4 ms·

As someone who doesn't keep up with the crypto/security communities, one thing that has surprised me is how the cutting-edge news on this Flame story has been c

As someone who doesn't keep up with the crypto/security communities, one thing that has surprised me is how the cutting-edge news on this Flame story has been coming from antivirus vendors like Kaspersky Lab and Symantec. General sentiment seems to be that AV vendors are low-tech operations that don't have the best people when it comes to security. Other comments even on this very thread reflect this sentiment "timaelliott: Symantec is just jealous these guys can remove viruses from a machine so damn efficiently." Do these guys deserve more respect than we give them?

ahsteele 14y ago
Symantec is gobbling up headlines specifically to make you believe they are a high-tech operation. There are many other private firms and state operations which you will never hear about, running rings around Symantec.
- cldrope 14y ago
  As per normal. Anyone in the antivirus/virus community knows how much of a slow and often incompetent operation Symantec & Co are.
roc 14y ago
I'm not sure where the cutting edge work is being done in this case, but generally speaking we 'hear' from Kaspersky/Symantec in these sorts of press stories primarily because they have notable press/marketing operations with tight relationships to mainstream news organizations. Even if they were doing little more than independently confirming the cutting edge work of other firms, their voice is massively 'louder' and today's mass media landscape is tilted away from the independent investigation that we could rely upon to properly attribute the work being done in such technical situations.
- deleted 14y ago
  [deleted]
  - mentat 14y ago
    Ralph Langner did most of the research then Symantec refused to credit him. Also on many points the wikipedia article disagrees with your statements. Care to disclose if you have a vested interest? http://en.wikipedia.org/wiki/Stuxnet http://en.wikipedia.org/wiki/Stuxnet
    - deleted 14y ago
      [deleted]
notatoad 14y ago
IMHO, the antivirus makers deserve even less credit than we give them. They have been demonstrating their competence, so why is their software a bloated mess that slows computers to a crawl and still lets through unsophisticated crapware like the fake antivirus stuff?
- jlgreco 14y ago
  Marketting. The answer to that question is almost always a ill corporation that allows marketting to run free.
  - cldrope 14y ago
    Thank you for saying this. My biggest problem with all this media is that with knowledge of how it works, and having control of the C&C software, none of those idiots are just saying "For a day let's spoof all of their update centers and spam suicide signal to anyone who comms during that day." Which would kill a majority if not ALL of the virus out there. Another option is to not sit around proudly on their C&C centers, but that's an obvious start on reversing them as well as a relay point for data. Finding WHAT data EXACTLY they're hunting is the first step in finding who is doing it.
    - brian_cloutier 14y ago
      > My biggest problem with all this media is that with knowledge of how it works, and having control of the C&C software, none of those idiots are just saying "For a day let's spoof all of their update centers and spam suicide signal to anyone who comms during that day." Which would kill a majority if not ALL of the virus out there. It should be pointed out that they're not actually allowed to do that. As silly as it sounds, controlling another person's computer without their permission is illegal, no matter the reason. The best they can do is take over the /entire/ C&C chain, a monumental task, and then not send any commands to the infected machines, thereby rendering the virus inert. This has actually happened a few times and it's frustrating to everybody involved, you should read the post linked from here: http://news.ycombinator.com/item?id=3764345 http://news.ycombinator.com/item?id=3764345
lawnchair_larry 14y ago
Firstly, there is nothing at all special or interesting about how flame removes itself. It deletes a list of files that the author knows they created. Secondly, you have to remember that these companies employ many free-thinking humans with varied jobs and abilities. Among those are some skilled analysts who simply take apart viruses for a paycheck. A lot of AV companies have at least a few people who are best of breed at this stuff. They post writeups and share the work of what is interesting. Marketing is generally not involved in the technical blog posts that you see.
- sp332 14y ago
  Well it overwrites them with random bytes and then deletes them. But yeah, nothing too special.
- iuguy 14y ago
  > Firstly, there is nothing at all special or interesting about how flame removes itself. Actually I'd disagree. The interesting thing for me is that it overwrites memory locations to thwart memory forensics. This isn't a common thing at all, but is something that I covered in a talk at a DC4420 meeting a year or two ago.
guelo 14y ago
No matter what people say there are many world-class security engineers and researchers working at Symantec.
qdog 14y ago
They think it's 4 or 5 years old. I don't think that's very cutting edge.
tptacek 14y ago
Kaspersky runs a security news operation, competing with trade press operations like "Dark Reading", staffed with former writers from places like ZDNet. It is from what I can tell an extraordinarily effective marketing tool.
stonemetal 14y ago
It could be a case of PhDs who can't code. Basically being smart in one area doesn't make you smart in another, and in fact will often blind you to other areas. So poor UX and the always behind nature of AV(attackers can see what you have done but you can't see what they are up to until it is too late) means you always appear incompetent no matter how good you are.

ahsteele 14y ago

Symantec is gobbling up headlines specifically to make you believe they are a high-tech operation. There are many other private firms and state operations which you will never hear about, running rings around Symantec.

cldrope 14y ago
As per normal. Anyone in the antivirus/virus community knows how much of a slow and often incompetent operation Symantec & Co are.

roc 14y ago

I'm not sure where the cutting edge work is being done in this case, but generally speaking we 'hear' from Kaspersky/Symantec in these sorts of press stories primarily because they have notable press/marketing operations with tight relationships to mainstream news organizations. Even if they were doing little more than independently confirming the cutting edge work of other firms, their voice is massively 'louder' and today's mass media landscape is tilted away from the independent investigation that we could rely upon to properly attribute the work being done in such technical situations.

deleted 14y ago
[deleted]
- mentat 14y ago
  Ralph Langner did most of the research then Symantec refused to credit him. Also on many points the wikipedia article disagrees with your statements. Care to disclose if you have a vested interest? http://en.wikipedia.org/wiki/Stuxnet http://en.wikipedia.org/wiki/Stuxnet
  - deleted 14y ago
    [deleted]

notatoad 14y ago

IMHO, the antivirus makers deserve even less credit than we give them. They have been demonstrating their competence, so why is their software a bloated mess that slows computers to a crawl and still lets through unsophisticated crapware like the fake antivirus stuff?

jlgreco 14y ago
Marketting. The answer to that question is almost always a ill corporation that allows marketting to run free.
- cldrope 14y ago
  Thank you for saying this. My biggest problem with all this media is that with knowledge of how it works, and having control of the C&C software, none of those idiots are just saying "For a day let's spoof all of their update centers and spam suicide signal to anyone who comms during that day." Which would kill a majority if not ALL of the virus out there. Another option is to not sit around proudly on their C&C centers, but that's an obvious start on reversing them as well as a relay point for data. Finding WHAT data EXACTLY they're hunting is the first step in finding who is doing it.
  - brian_cloutier 14y ago
    > My biggest problem with all this media is that with knowledge of how it works, and having control of the C&C software, none of those idiots are just saying "For a day let's spoof all of their update centers and spam suicide signal to anyone who comms during that day." Which would kill a majority if not ALL of the virus out there. It should be pointed out that they're not actually allowed to do that. As silly as it sounds, controlling another person's computer without their permission is illegal, no matter the reason. The best they can do is take over the /entire/ C&C chain, a monumental task, and then not send any commands to the infected machines, thereby rendering the virus inert. This has actually happened a few times and it's frustrating to everybody involved, you should read the post linked from here: http://news.ycombinator.com/item?id=3764345 http://news.ycombinator.com/item?id=3764345

lawnchair_larry 14y ago

Firstly, there is nothing at all special or interesting about how flame removes itself. It deletes a list of files that the author knows they created. Secondly, you have to remember that these companies employ many free-thinking humans with varied jobs and abilities. Among those are some skilled analysts who simply take apart viruses for a paycheck. A lot of AV companies have at least a few people who are best of breed at this stuff. They post writeups and share the work of what is interesting. Marketing is generally not involved in the technical blog posts that you see.

sp332 14y ago
Well it overwrites them with random bytes and then deletes them. But yeah, nothing too special.
iuguy 14y ago
> Firstly, there is nothing at all special or interesting about how flame removes itself. Actually I'd disagree. The interesting thing for me is that it overwrites memory locations to thwart memory forensics. This isn't a common thing at all, but is something that I covered in a talk at a DC4420 meeting a year or two ago.

guelo 14y ago

No matter what people say there are many world-class security engineers and researchers working at Symantec.

qdog 14y ago

They think it's 4 or 5 years old. I don't think that's very cutting edge.

tptacek 14y ago

Kaspersky runs a security news operation, competing with trade press operations like "Dark Reading", staffed with former writers from places like ZDNet. It is from what I can tell an extraordinarily effective marketing tool.

stonemetal 14y ago

It could be a case of PhDs who can't code. Basically being smart in one area doesn't make you smart in another, and in fact will often blind you to other areas. So poor UX and the always behind nature of AV(attackers can see what you have done but you can't see what they are up to until it is too late) means you always appear incompetent no matter how good you are.