3 ms·

I also work for an AV company, but unlike Mikko - I do not think Flame or Stuxnet should be focused on. They do not cause malicious behavior to our users, there

by jgmmo 14y ago

I also work for an AV company, but unlike Mikko - I do not think Flame or Stuxnet should be focused on. They do not cause malicious behavior to our users, therefore our time will be better spent addressing real threats that steal credit card numbers and ruin OS's.

noahm 14y ago
Out of curiosity, which AV company do you work for? I want to make sure I never recommend that anybody purchase your products. Any software that exploits security flaws in OS or other system-level software needs to ring every alarm bell you've got. Sure Stuxnet, et al, target specific systems and hardware that are unlikely to belong to your customers, but Stuxnet's escape into the wild shows that mistakes or false assumptions were made by the designers and implementers. The software may not be intentionally malicious, but it's already behaving in ways not predicted by its authors. Yet you claim that I should just trust them and not worry that their software might be running on my system against my wishes? That's not what I, as a hypothetical customer of yours, pay you for.
- jgmmo 14y ago
  There is limited amount of time and resources to deal with an enormous number of new samples daily, would you prefer we focus on samples that a) cause real harm to live users? b) could theoretically be dangerous down the line? I am sorry if you disagree, but with over 50,000 new samples of malware out daily I personally think that all of our time would be better spent on zero days that actually are hurting out users today.
Create 14y ago
The story to pay attention to here is the collusion between big media companies who try to control what we do on our computers and computer-security companies who are supposed to be protecting us. Initial estimates are that more than half a million computers worldwide are infected with this Sony rootkit. Those are amazing infection numbers, making this one of the most serious internet epidemics of all time -- on a par with worms like Blaster, Slammer, Code Red and Nimda. What do you think of your antivirus company, the one that didn't notice Sony's rootkit as it infected half a million computers? And this isn't one of those lightning-fast internet worms; this one has been spreading since mid-2004. Because it spread through infected CDs, not through internet connections, they didn't notice? This is exactly the kind of thing we're paying those companies to detect -- especially because the rootkit was phoning home. But much worse than not detecting it before Russinovich's discovery was the deafening silence that followed. When a new piece of malware is found, security companies fall over themselves to clean our computers and inoculate our networks. Not in this case. http://www.schneier.com/blog/archives/2005/11/sonys_drm_rootk.html http://www.schneier.com/blog/archives/2005/11/sonys_drm_root...
- jgmmo 14y ago
  There is an army of senior citizens calling support everyday complaining about Rogue Antivirus's which say they are infected and to give them their CC number, as well as the popups/redirectors. Nobody is worried about the things they cannot see, and the things which are not directly harming them. It behooves us to focus on the things people do see, so that we do a better job of eliminating the malware that is giving them tangible issues. I'm not saying 'Flame is a non-issue, suspend all analysis of it by malware researchers!'. I am saying, that for most of us in the AV field this is a hand-to-hand combat type of industry and we don't have the time or resources to get all academic and hypothetical. We need to fix real infections on real machines, like yesterday!

by jgmmo 14y ago

noahm 14y ago

Out of curiosity, which AV company do you work for? I want to make sure I never recommend that anybody purchase your products. Any software that exploits security flaws in OS or other system-level software needs to ring every alarm bell you've got. Sure Stuxnet, et al, target specific systems and hardware that are unlikely to belong to your customers, but Stuxnet's escape into the wild shows that mistakes or false assumptions were made by the designers and implementers. The software may not be intentionally malicious, but it's already behaving in ways not predicted by its authors. Yet you claim that I should just trust them and not worry that their software might be running on my system against my wishes? That's not what I, as a hypothetical customer of yours, pay you for.

jgmmo 14y ago
There is limited amount of time and resources to deal with an enormous number of new samples daily, would you prefer we focus on samples that a) cause real harm to live users? b) could theoretically be dangerous down the line? I am sorry if you disagree, but with over 50,000 new samples of malware out daily I personally think that all of our time would be better spent on zero days that actually are hurting out users today.

Create 14y ago

The story to pay attention to here is the collusion between big media companies who try to control what we do on our computers and computer-security companies who are supposed to be protecting us. Initial estimates are that more than half a million computers worldwide are infected with this Sony rootkit. Those are amazing infection numbers, making this one of the most serious internet epidemics of all time -- on a par with worms like Blaster, Slammer, Code Red and Nimda. What do you think of your antivirus company, the one that didn't notice Sony's rootkit as it infected half a million computers? And this isn't one of those lightning-fast internet worms; this one has been spreading since mid-2004. Because it spread through infected CDs, not through internet connections, they didn't notice? This is exactly the kind of thing we're paying those companies to detect -- especially because the rootkit was phoning home. But much worse than not detecting it before Russinovich's discovery was the deafening silence that followed. When a new piece of malware is found, security companies fall over themselves to clean our computers and inoculate our networks. Not in this case. http://www.schneier.com/blog/archives/2005/11/sonys_drm_rootk.html http://www.schneier.com/blog/archives/2005/11/sonys_drm_root...

jgmmo 14y ago
There is an army of senior citizens calling support everyday complaining about Rogue Antivirus's which say they are infected and to give them their CC number, as well as the popups/redirectors. Nobody is worried about the things they cannot see, and the things which are not directly harming them. It behooves us to focus on the things people do see, so that we do a better job of eliminating the malware that is giving them tangible issues. I'm not saying 'Flame is a non-issue, suspend all analysis of it by malware researchers!'. I am saying, that for most of us in the AV field this is a hand-to-hand combat type of industry and we don't have the time or resources to get all academic and hypothetical. We need to fix real infections on real machines, like yesterday!