3 ms·

>due to lack of APIs This is the elephant in the room. Software vendors dont want to make this APIs as they increase complexity and cost so AV vendors use hack

>due to lack of APIs This is the elephant in the room. Software vendors dont want to make this APIs as they increase complexity and cost so AV vendors use hackey solutions for a lot of security related tasks. This is a classic conflict that is probably never going away. To MS's credit, they did remove ring0 access to apps like AV and have added OS-level APIs, but the application level guys still consider that bothersome and the AV guys simple need more/better and more flexibility as threats change. The recent stuff in 8 and 10 were engineered well before we had this rash of ransomware attacks. Also from a practical perspective, its very rare to see an AV compromised but we're constantly seeing browsers, plugins, etc compromised. Heck, Firefox just had a zero-day yesterday. I think the argument that AV makes everything worse is the more questionable claim in this discussion regardless of how much we hate the necessary evil AV is. Especially when we consider how the next-gen stuff that's almost purely heuristics will probably replace AV one day and how its much less hacky than current solutions.

rcthompson 10y ago
The thread gives specific instances where AV has made the situation much worse for browsers, mainly by preventing them from enabling many forms of sandboxing.
joatmon-snoo 10y ago
Schuh points out in the Twitter thread that Chrome supports OS-level API's. > its very rare to see an AV compromised https://twitter.com/taviso/status/732365178872856577 https://twitter.com/taviso/status/732365178872856577 https://bugs.chromium.org/p/project-zero/issues/list?can=1&q=symantec https://bugs.chromium.org/p/project-zero/issues/list?can=1&q...
- drzaiusapelord 10y ago
  If AV was so vulnerable, we'd see nothing but exploits in the wild going after AV. Yet we aren't seeing that anywhere. If you read the notes you'll see scary terms like "buffer overflow" but "probably wont work on windows because windows uses /GS." I think Tavis does good work but the interpretation of his work is often hysterical. Finding an issue with AV doesn't invalidate the concept of AV. AV is just software. Bugs get found and patched like any other software. I think accepting that isn't asking too much here. Defect-free software is so far humanly impossible for non-trivial applications, let alone for complex security applications. Heck, how many security defects has the linux kernel and openssl had in the past couple years alone? Dozens, or more, and all have been weaponized and trivially exploited. Yet we still use that stuff. Grandma's PC, the PC of a random staff person at work, etc without AV is taken down near instantly. With it, she can avoid many of these security issues. The idea that some defects means AV is without value is a fun and popular opinion with techies, but in the real wold, it does far, far more good than harm.
  - marumari 10y ago
    > If AV was so vulnerable, we'd see nothing but exploits in the wild going after AV. Yet we aren't seeing that anywhere. That's because the Linux kernel, Chrome, Firefox, etc. are installed on hundred of millions or billions of devices. Any given piece of anti-virus is orders of magnitude less popular. Further, the route to exploitation is often more circuitous with AV Overall, that adds up to significantly less exploitation seen in the wild.
  - ekiru 10y ago
    > If you read the notes you'll see scary terms like "buffer overflow" but "probably wont work on windows because windows uses /GS." That's not true of the one issue which mentions Windows using /GS. For that issue (814), the bug actually says "Exploitation is likely still possible on Windows, but may be more difficult as they do use /GS on that platform." Of the other eight bugs linked, four in the link were confirmed to allow code exec as NT AUTHORITY\SYSTEM on Windows. One more is "trivially exploitable" and allows reliable control of the instruction pointer but didn't specify as what user the code is running.
    - drzaiusapelord 10y ago
      and they were patched before they could be properly exploited. Its odd to expect AV to be defect free but to excuse defects in other software. I think we're holding AV up to a quality level that's unrealistic here and also dismissing its everyday benefits for average users.
      - ekiru 10y ago
        I think that "Don't run several pieces of years-old third-party software with multiple publicly-known code execution vulnerabilities as root/SYSTEM on possibly malicious input" is a bare minimum requirement to demand of a piece of software whose entire purpose is to analyze untrusted data to prevent malicious code from executing on our machines. If it's unrealistic to ask that of AV software, then I'm not sure how this works out to be an argument for AV.
gcp 10y ago
Also from a practical perspective, its very rare to see an AV compromised If by very rare, you mean, constantly, then yes. You're hearing less about this because the AV industry is fragmented, so targeting AVs is not interesting because you only reach a small percentage of people. There's less browsers and the biggest ones reach literally multiple tens of percents of internet users, which is much more interesting. but we're constantly seeing browsers, plugins, etc compromised. Heck, Firefox just had a zero-day yesterday. ...and it was protected by its sandbox from infecting the system. (The actual exploit was a privacy unmask targeted at an older version) The same sandbox that can't be tightened due to AV. See the problem? How many AVs were blocking the exploit faster than the browser vendor released an update, anyway?

rcthompson 10y ago

The thread gives specific instances where AV has made the situation much worse for browsers, mainly by preventing them from enabling many forms of sandboxing.

joatmon-snoo 10y ago

Schuh points out in the Twitter thread that Chrome supports OS-level API's. > its very rare to see an AV compromised https://twitter.com/taviso/status/732365178872856577 https://twitter.com/taviso/status/732365178872856577 https://bugs.chromium.org/p/project-zero/issues/list?can=1&q=symantec https://bugs.chromium.org/p/project-zero/issues/list?can=1&q...

drzaiusapelord 10y ago
If AV was so vulnerable, we'd see nothing but exploits in the wild going after AV. Yet we aren't seeing that anywhere. If you read the notes you'll see scary terms like "buffer overflow" but "probably wont work on windows because windows uses /GS." I think Tavis does good work but the interpretation of his work is often hysterical. Finding an issue with AV doesn't invalidate the concept of AV. AV is just software. Bugs get found and patched like any other software. I think accepting that isn't asking too much here. Defect-free software is so far humanly impossible for non-trivial applications, let alone for complex security applications. Heck, how many security defects has the linux kernel and openssl had in the past couple years alone? Dozens, or more, and all have been weaponized and trivially exploited. Yet we still use that stuff. Grandma's PC, the PC of a random staff person at work, etc without AV is taken down near instantly. With it, she can avoid many of these security issues. The idea that some defects means AV is without value is a fun and popular opinion with techies, but in the real wold, it does far, far more good than harm.
- marumari 10y ago
  > If AV was so vulnerable, we'd see nothing but exploits in the wild going after AV. Yet we aren't seeing that anywhere. That's because the Linux kernel, Chrome, Firefox, etc. are installed on hundred of millions or billions of devices. Any given piece of anti-virus is orders of magnitude less popular. Further, the route to exploitation is often more circuitous with AV Overall, that adds up to significantly less exploitation seen in the wild.
- ekiru 10y ago
  > If you read the notes you'll see scary terms like "buffer overflow" but "probably wont work on windows because windows uses /GS." That's not true of the one issue which mentions Windows using /GS. For that issue (814), the bug actually says "Exploitation is likely still possible on Windows, but may be more difficult as they do use /GS on that platform." Of the other eight bugs linked, four in the link were confirmed to allow code exec as NT AUTHORITY\SYSTEM on Windows. One more is "trivially exploitable" and allows reliable control of the instruction pointer but didn't specify as what user the code is running.
  - drzaiusapelord 10y ago
    and they were patched before they could be properly exploited. Its odd to expect AV to be defect free but to excuse defects in other software. I think we're holding AV up to a quality level that's unrealistic here and also dismissing its everyday benefits for average users.
    - ekiru 10y ago
      I think that "Don't run several pieces of years-old third-party software with multiple publicly-known code execution vulnerabilities as root/SYSTEM on possibly malicious input" is a bare minimum requirement to demand of a piece of software whose entire purpose is to analyze untrusted data to prevent malicious code from executing on our machines. If it's unrealistic to ask that of AV software, then I'm not sure how this works out to be an argument for AV.

gcp 10y ago

Also from a practical perspective, its very rare to see an AV compromised If by very rare, you mean, constantly, then yes. You're hearing less about this because the AV industry is fragmented, so targeting AVs is not interesting because you only reach a small percentage of people. There's less browsers and the biggest ones reach literally multiple tens of percents of internet users, which is much more interesting. but we're constantly seeing browsers, plugins, etc compromised. Heck, Firefox just had a zero-day yesterday. ...and it was protected by its sandbox from infecting the system. (The actual exploit was a privacy unmask targeted at an older version) The same sandbox that can't be tightened due to AV. See the problem? How many AVs were blocking the exploit faster than the browser vendor released an update, anyway?