5 ms·

I think most antivirus is security theater at this point, unless you're using endpoint security like CrowdStrike Falcon, Palo Alto Cortex, Carbon Black, etc. Wh

by 4oo4 5y ago

I think most antivirus is security theater at this point, unless you're using endpoint security like CrowdStrike Falcon, Palo Alto Cortex, Carbon Black, etc. Which, I think only sell to B2B and not consumer.

_dain_ 5y ago
Was it ever not security theatre?
- 4oo4 5y ago
  You're definitely right about that. I think it's from the XP days, but I remember reading about antivirus vendors creating their own security holes and vulnerabilities, where running antivirus software made your computer less secure than without it. And then when Microsoft wanted to create fixes to prevent said vulnerabilities from being exploitable, the antivirus vendors actually threatened to sue them to avoid putting in the engineering work to fix their shitty code. EDIT: In many cases, these security changes meant deep architectural changes were required to third party solutions. And most ecosystem vendors were not incented to invest heavily in their legacy apps. Some of these solutions took the unorthodox approach of modifying data structures and even instructions in the kernel in order to implement their functionality, bypassing APIs and multiprocessor locks, often causing havoc. At one point, something like 70% of all Windows “blue screens” were caused by these third party drivers and their unwillingness to use supported APIs to implement their functionality. Antivirus vendors were notorious for using this approach. In my role as head of Microsoft security, I personally spent years explaining to antivirus vendors why we would no longer allow them to “patch” kernel instructions and data structures in memory, why this was a security risk, and why they needed to use approved APIs going forward, that we would no longer support their legacy apps with deep hooks in the Windows kernel — the same approach that hackers were using to attack consumer systems. Our “friends”, the antivirus vendors, threatened to sue us in return, claiming we were blocking their livelihood and abusing our monopoly power! With friends like that, who needs enemies? They just wanted their old solutions to keep working even if that meant reducing the security of our mutual customers — the very thing they were supposed to be improving. https://blog.usejournal.com/what-really-happened-with-vista-an-insiders-retrospective-f713ee77c239?gi=86c23f881661 https://blog.usejournal.com/what-really-happened-with-vista-...
- peanut_worm 5y ago
  Malware was definitely a lot more prevalent back in the day and you couldn’t do everything on the internet back then so you had to download a lot more random programs off the internet. I think they definitely had a purpose a long time ago but probably not for the past 15 years.
mise_en_place 5y ago
These are also annoying because they hijack/MITM SSL certs and change the certificate chain with their invalid root CA. It’s security through obscurity.
inglor 5y ago
Microsoft _does_ provide a bunch of the enterprise security features other vendors provide in its home anti-virus offering. Microsoft is also the biggest vendor of enterprise endpoint security solutions - that is Microsoft Defender and products like "Palo Alto Cortex" compete. However, the home offering of Defender _is_ quite different in terms of usage from the enterprise version and so is the amount of instrumentation.
fernandotakai 5y ago
>CrowdStrike Falcon for the first time, i have a machine with this installed and holy damn... it's so bad. it uses 30~50% cpu all the time + tons of IO. how can people just accept software that just degrades your machine for small gains on security?
- 4oo4 5y ago
  Really? That's interesting. We deployed this a few months ago this where I work and haven't encountered any performance issues like this. But we have had the fun of encountering BSODs when some of our end users try to use Excel.
  - fernandotakai 5y ago
    right now, just browsing web using hn, com.crowdstrike.falcon.Agent is using 10% cpu -- this is on an intel macbook pro 16". when i try to use docker, tmux within a terminal, it gets even worse -- i've seen it using 60% cpu + io.
    - 4oo4 5y ago
      That might be the difference, my work is a 100% Windows shop, so that's why we haven't seen it. That really sucks though.
    - ch0I9daAiO 5y ago
      What sensor version are you running? 6.33 iirc has an issue and you'll need to upgrade to 6.34. . If you have access to the support page inside the Falcon platform, run the script they have for collecting system info and submit a case to support. (not affiliated with CS, I came across a similar high CPU usage and middlemanned the comms between our Mac admin and CS).
- hughrr 5y ago
  Thanks for this reference. I was told I'm having this rolled out onto the infra I'm using. I have added this to the growing list of reasons to quit.
- 5y ago
qxmat 5y ago
Last year I tried to source an on-demand AV scanner because we'd exhausted what clamav was capable of (it non-deterministically craps out after 2Gb and can't scan binaries). If I couldn't find a suitable drop-in replacement I was going recommend an enterprise work-flow scanning solution that had AWS cloud integration (i.e. automatically move objects through ingress/output/quarantine S3 buckets or some kind of API we could hook to tag objects with a 'passed' label). My requirements were simple: it had to run in our cloud (AWS, eu-west-2) because of PII concerns, preferably "serverless"/ephemeral and we needed to scan assets our data analysts would use in their day to day operations (tiny files, massive files - a bit of everything). After a several time consuming days I had to give up because I found nothing. The Internet has become a mirage of av/malware scanning solutions that no longer exist (one of our guys reported that Sophos had a CLI tool - savscan - but when I looked it appeared to be discontinued). Almost every major vendor I came across offered an end-point product that ran on their cloud or had moved out of the malware/virus scanning market in favour of a DPI firewall. I was hampered by a lack of product documentation/feature comparison tables on the "enterprise" vendor marketing websites and sad "cloudification" of stacks that really ought to have a CLI binary.
huhtenberg 5y ago
> CrowdStrike Falcon, Palo Alto Cortex, Carbon Black These have absolutely massive issues with false positives that take ages to resolve even if reported.
allo37 5y ago
I don't know if this is still relevant, but around 2007 or so a buddy and I found the source code for a "research" keylogger trojan online. We compiled and ran it for kicks, and sure enough Avira (which I was using at the time, or was it still called AntiVir?), picked it up almost instantly. We swapped the order of a couple of instructions, recompiled, and glory be: Avira didn't flag it anymore! Since then I just find the least obtrusive AV and just try to avoid clicking on anything suspicious, because I'm convinced they all offer "meh" protection at best.
fomine3 5y ago
How could they differ?

by 4oo4 5y ago

_dain_ 5y ago

Was it ever not security theatre?

4oo4 5y ago
You're definitely right about that. I think it's from the XP days, but I remember reading about antivirus vendors creating their own security holes and vulnerabilities, where running antivirus software made your computer less secure than without it. And then when Microsoft wanted to create fixes to prevent said vulnerabilities from being exploitable, the antivirus vendors actually threatened to sue them to avoid putting in the engineering work to fix their shitty code. EDIT: In many cases, these security changes meant deep architectural changes were required to third party solutions. And most ecosystem vendors were not incented to invest heavily in their legacy apps. Some of these solutions took the unorthodox approach of modifying data structures and even instructions in the kernel in order to implement their functionality, bypassing APIs and multiprocessor locks, often causing havoc. At one point, something like 70% of all Windows “blue screens” were caused by these third party drivers and their unwillingness to use supported APIs to implement their functionality. Antivirus vendors were notorious for using this approach. In my role as head of Microsoft security, I personally spent years explaining to antivirus vendors why we would no longer allow them to “patch” kernel instructions and data structures in memory, why this was a security risk, and why they needed to use approved APIs going forward, that we would no longer support their legacy apps with deep hooks in the Windows kernel — the same approach that hackers were using to attack consumer systems. Our “friends”, the antivirus vendors, threatened to sue us in return, claiming we were blocking their livelihood and abusing our monopoly power! With friends like that, who needs enemies? They just wanted their old solutions to keep working even if that meant reducing the security of our mutual customers — the very thing they were supposed to be improving. https://blog.usejournal.com/what-really-happened-with-vista-an-insiders-retrospective-f713ee77c239?gi=86c23f881661 https://blog.usejournal.com/what-really-happened-with-vista-...
peanut_worm 5y ago
Malware was definitely a lot more prevalent back in the day and you couldn’t do everything on the internet back then so you had to download a lot more random programs off the internet. I think they definitely had a purpose a long time ago but probably not for the past 15 years.

mise_en_place 5y ago

These are also annoying because they hijack/MITM SSL certs and change the certificate chain with their invalid root CA. It’s security through obscurity.

inglor 5y ago

Microsoft _does_ provide a bunch of the enterprise security features other vendors provide in its home anti-virus offering. Microsoft is also the biggest vendor of enterprise endpoint security solutions - that is Microsoft Defender and products like "Palo Alto Cortex" compete. However, the home offering of Defender _is_ quite different in terms of usage from the enterprise version and so is the amount of instrumentation.

fernandotakai 5y ago

>CrowdStrike Falcon for the first time, i have a machine with this installed and holy damn... it's so bad. it uses 30~50% cpu all the time + tons of IO. how can people just accept software that just degrades your machine for small gains on security?

4oo4 5y ago
Really? That's interesting. We deployed this a few months ago this where I work and haven't encountered any performance issues like this. But we have had the fun of encountering BSODs when some of our end users try to use Excel.
- fernandotakai 5y ago
  right now, just browsing web using hn, com.crowdstrike.falcon.Agent is using 10% cpu -- this is on an intel macbook pro 16". when i try to use docker, tmux within a terminal, it gets even worse -- i've seen it using 60% cpu + io.
  - 4oo4 5y ago
    That might be the difference, my work is a 100% Windows shop, so that's why we haven't seen it. That really sucks though.
  - ch0I9daAiO 5y ago
    What sensor version are you running? 6.33 iirc has an issue and you'll need to upgrade to 6.34. . If you have access to the support page inside the Falcon platform, run the script they have for collecting system info and submit a case to support. (not affiliated with CS, I came across a similar high CPU usage and middlemanned the comms between our Mac admin and CS).
hughrr 5y ago
Thanks for this reference. I was told I'm having this rolled out onto the infra I'm using. I have added this to the growing list of reasons to quit.
5y ago

qxmat 5y ago

Last year I tried to source an on-demand AV scanner because we'd exhausted what clamav was capable of (it non-deterministically craps out after 2Gb and can't scan binaries). If I couldn't find a suitable drop-in replacement I was going recommend an enterprise work-flow scanning solution that had AWS cloud integration (i.e. automatically move objects through ingress/output/quarantine S3 buckets or some kind of API we could hook to tag objects with a 'passed' label). My requirements were simple: it had to run in our cloud (AWS, eu-west-2) because of PII concerns, preferably "serverless"/ephemeral and we needed to scan assets our data analysts would use in their day to day operations (tiny files, massive files - a bit of everything). After a several time consuming days I had to give up because I found nothing. The Internet has become a mirage of av/malware scanning solutions that no longer exist (one of our guys reported that Sophos had a CLI tool - savscan - but when I looked it appeared to be discontinued). Almost every major vendor I came across offered an end-point product that ran on their cloud or had moved out of the malware/virus scanning market in favour of a DPI firewall. I was hampered by a lack of product documentation/feature comparison tables on the "enterprise" vendor marketing websites and sad "cloudification" of stacks that really ought to have a CLI binary.

huhtenberg 5y ago

> CrowdStrike Falcon, Palo Alto Cortex, Carbon Black These have absolutely massive issues with false positives that take ages to resolve even if reported.

allo37 5y ago

I don't know if this is still relevant, but around 2007 or so a buddy and I found the source code for a "research" keylogger trojan online. We compiled and ran it for kicks, and sure enough Avira (which I was using at the time, or was it still called AntiVir?), picked it up almost instantly. We swapped the order of a couple of instructions, recompiled, and glory be: Avira didn't flag it anymore! Since then I just find the least obtrusive AV and just try to avoid clicking on anything suspicious, because I'm convinced they all offer "meh" protection at best.

fomine3 5y ago

How could they differ?