trend micro and cloud watching

last thursday mike rothman wrote the following:

Is traditional signature-based AV dead? It's definitely on life-support, as Trend announces a cloud-based something or other. Will it work? Who knows, but clearly the sacred cow of AV will be served for dinner sooner rather than later. - Trend Micro release

if you're like mike and think this has anything to do with moving away from signature-based technology then you need to read that release a second time... or a third time... or an nth time - it doesn't really matter how many times you've read it before you need to read it again, especially the following passage:

By storing the majority of pattern files in an Internet cloud database and keeping them at a minimum on the endpoint, Trend Micro helps stop Web, file and email threats before they reach the end-user or the corporate network. This new approach lightens bandwidth consumption on customers’ networks and endpoints and provides faster and more comprehensive up-to-date protection.

in other words, it's still signature-based, they're just putting the signatures in the cloud rather than the endpoint now... it's not your grandmother's scanner but it's still signature-based av...

one of the benefits of letting this post stew a little is that i've gotten to see what others have said about the subject... as a not-so-accurate barometer of av innovation, amrit williams thinks it's the most innovative thing to come out of the av industry in the past decade but alan shimel rightly points out that it sounds a lot like something panda has been doing for some time now... i would add that both are conceptually reminiscent of the digital immune system developed by ibm (starting more than a decade ago) and sold to symantec (and we know what symantec does with the things it buys, or rather we don't)... it would be hard to imagine that either trend or panda came up with their 'in-the-cloud' architectures without taking a few lessons away from this progenitor and so i wonder if we can really say this innovation came about within the past decade at all...

race to zero is no pwn2own

from mike rothman on the race to zero controversy:

It's like the PwnToOwn context at CanSec. Some folks will find some interesting holes and the vendors will patch them. Same deal here.

simply put, modifying known malware so that it no longer resembles known malware closely enough for anti-malware products to recognize it is not the same as finding new software flaws that need to be fixed...

with an infinite number of possible modifications, it's technically impossible for known-malware scanning producers to anticipate them all so they stay out of the pointless business of anticipating them entirely... as such failing to anticipate the ones used in this contest doesn't represent a flaw that needs to be fixed anymore than failing to read minds does... dealing with the new/unknown threats is the job of other technologies like behaviour-based HIPS (which i've already shown is available from a surprising number of traditional av vendors)...

coming from the guy who put me on to the phrase "mismatched expectations", this incite was a little off... but i guess i should expect as much when the prevailing wisdom in the security industry can't distinguish between malware research issues and vulnerability research issues...

all in all, the race to zero contest is really nothing like pwn2own... it's more like a cross between anti-virus fight-club and the consumer reports fiasco...

a glimpse behind the kurt-ain

(it's times like this i wish i lived in australia - then i could be the wismer of oz...)

i got some 'link love' from mike rothman earlier this week that caught my eye... no word love, mind you, as it seems mike has decided i generally don't know what i'm talking about... hopefully our disagreements are over value judgments (like our respective moral compass' pointing is slightly different directions) rather than over facts, but that's not really what caught my eye... one of the reasons i read mike's blog is for the pointed criticism, it would be hypocritical of me to turn around and cry foul when that criticism is directed at me... what surprised me was mike's realization that i'm not in the anti-malware industry...

i generally don't write too much about myself on this blog, i don't think it's interesting or topical (though some schools of thought suggest it humanizes the blog and makes it easier for people to relate), but i thought i had been pretty transparent about who i am and where i fit in in the greater scheme of things in my about me post... mike now has me thinking that perhaps that's not the case...

so to start things off: i am not a member of the anti-malware industry... instead i'm a member of the anti-malware community... you know, those people who discuss the concepts with others online, who help people with malware problems, that sort of thing... i've done a bit of infiltration - an enlightening experience, but not really worth repeating... i collected viruses for a while, though i'm glad i stopped; with a half million malware projected for this year that would be like a full time job without the benefit of getting paid... i've done a bit of disassembly, though not so much that i ever got good at it, and there never really seemed to me to be a shortage of malware analysts... what there did seem to be a shortage of (at least at the time many moons ago) were people willing to get their hands dirty and help out their fellow man (or woman) with their immediate problems with viral infection and their more long term problem of learning how to cope with the reality of viruses in the future... at one time i committed myself to making sure that every plea for help in alt.comp.virus got an answer, but these days there are plenty of people down in the trenches now in multiple forums so i feel less pressure to do so myself... there's still that longer term problem, of course, which is why i put up my (admittedly under-maintained) av reference library site (to make the information more available), and why i spend so much time on this blog explaining things (when i'm not ranting on topics i know nothing about, of course)... i suppose you could say i've tried on roles the way some people try on personae (it was certainly the right developmental period)...

not being in the anti-malware industry means i don't have to wear the corporate muzzle, i can say what i like about the anti-malware field without consequences other than making some enemies and possibly making myself less employable in that field (and since i've never tried to be employed in that field and am not sure i could start wearing the corporate muzzle, that works out just fine)... i can criticize any and all vendors if i see fit (and i have)... i can point out their ethical misdeeds, their marketing mistakes, their snake-oil, their FUD, their hype, etc...

not being in the anti-malware industry also means i don't have as much insider knowledge as someone who is... the only insider knowledge that i have is what i've acquired by interacting with those who are part of the industry, but i've done a fair bit of that over the years...

second: i am not an IT/security professional... i'm not the guy that manages the networks or the desktops in my company, i don't decide whether the company roles out virtualization on it's servers or any of that stuff... i write code, and lucky for me i get to implement (and in some cases design) a variety of the security-related functions and features of my employer's product...

i'm also not under the illusion that the security professional's frame of reference is the only game in town... as technical as i may be sometimes, i generally adopt a more consumer-centric frame of reference with regards to the application of security controls... i like free tools and i like safe-hex and i think understanding the threat and the counter-measures helps a lot...

third (and this has nothing to do with mike's post, but it is something that comes up from time to time): i am not an expert... some people think i am, or think i consider myself to be one, but i'm not and i don't... i consider myself to be a specialist in the sense that i have specialized knowledge (something one tends to pick up when following a field for 18 years)... i have not and will not lay claim to the title of expert - i know experts in this field and they're far more knowledgeable than i...

finally (and this is probably of the most general interest to readers of this blog): there is nothing wrong with my shift key... once upon a time it was not entirely unusual for people to neglect using the shift key - and, if you haven't guessed from the distinction i make between hacker and cracker, i'm a little bit old-school... besides it's not like following traditional capitalization rules imparts any extra information... punctuation (whether properly used or misused as i'm want to do) is entirely sufficient to mark off the places where one statement ends and another begins... i am capable of following those rules, i just don't generally find it natural or necessary...

yes mr. rothman, there is a defense against drive-by downloads

in fact, there are several...

mike rothman's days of incite #5 for 2008 was about malware, and while he makes a good point about the inevitability of getting compromised by malware (it's something you really need to be prepared for, though some of us are still waiting) due in part to lack of user input needed for drive-by downloads to work and the difficulty in avoiding exposure to them, he manages to sow some fear, uncertainty, and doubt in the process by stating that there are no defenses against drive-by downloads...

well not to be contrarian, but there are in fact defenses against drive-by downloads... known-malware/exploit scanning in a layered service provider will block the old ones that get re-used (and we know old exploits get re-used) before they reach the browser or any other web content rendering component on the host...

a behavioural HIPS (or possibly even simple application whitelisting, depending on the circumstances) can conceivably stop known or unknown malware injected into the system through a drive-by download...

also, browsing from a sandbox will generally stop most things (known or unknown) coming in through a drive-by download from getting a foothold in the actual host system (leaving the intrusion in the sandbox itself)...

finally, not having the web rendering component that a particular drive-by download exploits installed and/or using a web-content whitelisting technology (such as the noscript firefox extension) can significantly reduce the vulnerable surface you present to the internet and thereby reduce your chances of being compromised...

remember folks, for every measure there is a counter-measure - drive-by downloads are not a magical super-attack that can't be stopped, they're just means of automatically installing malware when you visit a web page and the process can be blocked...

anti-virus as a commodity

i was reading the daily incite yesterday (as i tend to do) and i noticed one of the items was about anti-virus... it had an element that was pretty usual fare from mike rothman in that he talked about how this or that just reinforces his point that anti-virus has become a commodity - and i don't necessarily disagree with him, in fact i think i've said things that were more or less in line with that in the past...

however, as i was reading this particular instance i realized that there was a fundamental assumption to the idea that anti-virus is a commodity - the assumption that when it comes to choosing an anti-virus all malware is created more or less equal - and i began to wonder if that was really a justified assumption to make...

this may seem like nothing more than playing devil's advocate but humour me... let's look at what i think is a fairly typical thought pattern for calling av a commodity (from mike's post):

The one thing I come away with is that all the products are decent, thus I'm going to state the obvious. AV (and other malware defense) suites are true commodities. All stop viruses and other malware attacks.

so my question is what if we stopped treating the threats anti-virus deals with as one big amorphous mass but instead looked at the various subsets of malware and more specifically, drew a distinction between what is new and what is not... would av look like a commodity then? is the commoditization perspective born of an oversimplification of the problem? if we started paying specific attention to performance with new malware, wouldn't that provide a basis for vendors to differentiate themselves from the competition in a truly meaningful way? the retrospective testing at av-comparatives.org seem to show some significant variation in performance between the different products available so it certainly seems that if you drill down into the problem space that anti-malware products are suppose to address things can look a lot different than they do from a bird's eye view...

this isn't the only example of things looking different when you start considering the details... a few days earlier marcin wielgoszewski
posted this question about best of breed vs bundles... i have to admit if i were confronted with this question framed the way it was there i might actually go with bundles, but that really says more about the power of framing than it does about the efficacy of bundles... this is actually something that builds on the product class X is a commodity result from before because it only considers the presence of various broad classes of security technologies in the bundles and not the specific underlying properties of each implementation... if you were to again dig deeper into what the capabilities of the products are and evaluate what kind of coverage you get against the types of threat agents you're trying to defend against you're going to wind up not only with a much more granular picture but one that could easily lead to a different bundle selection... in fact, i feel rather confident that if you dug deep enough you might even see a picture where no bundle gave you satisfactory coverage... of course then you'd have to decide whether or not that level of granularity is worth it but that's another analysis entirely...

not that any of this is to say that anti-virus is not a commodity, i still think there's a level of abstraction or frame of reference where that's a perfectly valid thing to say - but it's not the only frame of reference... the more general you go the more true it becomes, but at the same time the more details get glossed over (and the devil is in the details)... i think it's important sometimes to question the assumptions that bind us to a particular frame of reference so as to remind ourselves that there are others out there that may be equally good or possibly even better depending on the circumstances...

where do stealthkit detectors belong

mike rothman brought up an interesting point today in a section of his daily incite - where does stealthkit (rootkit to those of you drinking the revisionist rootkit koolaid) belong? inside a larger security application suite (or perhaps a larger security application period) or on it's own as a separate tool? although they're often separate right now, mike thinks they probably shouldn't be...

but given how they operate and how best the fundamental technique they employ can be used, is merging them into larger products really reasonable?

most stealthkit detectors employ a generic detection technique known as a cross-view diff or cross-view analysis where essentially you look at some area of the computer in 2 or more different ways and see if there are any discrepancies between them... although most stealthkit detectors are trying to cut this particular corner, outside-the-box analysis is ultimately necessary to truly see through persistent stealthed malware... the av industry knew this back in the 90's (it was called clean booting back then, though microsoft has since recycled that term) but got microsoft's boot up their ass when NTFS became mainstream without any robust method to perform outside-the-box analysis on that type of file system so they've been squeaking by with safe-mode ever since... anti-spyware and other anti-malware apps that grew up in the interim have never even dealt with this methodology because active stealth went out of fashion for a number of years but for an anti-malware that deals specifically with stealth in a generic sort of way at least part of it's operation really should be done outside-the-box and that is going to set it apart from other anti-malware functionality...

as yet the only detector i know of that does an outside-the-box cross-view diff is the WinPE implementation of microsoft's strider ghostbuster rootkit detection technology but that's still just a research project... no one else does it because as yet microsoft have not made WinPE easily available to the public (though i've heard rumors this may change with vista) and the alternative, BartPE, must be generated by the user (due to copyright and licensing restrictions from microsoft) rather than distributed with the stealthkit detector, which is a not-so-simple task from the perspective of average-joe computer users...

but if the anti-stealthkit folks were to do things right, how well would the resulting product (that runs off a bootable cd) fit in with existing security apps? not very well would be my guess... it would be nice if anti-virus and other anti-malware apps could operate in a similar outside-the-box environment since stealth is just a means to hide what eventually becomes known-malware, but that defies centralized management consoles and scheduled scans and a variety of other convenience features (bloat) that they've accumulated over the years... outside-the-box is fundamentally at odds with convenience but it's necessary for reliable generic detection of stealthed objects so how can you reconcile stealth malware detection with the increasingly convenient unified anti-malware product?

go find some other argument

i'm going to preface what i'm about to say with this: i like security incite blog, i like it's content and i like it's name and i look forward to reading the daily incite each day...

that said, mike rothman needs to find a different angle to counter the anti-patchguard arguments than what he used here... it's pretty clear that it's an emotional argument, he criticizes what he perceives alex eckelberry's motives to be rather than arguing the facts...

here are the facts:

1. there are important security functions (functions that remain important in spite of vista's enhanced security) that are just not possible under the current state of affairs with 64bit vista and won't be possible for years to come...
2. microsoft security program manager stephen toulouse admits that functionality is missing from the currently supported API and that it won't be seen until sp1 or sp2 here...
3. alex makes a very good argument for why full kernel access is needed (if/when a new type of kernel access is required to address a novel threat, there's no way to address the problem in a timely fashion if you have to negotiate access for months/years with microsoft to get that access)...

it's not about whether microsoft has the right to change their product, obviously they do have the right... it's about the fact that they're hurting security by saying that it can only be achieved in a certain narrowly defined set of ways and making attempts to go outside that set (like when it becomes obvious that microsoft didn't think of everything) cause the computer to crash...

maybe alex is just looking out for his bottom line but that doesn't mean that he's wrong or that the issues he's raised don't matter... microsoft has made entire classes of security monitoring impossible and anyone who cares about security should care about that and anyone who doesn't think those techniques are going to be useful anymore (that vista will obviate the need for such techniques) doesn't understand malware... to paraphrase jeff goldblum in jurassic park 'malware will find a way'...

sure vista looks all new and shiny and secure, and it will probably make a dent in malware too (at least existing malware), but in the long run that doesn't amount to a hill of beans... windows 95 probably did more to kill the major malware threat of the day (11 years ago the major threat was boot sector viruses) than any other technology or event but it didn't stop malware, malware evolved (obviously as windows is now seen as a malware magnet) and continues to evolve and will continue to evolve in the future... in order to deal with a constantly evolving threat landscape you need flexibility and that flexibility isn't there, nor is it even on the table (microsoft has promised additional kernel access but they haven't promised full kernel access)...

no one is arguing that there isn't good reason for microsoft to block access to the kernel, but doing so without first implementing all the necessary officially supported alternatives? come on, you don't brick over your back door if you don't have a front door yet...