4 ms·

" the attackers tested them against all of the relevant antivirus products on the market" And the other bad guys wouldn't be able to do this? There are only 2-

" the attackers tested them against all of the relevant antivirus products on the market" And the other bad guys wouldn't be able to do this? There are only 2-3 common anti-virus products it's not hard to check if you are detected by Mcaffee/Symantec/AVG Most antivirus products simply check for signatures. That way you keep paying for updates and they sell themselves on how many 1000s of viruses they detect. Yes you can't have perfect heuristics and some of these are operating system issues - why does browsing a USB key run a program, why can a game on my phone access to my address book, why can an app connect to the internet without me knowing. At this point do we just give up on both antivirus AND using general computers to access the web? Should we just use settop boxes with no persistent writeable storage?

lawnchair_larry 14y ago
Most antivirus products simply check for signatures. No, I don't think a single AV product can be described this way for many years now. But people like to repeat it.
- excuse-me 14y ago
  In which case the zero day isn't a real excuse. If you aren't checking for specific exploit code signatures then if a particular exploit is an unknown zero day or not doesn't matter. Perhaps it's time to switch back to Harvard architecture. Programs and data are separate - you can't change program codeand you can't execute data.
  - CWuestefeld 14y ago
    In which case the zero day isn't a real excuse. 0-day exploits aren't the problem. You're focusing on just one type of malware behavior. Even if all of our software today was free of exploits, it wouldn't do anything to stop the bad guys from building trojan horses, and using that to bootstrap into broader pwning.
  - dmak 14y ago
    You say it as if checking for signatures it the ONLY effective method and you seem to be saying it's not that effective, so all AV's are useless. Well, it's not the only method and there are other effective methods.
jerf 14y ago
"And the other bad guys wouldn't be able to do this?" Yes, absolutely. Part of the fear is that they indeed have. But your average bad guy isn't an intelligence agency. The antivirus vendors can outclass the guy in a basement, or even a few guys working in a basement, and right now our threat profile is such that stopping those guys is still a big gain. There is definitely a large class of threats they can prevent.
- terangdom 14y ago
  I know for a fact that the average bad guy does this. Google "fud crypter", they are programs that take malware and makes it Fully UnDetectable by encrypting it, similar to how upx does it. Even skiddies use them.
  - jerf 14y ago
    Heh, I went back and forth between highlighting the "can" in my post. I think you can make a great case that they do not do all the things they could be doing, and there's been rather more focus on the sort of things that have produced bloatware rather than better virus scanning. But it should be pointed out that in the arms race it should generally be expected that the mid-level underground is always pretty much exactly one step ahead of Symantec etc. It's the nature of the arms race that they are in that the attackers have the temporal advantage. The question is less about whether a given technique works today and more about how long it works. The big advantage an intelligence agency and a large attacker has that doesn't apply to the mid-level underground is that their malware won't (or shouldn't) be detected by the various early-detection techniques that the anti-virus companies have, because they aren't necessarily just going to release their stuff into any place the antivirus company will see. Ideally, they'll simply never see it, which is why its interesting when these "escape".

lawnchair_larry 14y ago

Most antivirus products simply check for signatures. No, I don't think a single AV product can be described this way for many years now. But people like to repeat it.

excuse-me 14y ago
In which case the zero day isn't a real excuse. If you aren't checking for specific exploit code signatures then if a particular exploit is an unknown zero day or not doesn't matter. Perhaps it's time to switch back to Harvard architecture. Programs and data are separate - you can't change program codeand you can't execute data.
- CWuestefeld 14y ago
  In which case the zero day isn't a real excuse. 0-day exploits aren't the problem. You're focusing on just one type of malware behavior. Even if all of our software today was free of exploits, it wouldn't do anything to stop the bad guys from building trojan horses, and using that to bootstrap into broader pwning.
- dmak 14y ago
  You say it as if checking for signatures it the ONLY effective method and you seem to be saying it's not that effective, so all AV's are useless. Well, it's not the only method and there are other effective methods.

jerf 14y ago

"And the other bad guys wouldn't be able to do this?" Yes, absolutely. Part of the fear is that they indeed have. But your average bad guy isn't an intelligence agency. The antivirus vendors can outclass the guy in a basement, or even a few guys working in a basement, and right now our threat profile is such that stopping those guys is still a big gain. There is definitely a large class of threats they can prevent.

terangdom 14y ago
I know for a fact that the average bad guy does this. Google "fud crypter", they are programs that take malware and makes it Fully UnDetectable by encrypting it, similar to how upx does it. Even skiddies use them.
- jerf 14y ago
  Heh, I went back and forth between highlighting the "can" in my post. I think you can make a great case that they do not do all the things they could be doing, and there's been rather more focus on the sort of things that have produced bloatware rather than better virus scanning. But it should be pointed out that in the arms race it should generally be expected that the mid-level underground is always pretty much exactly one step ahead of Symantec etc. It's the nature of the arms race that they are in that the attackers have the temporal advantage. The question is less about whether a given technique works today and more about how long it works. The big advantage an intelligence agency and a large attacker has that doesn't apply to the mid-level underground is that their malware won't (or shouldn't) be detected by the various early-detection techniques that the anti-virus companies have, because they aren't necessarily just going to release their stuff into any place the antivirus company will see. Ideally, they'll simply never see it, which is why its interesting when these "escape".