saw this post on the agnitum blog about how an older version of their technology was being detected as a stealthkit... basically they were keeping integrity information about files that had been previously scanned to optimize future scanning (no need to scan a file that hasn't changed) and hiding that integrity information using all too familiar means...
it reminded me of two things - first is yisreal radai's nearly 15 year old paper on integrity checking (due to his conclusion that to truly protect integrity information from attack it must be stored offline) and the second is the witch hunt that resulted from the misguided redefinition of rootkit to be anything that hides things (which has already dinged other security vendors - especially kaspersky for remarkably similar reasons)...
as the saying goes - those who cannot remember the past are condemned to repeat it...
Showing posts with label agnitum. Show all posts
Showing posts with label agnitum. Show all posts
Tuesday, June 24, 2008
Friday, March 21, 2008
the price of anti-virus
i found an interesting opinion on the pricing of anti-virus products over at the agnitum blog a while ago - basically mikhail penkovsky is saying (among other things) that part of the development cost should have gone away a long time ago... well, i have a different opinion...
i've often said that signature updates tell a known-malware scanner what to look for while engine updates tell a scanner where and how to look...
the need for signature updates is patently obvious - malware authors keep writing more malware so more signatures are required to detect the new malware... you might think that after a while, however, you wouldn't need to update where and how the scanner looks for things, there should only be so many ways and places to hide the malware, right?
wrong - not only are there basically an infinite number of ways for malware to perform all the functions we already know about, as new legitimate software is developed new opportunities for exploitation open up along-side them (ex. create a new document format that contains macros and watch new macro-based malware get developed)... furthermore, there are a number of things that scanners still don't do well enough that require more research and development (like seeing through packers and other obfuscation techniques)...
these are just a couple of the reasons why the underlying scanning technology itself is constantly being redeveloped and reworked and why the cost of that development has never gone away...
i've often said that signature updates tell a known-malware scanner what to look for while engine updates tell a scanner where and how to look...
the need for signature updates is patently obvious - malware authors keep writing more malware so more signatures are required to detect the new malware... you might think that after a while, however, you wouldn't need to update where and how the scanner looks for things, there should only be so many ways and places to hide the malware, right?
wrong - not only are there basically an infinite number of ways for malware to perform all the functions we already know about, as new legitimate software is developed new opportunities for exploitation open up along-side them (ex. create a new document format that contains macros and watch new macro-based malware get developed)... furthermore, there are a number of things that scanners still don't do well enough that require more research and development (like seeing through packers and other obfuscation techniques)...
these are just a couple of the reasons why the underlying scanning technology itself is constantly being redeveloped and reworked and why the cost of that development has never gone away...
Tuesday, June 26, 2007
looking for security wizards
well what do you know, the agnitum folks have come up with a quiz to test your security smarts...
25 out of 30 on my first try... that's 25 correct guesses at what the agnitum folks thought were the right answers since many of the questions didn't seem to include the right answers as far as i could tell - for example, since when is self-replication not the thing that most precisely characterizes a computer virus? this is a quiz to determine who's a security wizard, right? sure average folks might not be expected to know such details but we're talking about wizards here...
then there's question about what cannot be spyware that was accompanied by nothing but options that could be considered spyware... yes, it's possible to have self-replicating spyware (malware categories are not mutually exclusive), yes it's possible to have spyware that changes your browser's start page (otherwise spyware authors would just throw in that one extra feature to avoid having their creations labeled as spyware), and yes a keylogger is most definitely a kind of spyware (what, you think keeping track of what keys you typed and sending them to a 3rd party doesn't count as spying?)...
the quiz also doesn't tell you which questions you got wrong or what the right answers were so it doesn't really help the non-wizards learn and advance themselves... i actually think the underlying idea behind the quiz is a good one, but not if people can't learn from it...
then again, maybe they're just looking for security wizards to help them write a better quiz...
 |
| Are You an Internet Security Wizard? |
25 out of 30 on my first try... that's 25 correct guesses at what the agnitum folks thought were the right answers since many of the questions didn't seem to include the right answers as far as i could tell - for example, since when is self-replication not the thing that most precisely characterizes a computer virus? this is a quiz to determine who's a security wizard, right? sure average folks might not be expected to know such details but we're talking about wizards here...
then there's question about what cannot be spyware that was accompanied by nothing but options that could be considered spyware... yes, it's possible to have self-replicating spyware (malware categories are not mutually exclusive), yes it's possible to have spyware that changes your browser's start page (otherwise spyware authors would just throw in that one extra feature to avoid having their creations labeled as spyware), and yes a keylogger is most definitely a kind of spyware (what, you think keeping track of what keys you typed and sending them to a 3rd party doesn't count as spying?)...
the quiz also doesn't tell you which questions you got wrong or what the right answers were so it doesn't really help the non-wizards learn and advance themselves... i actually think the underlying idea behind the quiz is a good one, but not if people can't learn from it...
then again, maybe they're just looking for security wizards to help them write a better quiz...
Thursday, February 22, 2007
snake oil from agnitum
how do i put this succinctly without seeming overly personal? folks, stop and think about how you're using the P word... which word is that? well, take a look at this agnitum blog post and see if you can figure it out:
don't get me wrong, i know what the intended meaning of total malware protection is (it's supposed to mean that it offers a degree of protection from all types of malware, not all instances of it) but anyone who sits down and thinks about how the average person (with no knowledge of the malware field) will interpret that phrase should realize that average people will not understand or even conceive of that intended meaning... you know what they might understand though? that it's comprehensive, that it has full/total/complete coverage, or simply that it handles all types of malware... if you're going to write marketing material make sure you thoroughly consider how the average person thinks...
now at this point you might be thinking there goes kurt picking on the smallest little slip-up again, but there's more... snake oil isn't just about making outrageous claims, another hallmark of snake oil is the unthinking use of jargon... consider the following:
and yet there's still more... i understand they're licensing anti-malware technology from a vendor whose won the VB100 award but who is the vendor? wouldn't that be a good thing to tell people? wouldn't it be nice to be able to verify that that vendor actually won the VB100 award rather than taking agnitum's word for it? wouldn't it be nice to be able to look at the VB100 history to see how often the vendor won the award (since that is where the real significance of the VB100 award lies)? i mean really, if the vendor's engine is so great then the name should engender consumer trust, so why be obscure by basically referring to it as an unnamed award winning technology? what is there to hide?
you know what's really sad though? from the description it actually sounds like it's a pretty good engine (detection of all malware types integrated into a single light-weight client process) that really deserves a higher standard of promotion...
First of all, why did we decide to add total malware protection to our core firewall product?hmmmm, was it product? no it was protection, specifically total malware protection... i've said it before - the unqualified use of the word 'protection' is bad enough but to qualify it with a word like 'total' implies something about a product that just is not (and cannot be) true...
don't get me wrong, i know what the intended meaning of total malware protection is (it's supposed to mean that it offers a degree of protection from all types of malware, not all instances of it) but anyone who sits down and thinks about how the average person (with no knowledge of the malware field) will interpret that phrase should realize that average people will not understand or even conceive of that intended meaning... you know what they might understand though? that it's comprehensive, that it has full/total/complete coverage, or simply that it handles all types of malware... if you're going to write marketing material make sure you thoroughly consider how the average person thinks...
now at this point you might be thinking there goes kurt picking on the smallest little slip-up again, but there's more... snake oil isn't just about making outrageous claims, another hallmark of snake oil is the unthinking use of jargon... consider the following:
Using award-winning VB100 technology licensed from a leading malware expertnow i ask you, what is VB100 technology and what awards has it really won? actually knowing what you're talking about is a good first step towards not sounding like a snake oil peddler and that means knowing that VB100 isn't the technology but rather the award... maybe it's a grammatical slip-up by someone for whom english isn't their native tongue, but if so it stands in stark contrast with what is otherwise excellent english prose...
and yet there's still more... i understand they're licensing anti-malware technology from a vendor whose won the VB100 award but who is the vendor? wouldn't that be a good thing to tell people? wouldn't it be nice to be able to verify that that vendor actually won the VB100 award rather than taking agnitum's word for it? wouldn't it be nice to be able to look at the VB100 history to see how often the vendor won the award (since that is where the real significance of the VB100 award lies)? i mean really, if the vendor's engine is so great then the name should engender consumer trust, so why be obscure by basically referring to it as an unnamed award winning technology? what is there to hide?
you know what's really sad though? from the description it actually sounds like it's a pretty good engine (detection of all malware types integrated into a single light-weight client process) that really deserves a higher standard of promotion...
Subscribe to:
Posts (Atom)