5 ms·

As far as you know. Even the dumb malware writers don't write stuff that pops up floating skulls and "OwNEd by CyBeRKiLLeR" messages anymore. It's all about sta

As far as you know. Even the dumb malware writers don't write stuff that pops up floating skulls and "OwNEd by CyBeRKiLLeR" messages anymore. It's all about staying on the machine, and staying silent. I hate this "I've been running without AV for ages, and I never saw any viruses" argument. Of course you didn't. Making you aware hasn't been the motive for a long, long time. It's virtually impossible to run a Windows (or Linux, or Mac) installation with the usual suspects--Java, Flash, Adobe Reader, etc.--without being exposed to good old, non-targeted malware. Take into account that most of it is distributed from "good" sites, and "if I don't see it, it must mean there's nothing there" and "I never go to any risky sites" prove pretty silly. I'm not saying that AV is the best solution, or even a good one--indeed it can even be what contains the vulnerabilities used to take over a machine--but there is a reason it exists. Let's not pretend that AV solves all ones problems, but let's also not pretend that it's completely ineffective. It's only ineffective if there really is no other (probable) way for things it detects to get through--which there is on most desktop operating systems unless you (manually) go to great lengths to isolate the different things you do. There are ways to make AV moot, but it rarely comes built-in or without user overhead/experience requirements. (Ironically, in Windows 8 anti-virus comes built-in.)

stinos 13y ago
for your 3rd paragraph: I'm not sure I'm following you - are you saying that virtually every machine is infected? How come? btw I have been running without AVG for ages on all kinds of systems. Once in a while I'm checking if my habits are still ok and run a bunch of standalone scans. They never find a single thing. Does that mean they all suck hard and that my machines are infected by newer and more invisble things than they can find? (note this is an honest question. I have no clue.)
- Piskvorrr 13y ago
  As I understand this, virtually every machine gets exposed to the garden-variety malware; whether it's vulnerable to the given exploit is a different matter (look at the obsolete Java and Flash plugins eeeverywhere). Moreover, it is also important whether the exploit has an appropriate payload for the given system (I have yet to see e.g. a browser-vector transmitted payload which would run on Linux - which says something about its marketshare, not necessarily about its security). And of course "absence of evidence is not evidence of absence," so either the scans suck hard, or you're clean; but barring a more specific (and probably not fully-automated) inspection, there's no way to tell.
  - thirsteh 13y ago
    You hit the nail on the head.
WayneDB 13y ago
And I hate the "I can't imagine how to do this, so it's not possible" argument. We have syslogs going back 7 years. You want to come audit our network? I'll bet you all of the money in my bank account that you find nothing. > with the usual suspects--Java, Flash, Adobe Reader, etc... Nobody in my house runs those. > It's all about staying on the machine, and staying silent. They have to communicate over the network at some point though. Otherwise, it'd be useless. So yeah - as far as I know - and that's pretty damn far.
- thirsteh 13y ago
  > And I hate the "I can't imagine how to do this, so it's not possible" argument. I can imagine how to do it. But I also know that 99.9% of people don't. > > with the usual suspects--Java, Flash, Adobe Reader, etc... > Nobody in my house runs those. That's very unusual, and you'll have to agree. Let's assume that you are really doing so much that AV is completely moot. You're still being reckless by giving people the impression that they can just uninstall it and continue doing what they were doing (i.e. using Java, Flash, Adobe Reader, etc.), and everything will be exactly the same.
  - WayneDB 13y ago
    No. I am not. Read my original post again where I said: ...if you know what you're doing. Where did I imply anything remotely close to what you just said?
    - thirsteh 13y ago
      Well, if you don't define what "if you know what you're doing" means, it could be anything from "running Chrome" to "using curl on an OpenBSD box and parsing the source manually." But I was referring to that and the general sentiment that "AV is shit and you can just uninstall it." Literally anything could be possible "if you know what you're doing" if you leave it that ambiguous.
      - WayneDB 13y ago
diminoten 13y ago
> It's virtually impossible to run a Windows (or Linux, or Mac) installation with the usual suspects--Java, Flash, Adobe Reader, etc.--without being exposed to good old, non-targeted malware. Take into account that most of it is distributed from "good" sites, and "if I don't see it, it must mean there's nothing there" and "I never go to any risky sites" prove pretty silly. Do you have more information about this? I wasn't aware that malware was just "floating" out in the ether. I have been staunchly in the camp of, "If you know what you're doing you can remain safe." but you seem convinced otherwise. Why?
- thirsteh 13y ago
  https://www.google.com/transparencyreport/safebrowsing/malware/#region=ALL&period=90&size=LARGE&compromised&attack&asn=57010&page=1 https://www.google.com/transparencyreport/safebrowsing/malwa... See "Compromised sites" at the bottom. In my experience, compromised sites and insecure ad networks are by far the most common means of distributing malware through legitimate sites. Even if you know what you are doing, you are very likely to come across sites running e.g. Wordpress, Drupal, etc. with shitty addons, e.g. timthumb, that have been compromised and are serving exploits through hidden iframes, redirecting you to bad pages, etc.
  - diminoten 13y ago
    What percentage of those exploits are 0day? Part of "knowing what you're doing" involves keeping your software up to date, after all. Commodity malware isn't a large threat if it can't run. Very cool link though, thanks.
    - thirsteh 13y ago
      I don't know (presumably few to none if Google is detecting them), but yes, I agree. You can be exposed but not be vulnerable.
Shorel 13y ago
In my Windows 7 partition I don't have Java or Adobe Reader. I only have the Chrome Flash plugin and my Steam games. Tell me how the virus manages to stay out of Sysinternals Autoruns, and I will panic with you. Otherwise, no antivirus is really necessary.
- thirsteh 13y ago
  > Tell me how the virus manages to stay out of Sysinternals Autoruns, and I will panic with you. There's a whole category of malware that does just that: https://en.wikipedia.org/wiki/Rootkit https://en.wikipedia.org/wiki/Rootkit The most common (and basic) way is to run as a child process inside svchost.exe. > Otherwise, no antivirus is really necessary. You don't care what happens in all the time that elapses from you're infected with something until you realize you are, if you realize it?
  - Shorel 13y ago
    The Sysinternals Autoruns utility shows a full set of things that run at startup, it is not just the start menu and some 'run' reg keys. It shows all services with their signature, all device drivers with their signature, etc. It validates the signatures too. I'm sure I only run signed services and drivers. Also, there's a rootkit detector Sysinternals utility. The page you linked describes how Mark Russinovich one of the writers of the Sysinternals utilities, discovered the Sony Rootkit. > You don't care what happens in all the time that elapses from you're infected with something until you realize you are, if you realize it? Of course I do, that's why I have the Sysinternals utilities at hand.
    - thirsteh 13y ago
      I think you're missing my point. You don't care what happens from the point you get affected until you find it in whatever utility--be it 5 seconds, 10 minutes, or 3 days? No matter how vigilantly you stare at procexp, you're not going to stop it from running.

stinos 13y ago

for your 3rd paragraph: I'm not sure I'm following you - are you saying that virtually every machine is infected? How come? btw I have been running without AVG for ages on all kinds of systems. Once in a while I'm checking if my habits are still ok and run a bunch of standalone scans. They never find a single thing. Does that mean they all suck hard and that my machines are infected by newer and more invisble things than they can find? (note this is an honest question. I have no clue.)

Piskvorrr 13y ago
As I understand this, virtually every machine gets exposed to the garden-variety malware; whether it's vulnerable to the given exploit is a different matter (look at the obsolete Java and Flash plugins eeeverywhere). Moreover, it is also important whether the exploit has an appropriate payload for the given system (I have yet to see e.g. a browser-vector transmitted payload which would run on Linux - which says something about its marketshare, not necessarily about its security). And of course "absence of evidence is not evidence of absence," so either the scans suck hard, or you're clean; but barring a more specific (and probably not fully-automated) inspection, there's no way to tell.
- thirsteh 13y ago
  You hit the nail on the head.

WayneDB 13y ago

And I hate the "I can't imagine how to do this, so it's not possible" argument. We have syslogs going back 7 years. You want to come audit our network? I'll bet you all of the money in my bank account that you find nothing. > with the usual suspects--Java, Flash, Adobe Reader, etc... Nobody in my house runs those. > It's all about staying on the machine, and staying silent. They have to communicate over the network at some point though. Otherwise, it'd be useless. So yeah - as far as I know - and that's pretty damn far.

thirsteh 13y ago
> And I hate the "I can't imagine how to do this, so it's not possible" argument. I can imagine how to do it. But I also know that 99.9% of people don't. > > with the usual suspects--Java, Flash, Adobe Reader, etc... > Nobody in my house runs those. That's very unusual, and you'll have to agree. Let's assume that you are really doing so much that AV is completely moot. You're still being reckless by giving people the impression that they can just uninstall it and continue doing what they were doing (i.e. using Java, Flash, Adobe Reader, etc.), and everything will be exactly the same.
- WayneDB 13y ago
  No. I am not. Read my original post again where I said: ...if you know what you're doing. Where did I imply anything remotely close to what you just said?
  - thirsteh 13y ago
    Well, if you don't define what "if you know what you're doing" means, it could be anything from "running Chrome" to "using curl on an OpenBSD box and parsing the source manually." But I was referring to that and the general sentiment that "AV is shit and you can just uninstall it." Literally anything could be possible "if you know what you're doing" if you leave it that ambiguous.
    - WayneDB 13y ago

diminoten 13y ago

> It's virtually impossible to run a Windows (or Linux, or Mac) installation with the usual suspects--Java, Flash, Adobe Reader, etc.--without being exposed to good old, non-targeted malware. Take into account that most of it is distributed from "good" sites, and "if I don't see it, it must mean there's nothing there" and "I never go to any risky sites" prove pretty silly. Do you have more information about this? I wasn't aware that malware was just "floating" out in the ether. I have been staunchly in the camp of, "If you know what you're doing you can remain safe." but you seem convinced otherwise. Why?

thirsteh 13y ago
https://www.google.com/transparencyreport/safebrowsing/malware/#region=ALL&period=90&size=LARGE&compromised&attack&asn=57010&page=1 https://www.google.com/transparencyreport/safebrowsing/malwa... See "Compromised sites" at the bottom. In my experience, compromised sites and insecure ad networks are by far the most common means of distributing malware through legitimate sites. Even if you know what you are doing, you are very likely to come across sites running e.g. Wordpress, Drupal, etc. with shitty addons, e.g. timthumb, that have been compromised and are serving exploits through hidden iframes, redirecting you to bad pages, etc.
- diminoten 13y ago
  What percentage of those exploits are 0day? Part of "knowing what you're doing" involves keeping your software up to date, after all. Commodity malware isn't a large threat if it can't run. Very cool link though, thanks.
  - thirsteh 13y ago
    I don't know (presumably few to none if Google is detecting them), but yes, I agree. You can be exposed but not be vulnerable.

Shorel 13y ago

In my Windows 7 partition I don't have Java or Adobe Reader. I only have the Chrome Flash plugin and my Steam games. Tell me how the virus manages to stay out of Sysinternals Autoruns, and I will panic with you. Otherwise, no antivirus is really necessary.

thirsteh 13y ago
> Tell me how the virus manages to stay out of Sysinternals Autoruns, and I will panic with you. There's a whole category of malware that does just that: https://en.wikipedia.org/wiki/Rootkit https://en.wikipedia.org/wiki/Rootkit The most common (and basic) way is to run as a child process inside svchost.exe. > Otherwise, no antivirus is really necessary. You don't care what happens in all the time that elapses from you're infected with something until you realize you are, if you realize it?
- Shorel 13y ago
  The Sysinternals Autoruns utility shows a full set of things that run at startup, it is not just the start menu and some 'run' reg keys. It shows all services with their signature, all device drivers with their signature, etc. It validates the signatures too. I'm sure I only run signed services and drivers. Also, there's a rootkit detector Sysinternals utility. The page you linked describes how Mark Russinovich one of the writers of the Sysinternals utilities, discovered the Sony Rootkit. > You don't care what happens in all the time that elapses from you're infected with something until you realize you are, if you realize it? Of course I do, that's why I have the Sysinternals utilities at hand.
  - thirsteh 13y ago
    I think you're missing my point. You don't care what happens from the point you get affected until you find it in whatever utility--be it 5 seconds, 10 minutes, or 3 days? No matter how vigilantly you stare at procexp, you're not going to stop it from running.