6 ms·

"consumer-grade antivirus products can’t protect against targeted malware created by well-resourced nation-states with bulging budgets" Sorry - NO. These aren'

"consumer-grade antivirus products can’t protect against targeted malware created by well-resourced nation-states with bulging budgets" Sorry - NO. These aren't some super secret stealth aircraft needing special materials and billions of $ to develop. They are programming the same Windows targets using the same compilers, generating the same instructions using the same system calls. Yes they were clever to target the particular facility and to hide the code. But they didn't build anything that some other malicous hacker couldn't build. "And the zero-day exploits used in these attacks are unknown to antivirus companies by definition." I must try that excuse. The bugs in my software are by definition unknown so I can't be expected to have fixed them. So exactly what is the point of virus scanners? If all they are doing is checking for the obvious signatures in email attachments called "naked pictures of whoever readme.exe" to look for well known threats isn't the solution simply for the user to not be a moron?

jerf 14y ago
"'consumer-grade antivirus products can’t protect against targeted malware created by well-resourced nation-states with bulging budgets'" That's not the relevant bit. This is the relevant bit (emphasis mine): "As far as we can tell, before releasing their malicious codes to attack victims, the attackers tested them against all of the relevant antivirus products on the market to make sure that the malware wouldn’t be detected." This means that they can be certain they've bypassed the signatures, and whatever imperfect heuristics are being used have been bypassed, with the attackers essentially having all the time in the world to play with and understand the heuristics, up to and including a complete disassembly of the heuristics if necessary. And you can't have perfect heuristics (hi, halting problem!). Yes, when the enemy has full access to all these things and sufficient resources to use them, the antivirus loses. Other malicious hackers don't have this scale of resources, and that's the sole reason they can't do it.
- excuse-me 14y ago
  " the attackers tested them against all of the relevant antivirus products on the market" And the other bad guys wouldn't be able to do this? There are only 2-3 common anti-virus products it's not hard to check if you are detected by Mcaffee/Symantec/AVG Most antivirus products simply check for signatures. That way you keep paying for updates and they sell themselves on how many 1000s of viruses they detect. Yes you can't have perfect heuristics and some of these are operating system issues - why does browsing a USB key run a program, why can a game on my phone access to my address book, why can an app connect to the internet without me knowing. At this point do we just give up on both antivirus AND using general computers to access the web? Should we just use settop boxes with no persistent writeable storage?
  - lawnchair_larry 14y ago
    Most antivirus products simply check for signatures. No, I don't think a single AV product can be described this way for many years now. But people like to repeat it.
    - excuse-me 14y ago
      In which case the zero day isn't a real excuse. If you aren't checking for specific exploit code signatures then if a particular exploit is an unknown zero day or not doesn't matter. Perhaps it's time to switch back to Harvard architecture. Programs and data are separate - you can't change program codeand you can't execute data.
      - CWuestefeld 14y ago
        In which case the zero day isn't a real excuse. 0-day exploits aren't the problem. You're focusing on just one type of malware behavior. Even if all of our software today was free of exploits, it wouldn't do anything to stop the bad guys from building trojan horses, and using that to bootstrap into broader pwning.
      - dmak 14y ago
        You say it as if checking for signatures it the ONLY effective method and you seem to be saying it's not that effective, so all AV's are useless. Well, it's not the only method and there are other effective methods.
  - jerf 14y ago
    "And the other bad guys wouldn't be able to do this?" Yes, absolutely. Part of the fear is that they indeed have. But your average bad guy isn't an intelligence agency. The antivirus vendors can outclass the guy in a basement, or even a few guys working in a basement, and right now our threat profile is such that stopping those guys is still a big gain. There is definitely a large class of threats they can prevent.
    - 14y ago
- terangdom 14y ago
  >And you can't have perfect heuristics 1. All my computers have finite memory 2. You could in theory make heuristics with false positives but without false negatives.
  - archangel_one 14y ago
    It's not that theoretical, the following complex program fits that description: def IsProgramAVirus(program): return True But it's not particularly useful. In practice the false positive rate is extremely important, because if it gets too annoying users will switch it off.
    - terangdom 14y ago
      In the best of worlds, developers could make an effort not to do anything shady, like self modifying code, dll-injection etc, making heuristics complaining about such behaviours viable.
- planetguy 14y ago
  So what they're saying is: "We can't possibly defend against any attack if the attacker bothers to take the time to test their attack against our software." That's a startling admission, not just because they're saying "our software ain't that good" but because they've also gone and told you exactly how to defeat it. [insert conspiracy theory here]
  - berntb 14y ago
    A nation state might have access to the antivirus source code (and maybe some of the ex-programmers (or present!) as consultants). What was it the guy said, who was poisoned with Polonium in London? Something like "Spy organisations are made to compete with other spy organisations, with budgets in the billions. As a private person, you're hopelessly outmatched."
  - Achshar 14y ago
    > they've also gone and told you exactly how to defeat it. No, what they said is that since they [hackers] can test their code with antivirus before deploying, they can be sure of the fact that it wont be detected. So it's obvious that to "defeat" the antivirus, they have to test against it. It's in no way a solution. Anyone with a little common sense will tell you that to defeat an antivirus, the best way is to test against it before you release your malware.
clarky07 14y ago
"isn't the solution simply for the user to not be a moron" This. I haven't used an antivirus program in a long time.
scott_s 14y ago
Billions, no, but certainly millions, if not tens of millions. If 10 people worked on Stuxnet for a year (this includes programmers and managers across both the US and Israel), that's roughly $1 million. And I would be surprised if there was just 10 people a year working on this between both the US and Israeli governments. So, yes, they're using the same platform as other hackers. But I think you are understating the scope of what a team of dedicated people with governmental approval and budgets can accomplish by just calling it "clever."

jerf 14y ago

"'consumer-grade antivirus products can’t protect against targeted malware created by well-resourced nation-states with bulging budgets'" That's not the relevant bit. This is the relevant bit (emphasis mine): "As far as we can tell, before releasing their malicious codes to attack victims, the attackers tested them against all of the relevant antivirus products on the market to make sure that the malware wouldn’t be detected." This means that they can be certain they've bypassed the signatures, and whatever imperfect heuristics are being used have been bypassed, with the attackers essentially having all the time in the world to play with and understand the heuristics, up to and including a complete disassembly of the heuristics if necessary. And you can't have perfect heuristics (hi, halting problem!). Yes, when the enemy has full access to all these things and sufficient resources to use them, the antivirus loses. Other malicious hackers don't have this scale of resources, and that's the sole reason they can't do it.

excuse-me 14y ago
" the attackers tested them against all of the relevant antivirus products on the market" And the other bad guys wouldn't be able to do this? There are only 2-3 common anti-virus products it's not hard to check if you are detected by Mcaffee/Symantec/AVG Most antivirus products simply check for signatures. That way you keep paying for updates and they sell themselves on how many 1000s of viruses they detect. Yes you can't have perfect heuristics and some of these are operating system issues - why does browsing a USB key run a program, why can a game on my phone access to my address book, why can an app connect to the internet without me knowing. At this point do we just give up on both antivirus AND using general computers to access the web? Should we just use settop boxes with no persistent writeable storage?
- lawnchair_larry 14y ago
  Most antivirus products simply check for signatures. No, I don't think a single AV product can be described this way for many years now. But people like to repeat it.
  - excuse-me 14y ago
    In which case the zero day isn't a real excuse. If you aren't checking for specific exploit code signatures then if a particular exploit is an unknown zero day or not doesn't matter. Perhaps it's time to switch back to Harvard architecture. Programs and data are separate - you can't change program codeand you can't execute data.
    - CWuestefeld 14y ago
      In which case the zero day isn't a real excuse. 0-day exploits aren't the problem. You're focusing on just one type of malware behavior. Even if all of our software today was free of exploits, it wouldn't do anything to stop the bad guys from building trojan horses, and using that to bootstrap into broader pwning.
    - dmak 14y ago
      You say it as if checking for signatures it the ONLY effective method and you seem to be saying it's not that effective, so all AV's are useless. Well, it's not the only method and there are other effective methods.
- jerf 14y ago
  "And the other bad guys wouldn't be able to do this?" Yes, absolutely. Part of the fear is that they indeed have. But your average bad guy isn't an intelligence agency. The antivirus vendors can outclass the guy in a basement, or even a few guys working in a basement, and right now our threat profile is such that stopping those guys is still a big gain. There is definitely a large class of threats they can prevent.
  - 14y ago
terangdom 14y ago
>And you can't have perfect heuristics 1. All my computers have finite memory 2. You could in theory make heuristics with false positives but without false negatives.
- archangel_one 14y ago
  It's not that theoretical, the following complex program fits that description: def IsProgramAVirus(program): return True But it's not particularly useful. In practice the false positive rate is extremely important, because if it gets too annoying users will switch it off.
  - terangdom 14y ago
    In the best of worlds, developers could make an effort not to do anything shady, like self modifying code, dll-injection etc, making heuristics complaining about such behaviours viable.
planetguy 14y ago
So what they're saying is: "We can't possibly defend against any attack if the attacker bothers to take the time to test their attack against our software." That's a startling admission, not just because they're saying "our software ain't that good" but because they've also gone and told you exactly how to defeat it. [insert conspiracy theory here]
- berntb 14y ago
  A nation state might have access to the antivirus source code (and maybe some of the ex-programmers (or present!) as consultants). What was it the guy said, who was poisoned with Polonium in London? Something like "Spy organisations are made to compete with other spy organisations, with budgets in the billions. As a private person, you're hopelessly outmatched."
- Achshar 14y ago
  > they've also gone and told you exactly how to defeat it. No, what they said is that since they [hackers] can test their code with antivirus before deploying, they can be sure of the fact that it wont be detected. So it's obvious that to "defeat" the antivirus, they have to test against it. It's in no way a solution. Anyone with a little common sense will tell you that to defeat an antivirus, the best way is to test against it before you release your malware.

clarky07 14y ago

"isn't the solution simply for the user to not be a moron" This. I haven't used an antivirus program in a long time.

scott_s 14y ago

Billions, no, but certainly millions, if not tens of millions. If 10 people worked on Stuxnet for a year (this includes programmers and managers across both the US and Israel), that's roughly $1 million. And I would be surprised if there was just 10 people a year working on this between both the US and Israeli governments. So, yes, they're using the same platform as other hackers. But I think you are understating the scope of what a team of dedicated people with governmental approval and budgets can accomplish by just calling it "clever."