5 ms·

It's high time some of these compliance groups got together and had a good hard look at themselves. It's been years since desktop signature-based antivirus pro

It's high time some of these compliance groups got together and had a good hard look at themselves. It's been years since desktop signature-based antivirus provided a significant improvement to security. Every time there's a cryptolocker outbreak, I see people scrambling to make decisions like "we need to replace McAfee with Kaspersky", as though they feel that's their answer. When you try telling an insurance auditor "we have a whitelisting application, nothing runs unless I've approved it, products like Symantec Endpoint are unnecessary in that environment", you first get a confused look, then you hear "ok, so you're DON'T meet the minimum basic security requirements, let me write that down". It's gotten to a point that it's actively part of Intel Security's advertising, with a recent partner promotion pushing to "help your clients meet their compliancy requirements". The brochure never even mentioned actually securing anything, just how it ticked various boxes.

godzillabrennus 10y ago
Http://www.bromium.com is a new take on security providing full sandboxes for applications.
- lstamour 10y ago
  Having heard of Sandboxie as well, this whitepaper was interesting, see link at https://labs.bromium.com/2013/07/23/application-sandboxes-a-pen-testers-perspective/ https://labs.bromium.com/2013/07/23/application-sandboxes-a-... See also: https://news.ycombinator.com/item?id=8257250 https://news.ycombinator.com/item?id=8257250 (DrawBridge & commentary) Oh and the follow-up in the comments: (Regarding Sandboxie reconfiguration mitigating some of the attacks) > I tested with SBIE4 and indeed it is quite different and has security improvements over what we tested in our report. Great job by the author! > However, our kernel exploits still work flawlessly – no issues there. You need to remember that SBIE3/4 (and other similar app sandboxes) are kernel mode drivers and they will always have some fundamental limitations. Blocking access to specific DLL’s is far from a practical use case as you have no idea where the next patch is going to come (BTW similar capability has been available in HIPS technology for several years and very few people use it) > Once time permits, we’ll probably update our analysis with the latest SBIE4. However, this is not our core focus, the idea of this research was to simply enumerate the fundamental limitations of application sandboxing tech. If you've read this far, you might also be interested in other Bromium research: https://labs.bromium.com/category/research/ https://labs.bromium.com/category/research/ Of course, folks might be first in line to point out that nothing's perfect, and user-error can get around a lot of security... Nobody would argue sandboxing is an excuse to not patch systems, except with antivirus you might increase your attack surface while trying to detect attacks with something that can't be easily circumvented. Trade-offs. Can you trust sandboxing to prevent damage from malware or do you need some kind of warning that something strange is going on?
Dagwoodie 10y ago
You touch on a rather huge issue in the industry. So many IT companies out there are hiring one or two (if they're lucky) "Security Professionals" that are responsible from endpoint security, to managing the SIEM to digging deep into every popcorn noise that their IDS/IPS makes. There's a lot of boxes to check and there's nothing like hiring one poor soul to check them all in the name of compliance, while their board (Who reluctantly hired the poor guy or gal) is deeply shrouded inside a false sense of "Hey we are HIPAA compliant for another year!" security.
vacri 10y ago
When I was first getting into IT, I was trying to configure a low-end 'soho' cisco modem. It had a java-app webpage for configuration... which only ran on windows/IE (couldn't be forced to load elsewhere), was missing two-thirds of the device's capabilities, and was just generally awful. I asked a netadmin friend for some advice, and he said "Oh, that thing is just there to tick boxes - no techie would ever use it. 'Does it have a GUI configurator?' -> box ticked". Meanwhile the techies just configured the modem like any other bit of cisco equipment: via the console.
nihonde 10y ago
As a lawyer who deals with contracts, one of my major pet peeves is the stupid warranty that requires a party to use "industry-standard virus detection software". I'm fairly certain that none of the lawyers who insist on that language know anything about IT security.
pilif 10y ago
This is actually a real problem we need public perception changed. If you have proper white-listing in place then AV does nothing but actually decrease the security as these AV programs probably need to be white-listed and thus expose the machines to the kinds of issues as shown here. Unless the compliance auditors are happy with the software just being installed and don't check whether it actually runs. That would still be a colossal waste of money for the licenses but at least it would not compromise your security.
- wmt 10y ago
  It's a really sad truth that to this date the only effective way to almost fully stop malware is to take away the ability from people to do what they want with their computers. All operating systems that have some way to allow people to run malware, will get malware. Windows, OSX, GNU, Android all can get infected quite easily. Then there's iOS where you cannot, and instead Apple decides which software you can or cannot run. The downside is of course that you cannot run any software going against the corporate values of Apple. If you want the right to shoot yourself in the foot, AV is the necessary evil you must have, unless of course you're sure you'll never visit a website that contains an exploit, old or zeroday, against you browser or its components, and you will never open a office document, PDF or executable that has malware in it. And even then you can get owned.
  - lima 10y ago
    > If you want the right to shoot yourself in the foot, AV is the necessary evil you must have No. AVs are actually pretty useless at stopping anything except the most basic attacks (and sometimes, not even that - just look at Cryptolocker). Use Google Chrome (really! Firefox isn't even playing in the same league security-wise), disable Flash player, only run trusted executables with valid digital signatures.
    - wmt 10y ago
      The only tests against real malware out there I've seen are done by AV-Test and AV-Comparatives, and the top products are pretty good at blocking them. Calling them useless sounds more like your hopes than facts, like calling seatbelts useless because people die in car accidents. Uninstalling Flash, Adobe reader, Office and JRE, and using Chrome with adblock also helps you enormously, but is still a far cry for any user having difficulties with finding the download-button from sourceforge. Getting a signing cert is easy as just buying one from Honest Achmed's Used Cars and Certificates, so the only real use for signed software with malware protection is to manually maintain your own list of trusted signers.
Ntrails 10y ago
I don't think we have any antivirus on our work computers. It works out ok because, after all, we don't have internet either. It's amazing how hard it is to run a malicious executable when you can't get them onto your computer... (of course I've no doubt there are plenty of people smart enough to write their own but that's not the concern)
- jjawssd 10y ago
  Disconnecting externally-facing USB ports from the motherboard also helps a lot
  - Ntrails 10y ago
    Our thin clients are locked down in cages, I think the ports are locked anyway, and you'd struggle to get any hardware into the office. I just don't see any accidental options.

godzillabrennus 10y ago

Http://www.bromium.com is a new take on security providing full sandboxes for applications.

lstamour 10y ago
Having heard of Sandboxie as well, this whitepaper was interesting, see link at https://labs.bromium.com/2013/07/23/application-sandboxes-a-pen-testers-perspective/ https://labs.bromium.com/2013/07/23/application-sandboxes-a-... See also: https://news.ycombinator.com/item?id=8257250 https://news.ycombinator.com/item?id=8257250 (DrawBridge & commentary) Oh and the follow-up in the comments: (Regarding Sandboxie reconfiguration mitigating some of the attacks) > I tested with SBIE4 and indeed it is quite different and has security improvements over what we tested in our report. Great job by the author! > However, our kernel exploits still work flawlessly – no issues there. You need to remember that SBIE3/4 (and other similar app sandboxes) are kernel mode drivers and they will always have some fundamental limitations. Blocking access to specific DLL’s is far from a practical use case as you have no idea where the next patch is going to come (BTW similar capability has been available in HIPS technology for several years and very few people use it) > Once time permits, we’ll probably update our analysis with the latest SBIE4. However, this is not our core focus, the idea of this research was to simply enumerate the fundamental limitations of application sandboxing tech. If you've read this far, you might also be interested in other Bromium research: https://labs.bromium.com/category/research/ https://labs.bromium.com/category/research/ Of course, folks might be first in line to point out that nothing's perfect, and user-error can get around a lot of security... Nobody would argue sandboxing is an excuse to not patch systems, except with antivirus you might increase your attack surface while trying to detect attacks with something that can't be easily circumvented. Trade-offs. Can you trust sandboxing to prevent damage from malware or do you need some kind of warning that something strange is going on?

Dagwoodie 10y ago

You touch on a rather huge issue in the industry. So many IT companies out there are hiring one or two (if they're lucky) "Security Professionals" that are responsible from endpoint security, to managing the SIEM to digging deep into every popcorn noise that their IDS/IPS makes. There's a lot of boxes to check and there's nothing like hiring one poor soul to check them all in the name of compliance, while their board (Who reluctantly hired the poor guy or gal) is deeply shrouded inside a false sense of "Hey we are HIPAA compliant for another year!" security.

vacri 10y ago

When I was first getting into IT, I was trying to configure a low-end 'soho' cisco modem. It had a java-app webpage for configuration... which only ran on windows/IE (couldn't be forced to load elsewhere), was missing two-thirds of the device's capabilities, and was just generally awful. I asked a netadmin friend for some advice, and he said "Oh, that thing is just there to tick boxes - no techie would ever use it. 'Does it have a GUI configurator?' -> box ticked". Meanwhile the techies just configured the modem like any other bit of cisco equipment: via the console.

nihonde 10y ago

As a lawyer who deals with contracts, one of my major pet peeves is the stupid warranty that requires a party to use "industry-standard virus detection software". I'm fairly certain that none of the lawyers who insist on that language know anything about IT security.

pilif 10y ago

This is actually a real problem we need public perception changed. If you have proper white-listing in place then AV does nothing but actually decrease the security as these AV programs probably need to be white-listed and thus expose the machines to the kinds of issues as shown here. Unless the compliance auditors are happy with the software just being installed and don't check whether it actually runs. That would still be a colossal waste of money for the licenses but at least it would not compromise your security.

wmt 10y ago
It's a really sad truth that to this date the only effective way to almost fully stop malware is to take away the ability from people to do what they want with their computers. All operating systems that have some way to allow people to run malware, will get malware. Windows, OSX, GNU, Android all can get infected quite easily. Then there's iOS where you cannot, and instead Apple decides which software you can or cannot run. The downside is of course that you cannot run any software going against the corporate values of Apple. If you want the right to shoot yourself in the foot, AV is the necessary evil you must have, unless of course you're sure you'll never visit a website that contains an exploit, old or zeroday, against you browser or its components, and you will never open a office document, PDF or executable that has malware in it. And even then you can get owned.
- lima 10y ago
  > If you want the right to shoot yourself in the foot, AV is the necessary evil you must have No. AVs are actually pretty useless at stopping anything except the most basic attacks (and sometimes, not even that - just look at Cryptolocker). Use Google Chrome (really! Firefox isn't even playing in the same league security-wise), disable Flash player, only run trusted executables with valid digital signatures.
  - wmt 10y ago
    The only tests against real malware out there I've seen are done by AV-Test and AV-Comparatives, and the top products are pretty good at blocking them. Calling them useless sounds more like your hopes than facts, like calling seatbelts useless because people die in car accidents. Uninstalling Flash, Adobe reader, Office and JRE, and using Chrome with adblock also helps you enormously, but is still a far cry for any user having difficulties with finding the download-button from sourceforge. Getting a signing cert is easy as just buying one from Honest Achmed's Used Cars and Certificates, so the only real use for signed software with malware protection is to manually maintain your own list of trusted signers.

Ntrails 10y ago

I don't think we have any antivirus on our work computers. It works out ok because, after all, we don't have internet either. It's amazing how hard it is to run a malicious executable when you can't get them onto your computer... (of course I've no doubt there are plenty of people smart enough to write their own but that's not the concern)

jjawssd 10y ago
Disconnecting externally-facing USB ports from the motherboard also helps a lot
- Ntrails 10y ago
  Our thin clients are locked down in cages, I think the ports are locked anyway, and you'd struggle to get any hardware into the office. I just don't see any accidental options.