5 ms·

> Infection attempts by what? In January I've seen logs blocking drive-by malware attempts, lots of infected email attachments and an infected USB stick. These

> Infection attempts by what? In January I've seen logs blocking drive-by malware attempts, lots of infected email attachments and an infected USB stick. These are not false positives. They were not legitimate software from trusted sources. The logs I read were real-world true positives and they were not inconsequential trivia like tracking cookies or the like. I don't think that in any of the cases the user would have had a warning to blindly click through. Not entirely sure how an advert blocker can stop email or device-carrying malware.

freeflight 9y ago
> They were not legitimate software from trusted sources. Infected email attachments, unless they come from a trusted sender, I consider "useless positives" because nobody, with the appropriate training, should be opening them in the first place. Kinda along the same lines of tracking portscans and counting those as "thwarted cyber attacks", like many government agencies tend to boast about, it's nice for padding stats but is it a real security gain? Afaik by now one of the most common successful attack vectors is drive-by kits [0], increasingly served trough advertisement channels. Ad-blockers/disabling Java minimize this risk quite a bit, with low overhead, while having the added comfort of making the web more user-friendly. Which to me is the most sensible solution, unless one really likes opening weird email attachments and/or plugging in untrusted devices. > I don't think that in any of the cases the user would have had a warning to blindly click through. If the user is already careless enough to connect untrusted devices and/or opening random email attachments, then I have no trust in said user to heed any of the following warnings, as he/she already had to ignore previous best practice warnings to get there in the first place. [0] http://www.securityweek.com/internets-big-threat-drive-attacks http://www.securityweek.com/internets-big-threat-drive-attac...
- marshray 9y ago
  > nobody, with the appropriate training, should be opening them in the first place How many users do you administer again?
  - hutzlibu 9y ago
    I guess that doesn't matter as he said "should". But yeah, reality is different ...
  - freeflight 9y ago
    A whole lot of 5 users, I realize that in bigger companies it's probably less hassle to just install AV software and "hardblock" undesired behavior. I imagine that depending on the country you are operating in this might even be a requirement to prevent legal hassle, getting sued for "neglect" if not running AV software and something actually goes wrong but IANAL. But let's also keep in mind that AV solutions can have the exact opposite effect of what they're supposed to do, from data leakage [0] [1] to straight up remote code executions [2]. Which isn't that surprising, considering that more complexity is usually a bad thing to add to any system, especially if it's as deep-rooted as most AV suits tend to be. [0] https://www.directdefense.com/harvesting-cb-response-data-leaks-fun-profit/ https://www.directdefense.com/harvesting-cb-response-data-le... [1] https://www.siliconrepublic.com/enterprise/kaspersky-nsa-leak-mistake https://www.siliconrepublic.com/enterprise/kaspersky-nsa-lea... [2] https://landave.io/2017/06/avast-antivirus-remote-stack-buffer-overflow-with-magic-numbers/ https://landave.io/2017/06/avast-antivirus-remote-stack-buff...
- irundebian 9y ago
  > If the user is already careless enough to connect untrusted devices and/or opening random email attachments, then I have no trust in said user to heed any of the following warnings, as he/she already had to ignore previous best practice warnings to get there in the first place. Don't blame the user, when we as computer scientists are too stupid to build secure systems. I expect from an computer system / software that I don't get infected if I plug in a USB stick or open a PDF file. The software devs of operatings systems and applications as well as hardware vendors are to blame. That's it.
  - Dylan16807 9y ago
    If you want to protect the user from email attachments from strangers, block them all, don't base it on a scan that picks up some threats.
tscs37 9y ago
I recommend to keep the microsoft scanner active (Windows Defender or how they call it by now). It catches all the common stuff with high accuracy and only some of the exotic stuff gets through (which would probably be a pass for most other scanners too)

freeflight 9y ago

> They were not legitimate software from trusted sources. Infected email attachments, unless they come from a trusted sender, I consider "useless positives" because nobody, with the appropriate training, should be opening them in the first place. Kinda along the same lines of tracking portscans and counting those as "thwarted cyber attacks", like many government agencies tend to boast about, it's nice for padding stats but is it a real security gain? Afaik by now one of the most common successful attack vectors is drive-by kits [0], increasingly served trough advertisement channels. Ad-blockers/disabling Java minimize this risk quite a bit, with low overhead, while having the added comfort of making the web more user-friendly. Which to me is the most sensible solution, unless one really likes opening weird email attachments and/or plugging in untrusted devices. > I don't think that in any of the cases the user would have had a warning to blindly click through. If the user is already careless enough to connect untrusted devices and/or opening random email attachments, then I have no trust in said user to heed any of the following warnings, as he/she already had to ignore previous best practice warnings to get there in the first place. [0] http://www.securityweek.com/internets-big-threat-drive-attacks http://www.securityweek.com/internets-big-threat-drive-attac...

marshray 9y ago
> nobody, with the appropriate training, should be opening them in the first place How many users do you administer again?
- hutzlibu 9y ago
  I guess that doesn't matter as he said "should". But yeah, reality is different ...
- freeflight 9y ago
  A whole lot of 5 users, I realize that in bigger companies it's probably less hassle to just install AV software and "hardblock" undesired behavior. I imagine that depending on the country you are operating in this might even be a requirement to prevent legal hassle, getting sued for "neglect" if not running AV software and something actually goes wrong but IANAL. But let's also keep in mind that AV solutions can have the exact opposite effect of what they're supposed to do, from data leakage [0] [1] to straight up remote code executions [2]. Which isn't that surprising, considering that more complexity is usually a bad thing to add to any system, especially if it's as deep-rooted as most AV suits tend to be. [0] https://www.directdefense.com/harvesting-cb-response-data-leaks-fun-profit/ https://www.directdefense.com/harvesting-cb-response-data-le... [1] https://www.siliconrepublic.com/enterprise/kaspersky-nsa-leak-mistake https://www.siliconrepublic.com/enterprise/kaspersky-nsa-lea... [2] https://landave.io/2017/06/avast-antivirus-remote-stack-buffer-overflow-with-magic-numbers/ https://landave.io/2017/06/avast-antivirus-remote-stack-buff...
irundebian 9y ago
> If the user is already careless enough to connect untrusted devices and/or opening random email attachments, then I have no trust in said user to heed any of the following warnings, as he/she already had to ignore previous best practice warnings to get there in the first place. Don't blame the user, when we as computer scientists are too stupid to build secure systems. I expect from an computer system / software that I don't get infected if I plug in a USB stick or open a PDF file. The software devs of operatings systems and applications as well as hardware vendors are to blame. That's it.
- Dylan16807 9y ago
  If you want to protect the user from email attachments from strangers, block them all, don't base it on a scan that picks up some threats.

tscs37 9y ago

I recommend to keep the microsoft scanner active (Windows Defender or how they call it by now). It catches all the common stuff with high accuracy and only some of the exotic stuff gets through (which would probably be a pass for most other scanners too)