6 ms·

I think this exchange (pulled from one of the other threads linked in the comments here) perfectly captures the general argument: https://twitter.com/taviso/sta

I think this exchange (pulled from one of the other threads linked in the comments here) perfectly captures the general argument: https://twitter.com/taviso/status/800061052964651008 https://twitter.com/taviso/status/800061052964651008 Tavis Ormandy: "Kinda like how a lightbulb that sets things on fire is still high quality, so long as you only measure lumens?" Vess: "It's certainly of better quality than a lightbulb that doesn't light the room at all." I think I know which lightbulb I would prefer.

drzaiusapelord 10y ago
Everything electric in your house can start a fire, yet I imagine you don't live like an Amish person. You make a rational gamble with yourself to allow this tech and deal with extremely rare edge cases because of the greater utility this technology gives you. Vess's point is that yes you can find defects in AV, but that doesn't invalidate AV the same way finding defects in the linux kernel or openssl doesn't mean we'll stop using linux or ssl. Also, if you look at some of Tavis's work you'll find scary things like buffer overflows but also disclaimer comments on how tough it would be to actually exploit it due to OS-level protections or other protections. I'm fairly certain we haven't seen any in-the-wild exploits that actually compromise AV. If it was practical to do, it would be the defacto exploit considering you get to take down the gatekeeper and get to run your code at the same time. I think a lot of people interpret Tavis's work in a hysterical manner and it leads to thinking about tossing out the baby with the bathwater. I also think there's a pretty major disconnect between devs and everyday end user habits. Sure, you can live without AV, probably, but get rid of it wholesales at every Fortune 500 company or in a major city and then tell me how you think things will play out. I imagine not well regardless of how 'more secure' Chrome or Firefox can be made.
- rincebrain 10y ago
  I think you may be going too far the other direction, WRT "[you'll] also [find] disclaimer comments on how tough it would be to actually exploit" - there have been several findings that were quite bad even without being properly weaponized. [1][2] The remark about wholly getting rid of AV is also at least partially disingenuous, since I think most (all?) of those advocating it were suggesting that the built-in protections of Windows Defender/MSE were sufficient for most use cases. [1] - https://bugs.chromium.org/p/project-zero/issues/detail?id=820 https://bugs.chromium.org/p/project-zero/issues/detail?id=82... [2] - https://googleprojectzero.blogspot.com/2016/06/a-year-of-windows-kernel-font-fuzzing-1_27.html https://googleprojectzero.blogspot.com/2016/06/a-year-of-win...
- tptacek 10y ago
  You're distorting the argument. Yes, it's all tradeoffs. Almost all of us would trade less light in a room against a likelihood of our house burning down. Pretty much the same deal with antivirus. To fully appreciate what security people are saying about antivirus, you have to understand that contrary to appearances, there is no baby in this bathwater.
- busterarm 10y ago
  > I'm fairly certain we haven't seen any in-the-wild exploits that actually compromise AV. If it was practical to do, it would be the defacto exploit considering you get to take down the gatekeeper and get to run your code at the same time. We have, a number of times and it is practical to do. At least it was on Windows several times in the past. Some AV vendors have in the past chosen to use such bad practices as hooking the SSDT. This has ended hilariously bad for them when they left their own simple vulnerabilities behind them. Suddenly you have the whole kernel because the AV vendor did something astonishingly amateurish in their code.
- vxNsr 10y ago
  I think you're missing the point by looking at the false extreme that Vess offers. A more realistic example would be a lightbulb that is known to catch fire vs a lightbulb that is dimmer than most. As you know basically everyone has chosen the dimmer lightbulb over the brighter one, except in special scenarios (movie set lighting, etc). Travis is just arguing that most people don't need the super bright light bulb that's gonna catch fire (buggy and badly audited AV software) because windows defender + {bignamebrowserofyourchoice} will be good enough to satisfy 90% of people.

drzaiusapelord 10y ago

Everything electric in your house can start a fire, yet I imagine you don't live like an Amish person. You make a rational gamble with yourself to allow this tech and deal with extremely rare edge cases because of the greater utility this technology gives you. Vess's point is that yes you can find defects in AV, but that doesn't invalidate AV the same way finding defects in the linux kernel or openssl doesn't mean we'll stop using linux or ssl. Also, if you look at some of Tavis's work you'll find scary things like buffer overflows but also disclaimer comments on how tough it would be to actually exploit it due to OS-level protections or other protections. I'm fairly certain we haven't seen any in-the-wild exploits that actually compromise AV. If it was practical to do, it would be the defacto exploit considering you get to take down the gatekeeper and get to run your code at the same time. I think a lot of people interpret Tavis's work in a hysterical manner and it leads to thinking about tossing out the baby with the bathwater. I also think there's a pretty major disconnect between devs and everyday end user habits. Sure, you can live without AV, probably, but get rid of it wholesales at every Fortune 500 company or in a major city and then tell me how you think things will play out. I imagine not well regardless of how 'more secure' Chrome or Firefox can be made.

rincebrain 10y ago
I think you may be going too far the other direction, WRT "[you'll] also [find] disclaimer comments on how tough it would be to actually exploit" - there have been several findings that were quite bad even without being properly weaponized. [1][2] The remark about wholly getting rid of AV is also at least partially disingenuous, since I think most (all?) of those advocating it were suggesting that the built-in protections of Windows Defender/MSE were sufficient for most use cases. [1] - https://bugs.chromium.org/p/project-zero/issues/detail?id=820 https://bugs.chromium.org/p/project-zero/issues/detail?id=82... [2] - https://googleprojectzero.blogspot.com/2016/06/a-year-of-windows-kernel-font-fuzzing-1_27.html https://googleprojectzero.blogspot.com/2016/06/a-year-of-win...
tptacek 10y ago
You're distorting the argument. Yes, it's all tradeoffs. Almost all of us would trade less light in a room against a likelihood of our house burning down. Pretty much the same deal with antivirus. To fully appreciate what security people are saying about antivirus, you have to understand that contrary to appearances, there is no baby in this bathwater.
busterarm 10y ago
> I'm fairly certain we haven't seen any in-the-wild exploits that actually compromise AV. If it was practical to do, it would be the defacto exploit considering you get to take down the gatekeeper and get to run your code at the same time. We have, a number of times and it is practical to do. At least it was on Windows several times in the past. Some AV vendors have in the past chosen to use such bad practices as hooking the SSDT. This has ended hilariously bad for them when they left their own simple vulnerabilities behind them. Suddenly you have the whole kernel because the AV vendor did something astonishingly amateurish in their code.
vxNsr 10y ago
I think you're missing the point by looking at the false extreme that Vess offers. A more realistic example would be a lightbulb that is known to catch fire vs a lightbulb that is dimmer than most. As you know basically everyone has chosen the dimmer lightbulb over the brighter one, except in special scenarios (movie set lighting, etc). Travis is just arguing that most people don't need the super bright light bulb that's gonna catch fire (buggy and badly audited AV software) because windows defender + {bignamebrowserofyourchoice} will be good enough to satisfy 90% of people.