5 ms·

Well, I see his point. 3rd Party AV vendors have hacky hooks into the kernel to do what they need to do. And at that point they become kernel-level so they are

by 0xfeba 10y ago

Well, I see his point. 3rd Party AV vendors have hacky hooks into the kernel to do what they need to do. And at that point they become kernel-level so they are a juicy target. Symantec and other AV vendors have had stupid flaws (someone else linked to it in the comments) that allowed remote access and privileged escalation from just knowing the host has a certain AV installed. All AV seems hacky--except for Microsoft's own, which is what I use and suggest all my friends use rather than shelling out for those subpar products.

jackmott 10y ago
even ignoring the attack surface, the tools seem to always cause the same kinds of system performance degradation that actual malware does. I'd rather be occasionally hacked!
- sqeaky 10y ago
  You act as though its a choice. You will get hacked with or without the the AV, The AV might just let you know.
  - davidcbc 10y ago
    It's more likely that the AV will be the cause of your infection than that it will protect you from infection.
    - sqeaky 10y ago
      I agree completely. I didn't mean it as a good thing. If you want to not be infected don't use windows or other systems with prolific AV vendors.
jsheard 10y ago
Case in point: After years of fruitlessly asking AV companies to stop injecting shoddy patches into their kernel, Microsoft eventually gave up and added active countermeasures which deliberately trigger a kernel panic if certain structures are tampered with. That gave AV vendors the "encouragement" required to move to the sanctioned APIs. https://en.wikipedia.org/wiki/Kernel_Patch_Protection https://en.wikipedia.org/wiki/Kernel_Patch_Protection
SippinLean 10y ago
>except for Microsoft's own It used to be great but I think the last stats I saw showed it at about 50% success rate. ESET is excellent.
- zokier 10y ago
  I think the point is not detection rate, but the amount of new holes the AV introduces to the system
ionised 10y ago
Windows Defender was shown to be pretty piss poor in general detections. The only thing it has going for it is its low resource footprint.
- anonymfus 10y ago
  Looks like survivorship bias: malware detectable by Windows Defender does not spread so it is not included in comparisons.

by 0xfeba 10y ago

jackmott 10y ago

even ignoring the attack surface, the tools seem to always cause the same kinds of system performance degradation that actual malware does. I'd rather be occasionally hacked!

sqeaky 10y ago
You act as though its a choice. You will get hacked with or without the the AV, The AV might just let you know.
- davidcbc 10y ago
  It's more likely that the AV will be the cause of your infection than that it will protect you from infection.
  - sqeaky 10y ago
    I agree completely. I didn't mean it as a good thing. If you want to not be infected don't use windows or other systems with prolific AV vendors.

jsheard 10y ago

Case in point: After years of fruitlessly asking AV companies to stop injecting shoddy patches into their kernel, Microsoft eventually gave up and added active countermeasures which deliberately trigger a kernel panic if certain structures are tampered with. That gave AV vendors the "encouragement" required to move to the sanctioned APIs. https://en.wikipedia.org/wiki/Kernel_Patch_Protection https://en.wikipedia.org/wiki/Kernel_Patch_Protection

SippinLean 10y ago

>except for Microsoft's own It used to be great but I think the last stats I saw showed it at about 50% success rate. ESET is excellent.

zokier 10y ago
I think the point is not detection rate, but the amount of new holes the AV introduces to the system

ionised 10y ago

Windows Defender was shown to be pretty piss poor in general detections. The only thing it has going for it is its low resource footprint.

anonymfus 10y ago
Looks like survivorship bias: malware detectable by Windows Defender does not spread so it is not included in comparisons.