badware busters - a 'me too' effort

i read yesterday that the folks at stopbadware.org and consumer reports webwatch are starting a community called badware busters to help ordninary people get malware off their computers...

the stated reasoning is that there's no central place where people can get this help, and they're correct there is no single central place, rather there are dozens of them... some of them even have the slashdot-esque features that badware busters seem to hope will set them apart....

that is if the folks at badware busters are even aware that there are so many communities already doing this... i'm really not sure what they're thinking or how they expect to become the central community for this sort of thing when there's already places like wilders security forums, castle cops, the communities that just about each and ever av vendor seems to set up, the long list of communities you can go to for help with hijackthis logs (and generally don't deal exclusively in hijackthis log analysis), various usenet newsgroups, etc...

dare to dream, guys/gals, but i just can't see you displacing all the other communities that are already out there (and castle cops takes this kind of assistance giving very seriously) and becoming the place to go for all your malware removal needs...

race to zero is no pwn2own

from mike rothman on the race to zero controversy:

It's like the PwnToOwn context at CanSec. Some folks will find some interesting holes and the vendors will patch them. Same deal here.

simply put, modifying known malware so that it no longer resembles known malware closely enough for anti-malware products to recognize it is not the same as finding new software flaws that need to be fixed...

with an infinite number of possible modifications, it's technically impossible for known-malware scanning producers to anticipate them all so they stay out of the pointless business of anticipating them entirely... as such failing to anticipate the ones used in this contest doesn't represent a flaw that needs to be fixed anymore than failing to read minds does... dealing with the new/unknown threats is the job of other technologies like behaviour-based HIPS (which i've already shown is available from a surprising number of traditional av vendors)...

coming from the guy who put me on to the phrase "mismatched expectations", this incite was a little off... but i guess i should expect as much when the prevailing wisdom in the security industry can't distinguish between malware research issues and vulnerability research issues...

all in all, the race to zero contest is really nothing like pwn2own... it's more like a cross between anti-virus fight-club and the consumer reports fiasco...

corrections for cytrap labs blog

here we go again... ok, this particular blog didn't accept my comment at all so instead of getting the text out of historical feed items for a comment aggregator feed i got them out of a backup i saved in google notebook (i backup my comments before submitting because i occasionally encounter problems during comment submission and need to resubmit)...

the article in question is Do not believe everything you read but you should reflect on it - anti-virus software tests which was about (you guessed it) the consumer reports controversy... my comment was as follows:

"This is more scientific than the test method used by Independent Security Evaluatiors (ISE) used by Consumer Reports to conduct these tests on its behalft?"

yes, retrospective testing is more scientific than testing with lab-made viruses... retrospective testing uses viruses from the real world while ISE's test used viruses meant to approximate those from the real world (ie. it simulated the processes by which viruses are created in the real world based on a variety assumptions which may or may not be valid)...

"A 40% detection rate in a retrospective test is seen as being pretty good for most anti-virus software because it means that it detects all the new malware appearing during 3 months by heuristics and generic detections."

??? 40% detection rate means it detected 40% of the viruses, not all of them... it's considered pretty good because most do much worse than 40%...

"Using currently-known viruses to measure the performance of older AV engines is based on the assumption that the viruses we know about today will be the same kind as those that we will see in the near future. Hence, what was unkown three months ago should be representative of new viruses in general?"

the only assumption here is your own that retrospective test results are supposed to be generalizable... the reason retrospective tests (and other tests for that matter) are performed over and over again is precisely because they are not individually generalizable and a general sense of how well a product does can only be gained from looking at trends across multiple tests...

"Just for the record, zoo viruses are commonly defined as “existing only in lab environments” and thus not ITW (in the wild) until leaked. If they only exist in lab environments, what might their origin be?"

just for the record this is an oversimplification of what zoo viruses are... they do not exist only in labs, they are simply believed to not be actively spreading in the wild... they can still exist all over the place, in vendor labs, in private collections, or in the hot little hands of those who simply haven't gotten around to trying to spread them yet...

"Further, where is the line to be drawn at “vendor created”? Vendors get viruses in various ways but sometimes provide compensation to people providing them (e.g., also called vulnerability research). Examples of this can be found in the Perrun JPEG virus proof of concept and the Commwarrior.a SymbianOS virus."

if those are supposed to be examples of viruses whose creators were compensated by the vendors then i think you need to provide some proof... although a certain famous name in the av industry is believed to have paid for viruses, that was a long time ago and those efforts helped him become a pariah in the av industry and community...

"The AVIEN open letter:
>Public letter concerning the Writing of Viruses & How it Does Not Teach about Virus Prevention (May 30, 2003)
is not necessarily very helpful. I even wonder why some of these well known av industry representatives let their name stand on this letter."

consider reading the signatures more closely - they are not just av industry representatives, there are lots of people on the list that are outside of the av industry...

" > “…it is not necessary and it is not useful to write computer viruses to learn how to protect against them.”
One could interpret this statement as saying something similar to: trust us we know best and do not need to explain ourselves to people like you."

or you could interpret it as simply the result of a great deal of online discussion that occurred elsewhere (in multiple venues)... petitions generally don't include all the conversations and arguments that lead up to their creation...

and that pretty much covers all the corrections i have saved up... for now...

the end of security experts

no, i'm not talking about some sort of apocalypse that's going to wipe out all the security experts, i'm talking about the fact that the very notion of a security expert is starting to become ridiculous...

what's brought this line of thinking on is the raging false authority syndrome being displayed in the security community over the recent consumer reports contraversy... everywhere i look i'm finding so-called security experts offering their opinions about how the anti-virus community is overreacting or people citing security experts when discussing virus related issues...

i have a computer science degree, does that make me an expert in (or qualified in any way to talk about) artificial intelligence? no... sure AI research is a computer science discipline but my computer science background was not in AI... in fact there are a number of computer science disciplines which are so far outside of my experience that i know better than to open my mouth about them most of the time... too bad this doesn't hold true for the computer security community...

see, the security domain is not a simple one and it's not getting any simpler as time goes by... it's a complex and diverse set of quasi-related fields and specialized disciplines and the reality is that it's no longer possible (and hasn't been for some time) for any one person to have expert knowledge of them all... so what we have instead of security experts are experts in some specialized security subdisciplines with good heads for a lot of the more generic security concepts... they call themselves (or are called by others) security experts but that's not really what they are, and the knowledge from their own particular area of expertise is not necessarily applicable to all other parts of the computer security domain...

that doesn't stop them, however, as the consumer reports contraversy clearly illustrated... anti-malware in general and anti-virus in particular is a highly specialized discipline that deals with a kind of threat unlike anything else currently in the computer security domain... unfortunately we still have security experts saying viruses artificially generated in a lab represent the real world more accurately than viruses from the real world, or likening the threat posed by viruses to the threat posed by remote code execution exploits, or that the only reason the anti-virus companies reacted the way they did was because consumer reports made their products look bad (in spite of the fact that retrospective testing does the same thing, or the fact that some of the companies complaining weren't even included in the consumer reports test), etc...

if these people have no real background in the anti-virus field, why should what they say about virus issues be given any weight above that of a novice? because they're security experts and the anti-virus field is part of the security domain? please - security experts are not experts in all the security related disciplines, usually only one or two... most don't even bother to get enough of a taste of the other disciplines outside their area of expertise to know the true extent to which their own knowledge can apply there, otherwise they wouldn't behave like authorities on subjects for which they quite obviously have no real qualifications - the epitome of false authority syndrome... most security experts have no appreciation for the limitations that computational complexity places on detection techniques, or for the autonomous nature of the threat, or the environmental conditions that caused the anti-virus community to evolve the way it has, or any of a myriad of other details that are required to be a true authority in the anti-virus field...

the title of security expert is dead, it just doesn't know it yet... it doesn't mean what people think it means anymore, it's just a way of putting on airs... next time someone gets called or calls themself a security expert ask yourself "is that like an animal expert?" and then ask yourself if you have a question about a particular type of insect, do you want to talk to an animal expert or an entomologist?...

reactions to the consumer reports virus creation effort

there's been surprisingly little attention paid to the fact that SANS internet storm center distributes malware but when news broke about consumer reports creating new viruses the shit definitely hit the fan...

authentium, mcafee, kaspersky labs, and eset all came out and expressed their disapproval and disappointment at consumer reports' irresponsible actions... sunbeltblog also came out with a great analysis of what's so wrong about what consumer reports did...

of course not everyone agrees... larry seltzer actually tries comparing writing viruses with writing exploits, apparently ignorant of the fact that, while exploits can demonstrate the existence of software flaws and therefore aid in their correction, viruses demonstrate no such flaws or anything else of comparable benefit to society... security curve also questions what all the commotion is about (and i've tried to share what i know there)...

that said, i think the most insightful comment (yes, prepare yourselves folks, i'm going to agree with someone again) came from david harley in his response to rob slade's securiteam blog entry... i'll paraphrase here - 1) you can test heuristics without creating new viruses, 2) people (even others in the security field) still don't understand av technology, and 3) people don't trust the av industry/community...

it's easy enough to get across the idea that you can test heurstics without creating new viruses, but the ignorance and mistrust are much bigger problems that really need to be addressed... more attention needs to be paid to the various social dimensions of the virus problem or these kinds of things will keep happening...