5 ms·

> You can't just pull numbers out of thin air to make your point. > Experience has shown us that antivirus software does not do what it says on the tin. Whose

> You can't just pull numbers out of thin air to make your point. > Experience has shown us that antivirus software does not do what it says on the tin. Whose experience? I built WildFire at Palo Alto Networks[1]. We analyzed a few tens of millions of new potential threats daily, including the VirusTotal firehose. As part of our internal efficacy and competitive monitoring, we took the top 5 enterprise antivirus products and ran everything coming into WildFire through them. The delta between ground truth and what the antivirus engines caught using only static scanning and emulation was about a third, i.e. better than the pessimistic estimate of half I threw out. (In the real world, antivirus actually does better because malware is easier to catch after it starts running.) The danger of antivirus, on the other hand, is wildly overstated in this thread. A small fraction of attacks use vulnerabilities to begin with, and in the scheme of things, very few antivirus vulnerabilities have been found. 1% is just a nice, round number chosen for illustrative purposes; it's orders of magnitude greater than the real risk. Now, this will surprise exactly no one who works in security, since most new malware is a minor variant of existing malware and exploits are relatively uncommon, but for the less experienced folks reading these comments, I implore you: Don't listen to people who say antivirus is useless or, worse, makes you less secure. It isn't. It doesn't. They're wrong. 1. It's the biggest ATP product out there, took the crown from FireEye c. 2015. https://www.paloaltonetworks.com/products/secure-the-network/subscriptions/wildfire https://www.paloaltonetworks.com/products/secure-the-network...

mulmen 9y ago
> Whose experience? Off the top of my head, users of Bitdefender. You're right of course, my point is that without some evidence you're just making up numbers to prove your point and any jerk with a keyboard (like say, me) can do the same thing. Thanks for providing some background to those numbers.
- xenophonf 9y ago
  This Bitdefender vulnerability doesn't come with a PoC and is difficult to exploit due to DEP and ASLR---hooray for defense in depth! I've got a thousand nodes running Bitdefender in environments where malware runs rampant, and I'm not really that worried about someone coming after us through the scan engine. What I am going to do is make sure all my clients are up to date, which is really no different than my existing patch management activities.
the8472 9y ago
> The danger of antivirus, on the other hand, is wildly overstated in this thread. A small fraction of attacks use vulnerabilities to begin with But AV vulnerabilities sit on the top of the attack class pyramid. They often are remotely executable, run with kernel privileges and do not require user interaction. You can't lump that together that with malware that requires tricking a user into downloading an installer, clicking through it and granting it elevated privileges.
ktRolster 9y ago
Your comment sounds like a commercial mainly.
- FreakLegion 9y ago
  If you're talking about WildFire, it's not an antivirus product and isn't relevant to this conversation beyond establishing the provenance of the data I've shared with you. If you're talking about something else, I've stated that antivirus detects around two-thirds of new malware on any given day. In case it wasn't already clear, two-thirds is terrible. Your claim is far more extreme, though. You said "You're better off not using an antivirus". That's wrong. Antivirus won't keep you safe, but you're still safer with it than without it.
  - ktRolster 9y ago
    Security products flag cookies as malware, so your point is kind of doubtful.
    - FreakLegion 9y ago
      > Security products flag cookies as malware If you're saying cookies shouldn't be flagged by antivirus, that's wrong. Cookies can be associated with malware in any number of ways[1], although grayware (especially adware), which antivirus also flags depending on configuration, is a more likely culprit. 1. Check out PyExfil, for example: https://github.com/ytisf/PyExfil https://github.com/ytisf/PyExfil. Cookies for data exfiltration. DNS controls on firewalls are there for similar reasons.
      - ktRolster 9y ago
        Oh, exfiltration? Yeah, you're like every other malware 'protection' snake oil salesman.

mulmen 9y ago

> Whose experience? Off the top of my head, users of Bitdefender. You're right of course, my point is that without some evidence you're just making up numbers to prove your point and any jerk with a keyboard (like say, me) can do the same thing. Thanks for providing some background to those numbers.

xenophonf 9y ago
This Bitdefender vulnerability doesn't come with a PoC and is difficult to exploit due to DEP and ASLR---hooray for defense in depth! I've got a thousand nodes running Bitdefender in environments where malware runs rampant, and I'm not really that worried about someone coming after us through the scan engine. What I am going to do is make sure all my clients are up to date, which is really no different than my existing patch management activities.

the8472 9y ago

> The danger of antivirus, on the other hand, is wildly overstated in this thread. A small fraction of attacks use vulnerabilities to begin with But AV vulnerabilities sit on the top of the attack class pyramid. They often are remotely executable, run with kernel privileges and do not require user interaction. You can't lump that together that with malware that requires tricking a user into downloading an installer, clicking through it and granting it elevated privileges.

ktRolster 9y ago

Your comment sounds like a commercial mainly.

FreakLegion 9y ago
If you're talking about WildFire, it's not an antivirus product and isn't relevant to this conversation beyond establishing the provenance of the data I've shared with you. If you're talking about something else, I've stated that antivirus detects around two-thirds of new malware on any given day. In case it wasn't already clear, two-thirds is terrible. Your claim is far more extreme, though. You said "You're better off not using an antivirus". That's wrong. Antivirus won't keep you safe, but you're still safer with it than without it.
- ktRolster 9y ago
  Security products flag cookies as malware, so your point is kind of doubtful.
  - FreakLegion 9y ago
    > Security products flag cookies as malware If you're saying cookies shouldn't be flagged by antivirus, that's wrong. Cookies can be associated with malware in any number of ways[1], although grayware (especially adware), which antivirus also flags depending on configuration, is a more likely culprit. 1. Check out PyExfil, for example: https://github.com/ytisf/PyExfil https://github.com/ytisf/PyExfil. Cookies for data exfiltration. DNS controls on firewalls are there for similar reasons.
    - ktRolster 9y ago
      Oh, exfiltration? Yeah, you're like every other malware 'protection' snake oil salesman.