're literally forced to use it. What mostly everyone fails to understand is that antivirus software is not effective as a _preventative_ measure. What they are good at is detecting that you're already infected, but they all have terrible rates of false-positives. Nothing out there is much effective at protecting you from 0-day, despite industry claims to the contrary. User training/habit modification is the only effective measure at preventing infection (besides being behind a default-deny firewall, but that's not something consumers will do). 99.9999% of infections require user interaction (and the ones that don't require it become instant international news). Adblockers get you most of the way there and do a better job at prevention than antivirus software. Flaws in AV software have been exploited by rootkits before. AV software is just another point of failure.

helper 11y ago

Tavis is beast when comes to finding these exploits. Its always fun reading his write ups.

komaromy 11y ago
I get more excitement from seeing his avatar in my Twitter timeline than any other.

ep103 11y ago

Aw, I got all excited that someone had actually made a Chromium fork with basic things, like JS's script security context completely ripped out. No HTTPs validity checking, etc.

jhspaybar 11y ago

Aren't these sorts of zero days worth a LOT of money? He didn't go all the way to RCE, but he probably could have gotten there. It makes you wonder how many people are out there with Tavis' skills who just farm these things and sell them to the highest bidder instead of making us safer.

sarciszewski 11y ago
Fortunately there aren't many with Tavis's skills, but you don't need to be that legendary to find these sort of vulnerabilities. Assuming you can identify (skill) and safely sell (anonymity expertise and market savvy) a zero day, the demand for them is quite limited. (The only reason the price is so high is that the supply is just even lower.) Additionally, if you have the market savvy to extract the maximum value for a 0day, you will quickly realize the feast-or-famine nature of unsavory income isn't great for a stable home life. You might eventually want a day job, and you can't exactly say "Oh, I helped that virus penetrate your network three years ago that you just detected last month." So most people with Tavis's skill levels typically aren't in a hurry to go rogue. And the ones that do are more interested in compromising bitcoin exchanges and drug marketplaces on Tor Hidden Services than they are in spreading malware to end users. (That's the advertising industry's shtick.)
TACIXAT 11y ago
Yea, I'd also have to say very few. A researcher of that skill level is pulling a very comfortable salary. A lot of the work that comes with that salary requires you to have an above board reputation. If a company is hiring you (or your parent company) to find vulnerabilities in their product, they need to be sure you don't have a conflict of interest.

ambrop7 11y ago

My machine is running CUPS on 127.0.0.1:631 (the local HTTP interface). Does this mean any web site can print with my printer?

mey 11y ago
Potentially depending on how it is secured (if it is), but it warrants further investigation.

smcnally 11y ago

Interesting posts from Avast explaining how they supply data to their marketing analytics product from their AntiVirus products: https://forum.avast.com/index.php?topic=171725.0 https://forum.avast.com/index.php?topic=171725.0 https://blog.avast.com/2015/05/29/avast-data-drives-new-analytics-engine/ https://blog.avast.com/2015/05/29/avast-data-drives-new-anal...