8 ms·

Schneier on Security: Is Antivirus Dead?

35 points by billpg 17y ago

Dilpil 17y ago
Will you really not notice any performance degradation from anti virus? Really?
- DannoHung 17y ago
  It is SO horrible. It's like if you stuck 30 pound weights on one hand of a sprinter.
  - stcredzero 17y ago
    I use ClamX AV. I have it set to do scans of new Downloads and scans late at night. I have no problems at all.
- motters 17y ago
  "you won't notice any performance degradation at all" O RLY?? I beg to differ. I've seen the PCs of friends and relations reduced to a pitiful level of performance by well known so-called "security" software.
  - stcredzero 17y ago
    Bad or inappropriate software of all sorts can do that. Security software is no different. My dad keeps trying to install security software which he discovers through pop-ups on Korean websites. Fortunately, I bought him a Mac, and most of that stuff is a *.exe file. Unfortunately, this is not enough! :(
    - fnid 17y ago
      Yep. Unfortunately, this is becoming more and more true. Typical computer users just don't know the difference between "safe computer use" and "unsafe computer use." It's the same as human viruses. If you do things that are safe, you dramatically reduce your chances of infection.
chaosmachine 17y ago
I spent 2 years working tech support for a large cable ISP. We offered a free antivirus/firewall package. In my experience, the AV software was more likely to break your PC than an actual virus, and we'd often get calls where people were infested with malware the AV package didn't stop. AV software gives you a false sense of security, imo.
stingraycharles 17y ago
"On the other hand, an antivirus program with up-to-date signatures will protect you from a lot of threats. It'll protect you against viruses, against spyware, against Trojans -- against all sorts of malware. It'll run in the background, automatically, and you won't notice any performance degradation at all" Now, this may be a bit off-topic, but does anyone know about which software he's talking ? I personally find that most of the virus scanners try desperately to let you know how effective they are, constantly notifying what they have done to help you, to validate their existence. On the other hand, you have the more minimalistic virus scanners, like ClamAV, but I really can't tell if they're effective or not. I fear they are not. Anyone has recommendations for a good virus scanner that doesn't suck ? Perhaps pg can make this a request for startups, please ? It's about time this whole industry stopped sucking. :)
- pxlpshr 17y ago
  Well I haven't used anti-virus in a long time since switching to OSX but when I was on Windows, I was always a big fan of ESET NOD32.
  - e40 17y ago
    Tech support in my company has to constantly deal with false positives of our software with NOD32. I don't know how effective it is catching real trojans/viruses, but I know it sucks at catching non-trojans/non-viruses.
    - nuclear_eclipse 17y ago
      Actually, it sounds like it's pretty good at catching non-viruses and non-trojans...
- dragonquest 17y ago
  ClamAV is actually pretty effective at detecting malware it knows about. I've seen it work on multiple occasion even with non in-the-wild viruses. However because it lacks real time scanning and cleaning, it's clearly not a first line of defense yet. A better bet would be F-Prot or Nod32 which seem far lighter and a tad more quiet about their business except when a malware is actually found (which is also customizable I believe). However, I see a hard task ahead of any startup that wants to come up in this field. Writing sig definitions for the 100000+ viruses already difficult is a massive initial undertaking. The older players already have most of it written down but a startup would have to put in a ton of effort just to catch up.
marltod 17y ago
Tools like time machine and vmware snapshots can make viruses less disastrous than before. You can rollback instead of re-imaging or worrying about removing all the malware.
- antonovka 17y ago
  Only if you're aware that the virus is running, and it doesn't do something disastrous in the meantime (eg, sniff your keystrokes while you enter a bank account number or log into the hospital records system).
- tomjen2 17y ago
  That is good and all, but does little when the badware steals your passwords to your online bank.
jodrellblank 17y ago
""" Examine a typical antivirus package and you'll see it knows about 75,000+ viruses that might infect your machine. Compare that to the legitimate 30 or so apps that I've installed on my machine, and you can see it's rather dumb to try to track 75,000 pieces of Badness when even a simpleton could track 30 pieces of Goodness. In fact, if I were to simply track the 30 pieces of Goodness on my machine, and allow nothing else to run, I would have simultaneously solved the following problems: * Spyware * Viruses * Remote Control Trojans * Exploits that involve executing pre-installed code that you don't use regularly Thanks to all the marketing hype around disclosing and announcing vulnerabilities, there are (according to some industry analysts) between 200 and 700 new pieces of Badness hitting the Internet every month. Not only is "Enumerating Badness" a dumb idea, it's gotten dumber during the few minutes of your time you've bequeathed me by reading this article. """ - http://www.ranum.com/security/computer_security/editorials/dumb/ http://www.ranum.com/security/computer_security/editorials/d...
- nuclear_eclipse 17y ago
  As Bruce mentioned in his article: "And whitelists aren't a panacea, either: they don't defend against malware that attaches itself to data files (think Word macro viruses), for example."
  - pragmatic 17y ago
    But this should be a solved (or at least solveable problem). You have complete control over email in the enterprise b/c you control the mail server. If you use a service like gmail then you can't even send certain attachments. I couldn't send .zip files the last I checked. Plus spam filtering has gotten better. I think white-listing could go a very long way towards solving the problem.
    - bockris 17y ago
      Hmmm. I can send zip files through GMail. However, I can't receive zip files through my work email which is a policy decision made by our network admins. (You can rename it .zipX or something like that and it will go through. They have been burnt by users clicking on any random attachment and getting Trojans and viruses.) I don't seem to be able to send an exe through GMail though.
bensummers 17y ago
The bit about users accessing services on any old computer becoming the norm is the bit which scares me. The idea of entering a password in a random computer with who know what key-logging malware installed scares me. Two-factor can only go so far, as it only limits the window of opportunity to between log in and log out. While I, and most technical people, guard our computers carefully and wouldn't use a computer owned by someone else for anything but anonymous web browsing, the average user is quite happy to use some terminal in an internet cafe.
pragmatic 17y ago
Can any one suggest a good white-listing software? I see he recommends Malwarebytes' Anti-Malware: http://www.malwarebytes.org/mbam.php http://www.malwarebytes.org/mbam.php However this looks like more of a scanner than a white-listing software. The other two he recommends look to be commercial only? Any suggestions? Looking for Windows 7 64 bit capability. Thanks
jdbeast00 17y ago
i went sans AV software when i installed windows 7. we are a long way from the days of windows 98.
dmfdmf 17y ago
I think the detection of virus signatures is a failing strategy. I have seen computers that I know are infected and scanning with multiple products leaves some of the bugs undetected. That said, it would be pretty stupid to run Windows today without a scanner. AVG and (believe it or not) Microsoft's Essential Security are good and free. The two major problems with virus scanners is that they bog the machine down. (AVG is starting to do this). The other problem, and I see this from all brands, they can detect a virus but cannot remove it. This is a serious problem today because it then requires an expensive tech visit to manually remove a virus.
billswift 17y ago
I posted the original with Schneier's and Ranum's pieces (http://searchsecurity.techtarget.com/magazinePrintFriendly/0,296905,sid14_gci1373562,00.html http://searchsecurity.techtarget.com/magazinePrintFriendly/0...) at about the same time this was posted - http://news.ycombinator.com/item?id=932940 http://news.ycombinator.com/item?id=932940

35 points by billpg 17y ago

Dilpil 17y ago

Will you really not notice any performance degradation from anti virus? Really?

DannoHung 17y ago
It is SO horrible. It's like if you stuck 30 pound weights on one hand of a sprinter.
- stcredzero 17y ago
  I use ClamX AV. I have it set to do scans of new Downloads and scans late at night. I have no problems at all.
motters 17y ago
"you won't notice any performance degradation at all" O RLY?? I beg to differ. I've seen the PCs of friends and relations reduced to a pitiful level of performance by well known so-called "security" software.
- stcredzero 17y ago
  Bad or inappropriate software of all sorts can do that. Security software is no different. My dad keeps trying to install security software which he discovers through pop-ups on Korean websites. Fortunately, I bought him a Mac, and most of that stuff is a *.exe file. Unfortunately, this is not enough! :(
  - fnid 17y ago
    Yep. Unfortunately, this is becoming more and more true. Typical computer users just don't know the difference between "safe computer use" and "unsafe computer use." It's the same as human viruses. If you do things that are safe, you dramatically reduce your chances of infection.

chaosmachine 17y ago

I spent 2 years working tech support for a large cable ISP. We offered a free antivirus/firewall package. In my experience, the AV software was more likely to break your PC than an actual virus, and we'd often get calls where people were infested with malware the AV package didn't stop. AV software gives you a false sense of security, imo.

stingraycharles 17y ago

"On the other hand, an antivirus program with up-to-date signatures will protect you from a lot of threats. It'll protect you against viruses, against spyware, against Trojans -- against all sorts of malware. It'll run in the background, automatically, and you won't notice any performance degradation at all" Now, this may be a bit off-topic, but does anyone know about which software he's talking ? I personally find that most of the virus scanners try desperately to let you know how effective they are, constantly notifying what they have done to help you, to validate their existence. On the other hand, you have the more minimalistic virus scanners, like ClamAV, but I really can't tell if they're effective or not. I fear they are not. Anyone has recommendations for a good virus scanner that doesn't suck ? Perhaps pg can make this a request for startups, please ? It's about time this whole industry stopped sucking. :)

pxlpshr 17y ago
Well I haven't used anti-virus in a long time since switching to OSX but when I was on Windows, I was always a big fan of ESET NOD32.
- e40 17y ago
  Tech support in my company has to constantly deal with false positives of our software with NOD32. I don't know how effective it is catching real trojans/viruses, but I know it sucks at catching non-trojans/non-viruses.
  - nuclear_eclipse 17y ago
    Actually, it sounds like it's pretty good at catching non-viruses and non-trojans...
dragonquest 17y ago
ClamAV is actually pretty effective at detecting malware it knows about. I've seen it work on multiple occasion even with non in-the-wild viruses. However because it lacks real time scanning and cleaning, it's clearly not a first line of defense yet. A better bet would be F-Prot or Nod32 which seem far lighter and a tad more quiet about their business except when a malware is actually found (which is also customizable I believe). However, I see a hard task ahead of any startup that wants to come up in this field. Writing sig definitions for the 100000+ viruses already difficult is a massive initial undertaking. The older players already have most of it written down but a startup would have to put in a ton of effort just to catch up.

marltod 17y ago

Tools like time machine and vmware snapshots can make viruses less disastrous than before. You can rollback instead of re-imaging or worrying about removing all the malware.

antonovka 17y ago
Only if you're aware that the virus is running, and it doesn't do something disastrous in the meantime (eg, sniff your keystrokes while you enter a bank account number or log into the hospital records system).
tomjen2 17y ago
That is good and all, but does little when the badware steals your passwords to your online bank.

jodrellblank 17y ago

""" Examine a typical antivirus package and you'll see it knows about 75,000+ viruses that might infect your machine. Compare that to the legitimate 30 or so apps that I've installed on my machine, and you can see it's rather dumb to try to track 75,000 pieces of Badness when even a simpleton could track 30 pieces of Goodness. In fact, if I were to simply track the 30 pieces of Goodness on my machine, and allow nothing else to run, I would have simultaneously solved the following problems: * Spyware * Viruses * Remote Control Trojans * Exploits that involve executing pre-installed code that you don't use regularly Thanks to all the marketing hype around disclosing and announcing vulnerabilities, there are (according to some industry analysts) between 200 and 700 new pieces of Badness hitting the Internet every month. Not only is "Enumerating Badness" a dumb idea, it's gotten dumber during the few minutes of your time you've bequeathed me by reading this article. """ - http://www.ranum.com/security/computer_security/editorials/dumb/ http://www.ranum.com/security/computer_security/editorials/d...

nuclear_eclipse 17y ago
As Bruce mentioned in his article: "And whitelists aren't a panacea, either: they don't defend against malware that attaches itself to data files (think Word macro viruses), for example."
- pragmatic 17y ago
  But this should be a solved (or at least solveable problem). You have complete control over email in the enterprise b/c you control the mail server. If you use a service like gmail then you can't even send certain attachments. I couldn't send .zip files the last I checked. Plus spam filtering has gotten better. I think white-listing could go a very long way towards solving the problem.
  - bockris 17y ago
    Hmmm. I can send zip files through GMail. However, I can't receive zip files through my work email which is a policy decision made by our network admins. (You can rename it .zipX or something like that and it will go through. They have been burnt by users clicking on any random attachment and getting Trojans and viruses.) I don't seem to be able to send an exe through GMail though.

bensummers 17y ago

The bit about users accessing services on any old computer becoming the norm is the bit which scares me. The idea of entering a password in a random computer with who know what key-logging malware installed scares me. Two-factor can only go so far, as it only limits the window of opportunity to between log in and log out. While I, and most technical people, guard our computers carefully and wouldn't use a computer owned by someone else for anything but anonymous web browsing, the average user is quite happy to use some terminal in an internet cafe.

pragmatic 17y ago

Can any one suggest a good white-listing software? I see he recommends Malwarebytes' Anti-Malware: http://www.malwarebytes.org/mbam.php http://www.malwarebytes.org/mbam.php However this looks like more of a scanner than a white-listing software. The other two he recommends look to be commercial only? Any suggestions? Looking for Windows 7 64 bit capability. Thanks

jdbeast00 17y ago

i went sans AV software when i installed windows 7. we are a long way from the days of windows 98.

dmfdmf 17y ago

I think the detection of virus signatures is a failing strategy. I have seen computers that I know are infected and scanning with multiple products leaves some of the bugs undetected. That said, it would be pretty stupid to run Windows today without a scanner. AVG and (believe it or not) Microsoft's Essential Security are good and free. The two major problems with virus scanners is that they bog the machine down. (AVG is starting to do this). The other problem, and I see this from all brands, they can detect a virus but cannot remove it. This is a serious problem today because it then requires an expensive tech visit to manually remove a virus.

billswift 17y ago

I posted the original with Schneier's and Ranum's pieces (http://searchsecurity.techtarget.com/magazinePrintFriendly/0,296905,sid14_gci1373562,00.html http://searchsecurity.techtarget.com/magazinePrintFriendly/0...) at about the same time this was posted - http://news.ycombinator.com/item?id=932940 http://news.ycombinator.com/item?id=932940