6 ms·

Vess has been in the AV industry a LONG time. A really long time. So long that I don't think he's really able to see the state of the industry for what it is

Vess has been in the AV industry a LONG time. A really long time. So long that I don't think he's really able to see the state of the industry for what it is anymore. In the days of windows 95/8, the desktop landscape was very different to how it is now - OSes and browsers were horribly insecure, and readily compromised with little effort. Attacks were plentiful, and infections common. AV really did add useful additional security. These days that's less the case - an up to date windows 10 or OSX desktop is reasonably secure by default - it can still be infected, but generally not without some action taken by the user (of course there are still 0-days, but they are generally treated seriously and patched at least moderately quickly. Unauthenticated RCEs are now a rarity, thankfully). The AV industry hasn't really caught up with the idea that the OS/apps they are messing with are now in general fairly well written and audited pieces of code, and haven't really got institutional awareness that they are making things worse, much of the time. This is frustrating for the OS/app devs, who rightly get annoyed at having AV vendors actively removing protections built into the browser, but also I feel that the AV industry is getting defensive at the bad press generated by things like project-zero, when at least in their own minds they are trying to do something useful. Hence the heated words. ALso, infosec tends towards being a profession of heated language, a lot of the time...

digi_owl 10y ago
Yeah AV had its heyday when we didn't have 24/7 net connections (a problem all its own, i am starting to think) and "infections" happened by way of boot sectors and modified binaries. These days however, infections happen more and more via "clever" interpreted code that can be embedded in just about anything. You best bet for killing a whole lot of crap online is basically to turn off JS. This because http delivered JS is the best way to get past the firewall, that in turn is a blunt, but effective, way at stopping various network born crap.
- JdeBP 10y ago
  There are interpreters for programs that are delivered over the network to be run locally by the unsuspecting user, in some surprising places. For example: Here's a sound player that contains an entire 6502-based virtual machine, because the "sound file format" that it "plays" is actually an executable program. Unfortunately, the virtual machine hardware is not properly simulated, allowing the 6502 code to memory-map parts of the virtual machine manager itself using the virtual memory controller hardware and alter them. * http://scarybeastsecurity.blogspot.co.uk/2016/11/0day-exploit-compromising-linux-desktop.html http://scarybeastsecurity.blogspot.co.uk/2016/11/0day-exploi... (https://news.ycombinator.com/item?id=12951503 https://news.ycombinator.com/item?id=12951503)
  - kuschku 10y ago
    Another example: > Essentially, a WMF file stores a list of function calls that have to be issued to the Windows Graphics Device Interface (GDI) layer to display an image on screen. Since some GDI functions accept pointers to callback functions for error handling, a WMF file may erroneously include executable code.[2] https://en.wikipedia.org/wiki/Windows_Metafile https://en.wikipedia.org/wiki/Windows_Metafile
astrodust 10y ago
He might know what AV technology is like today on a theoretical basis but he seems utterly clueless on a granular technical level. His comment that AV is necessary today seems completely out of touch. There's two things more important than anything else these days: Keeping patched as you mention, but also never, ever giving clueless users administrator access on the machine. I'm not sure any AV package will protect a sufficiently stupid user from a targeted spear-phishing attack, and that's the real threat to worry about.
- dublinben 10y ago
  An adblocker in your browser will mitigate your actual threats better than any AV running on your system.
- tracker1 10y ago
  To the last point... at least today, you can usually "fix" an infection by creating a new user, logging in as that new user, and copying over necessary files from the infected, then delete the infected profile. On the flip side, depending on the infiltration, if it can be used to target other systems, it doesn't matter if it's escalated or not, if it can run.
tptacek 10y ago
Hold on, because installing AV in 1995 would not have done a whole lot more to protect you than installing in 2016 does. I was peripherally involved in the virus scene in the early 1990s --- in that I had close friends who were more than peripherally involved --- and my recollection is that AV was as much a joke then as it is now. I had the pleasure of working for an antivirus company for a few years after they bought my firm. We were in the security group for that company. The antivirus people might as well have been in a different universe; there was no input from security whatsoever.
- yuhong 10y ago
  I think parent was talking about more fundamentally though. There were good and bad AV software back in the 1990s too. I think Vess was involved in macro viruses detection back in the 1990s.
  - tptacek 10y ago
    I don't know that there was ever good AV, at least not in the terms that Schuh is talking about. That's interesting about Vess, though; where did you find that out?
    - yuhong 10y ago
      Full name is I think Vesselin Bontchev.
      - tptacek 10y ago
        Thanks!
  - EvanAnderson 10y ago
    Vess wrote quite a bit about The Dark Avenger. I'd go so far as to say they had a rivalry. (I guess I just assumed most people knew who Vess is. He was certainly a name I knew from my reckless teenage years...) https://en.m.wikipedia.org/wiki/Dark_Avenger https://en.m.wikipedia.org/wiki/Dark_Avenger
technion 10y ago
I'm glad you clarified this, because I was confused by it. For anyone questioning AV, I'd recommend talking to someone who's worked in a service provider. That being, managing: -Businesses that are not overly technical. Specifically, it's easy to work in a technical environment where users know better and provide an artificial shielding -Inheriting AV solutions, and therefore working with 5-6 different vendors at any one time. It's not a matter of "get a better product" -Businesses that consider themselves too small to implement good policies, or force users to tolerate lockdowns in any way Anyone in that position will talk about seeing cryptolocker having walked right past well managed AV products, not just once or twice, but weekly, for the past few years. They will also have horror stories about outages caused by AV themselves. I have a hard time with anyone claiming to AV is an effective requirement beyond politics and insurance policies.
rufius 10y ago
Agreed. AV will not save you from a determined attacker. It's a vaccination, not a magical cure.

digi_owl 10y ago

Yeah AV had its heyday when we didn't have 24/7 net connections (a problem all its own, i am starting to think) and "infections" happened by way of boot sectors and modified binaries. These days however, infections happen more and more via "clever" interpreted code that can be embedded in just about anything. You best bet for killing a whole lot of crap online is basically to turn off JS. This because http delivered JS is the best way to get past the firewall, that in turn is a blunt, but effective, way at stopping various network born crap.

JdeBP 10y ago
There are interpreters for programs that are delivered over the network to be run locally by the unsuspecting user, in some surprising places. For example: Here's a sound player that contains an entire 6502-based virtual machine, because the "sound file format" that it "plays" is actually an executable program. Unfortunately, the virtual machine hardware is not properly simulated, allowing the 6502 code to memory-map parts of the virtual machine manager itself using the virtual memory controller hardware and alter them. * http://scarybeastsecurity.blogspot.co.uk/2016/11/0day-exploit-compromising-linux-desktop.html http://scarybeastsecurity.blogspot.co.uk/2016/11/0day-exploi... (https://news.ycombinator.com/item?id=12951503 https://news.ycombinator.com/item?id=12951503)
- kuschku 10y ago
  Another example: > Essentially, a WMF file stores a list of function calls that have to be issued to the Windows Graphics Device Interface (GDI) layer to display an image on screen. Since some GDI functions accept pointers to callback functions for error handling, a WMF file may erroneously include executable code.[2] https://en.wikipedia.org/wiki/Windows_Metafile https://en.wikipedia.org/wiki/Windows_Metafile

astrodust 10y ago

He might know what AV technology is like today on a theoretical basis but he seems utterly clueless on a granular technical level. His comment that AV is necessary today seems completely out of touch. There's two things more important than anything else these days: Keeping patched as you mention, but also never, ever giving clueless users administrator access on the machine. I'm not sure any AV package will protect a sufficiently stupid user from a targeted spear-phishing attack, and that's the real threat to worry about.

dublinben 10y ago
An adblocker in your browser will mitigate your actual threats better than any AV running on your system.
tracker1 10y ago
To the last point... at least today, you can usually "fix" an infection by creating a new user, logging in as that new user, and copying over necessary files from the infected, then delete the infected profile. On the flip side, depending on the infiltration, if it can be used to target other systems, it doesn't matter if it's escalated or not, if it can run.

tptacek 10y ago

Hold on, because installing AV in 1995 would not have done a whole lot more to protect you than installing in 2016 does. I was peripherally involved in the virus scene in the early 1990s --- in that I had close friends who were more than peripherally involved --- and my recollection is that AV was as much a joke then as it is now. I had the pleasure of working for an antivirus company for a few years after they bought my firm. We were in the security group for that company. The antivirus people might as well have been in a different universe; there was no input from security whatsoever.

yuhong 10y ago
I think parent was talking about more fundamentally though. There were good and bad AV software back in the 1990s too. I think Vess was involved in macro viruses detection back in the 1990s.
- tptacek 10y ago
  I don't know that there was ever good AV, at least not in the terms that Schuh is talking about. That's interesting about Vess, though; where did you find that out?
  - yuhong 10y ago
    Full name is I think Vesselin Bontchev.
    - tptacek 10y ago
      Thanks!
- EvanAnderson 10y ago
  Vess wrote quite a bit about The Dark Avenger. I'd go so far as to say they had a rivalry. (I guess I just assumed most people knew who Vess is. He was certainly a name I knew from my reckless teenage years...) https://en.m.wikipedia.org/wiki/Dark_Avenger https://en.m.wikipedia.org/wiki/Dark_Avenger

technion 10y ago

I'm glad you clarified this, because I was confused by it. For anyone questioning AV, I'd recommend talking to someone who's worked in a service provider. That being, managing: -Businesses that are not overly technical. Specifically, it's easy to work in a technical environment where users know better and provide an artificial shielding -Inheriting AV solutions, and therefore working with 5-6 different vendors at any one time. It's not a matter of "get a better product" -Businesses that consider themselves too small to implement good policies, or force users to tolerate lockdowns in any way Anyone in that position will talk about seeing cryptolocker having walked right past well managed AV products, not just once or twice, but weekly, for the past few years. They will also have horror stories about outages caused by AV themselves. I have a hard time with anyone claiming to AV is an effective requirement beyond politics and insurance policies.

rufius 10y ago

Agreed. AV will not save you from a determined attacker. It's a vaccination, not a magical cure.