expert misuse of the term "virus"

in the past, the argument many experts have used against putting in the effort to actually correct people's misconceptions about what a computer virus is and what it does and how it's different from other forms of malware have centered on the idea that it doesn't really matter to a victim what kind of malware they have. when they have malware on their computer, all they care about is getting rid of it. i can understand this school of thought, even though i've never agreed with it. however, the world has changed. 

this is a post stuxnet world and defenders/victims aren't the only ones we need to consider anymore. we now have people barking orders to create digital weapons, and the details of those orders matter. if they say make me a virus then someone will make them a virus even if they didn't understand what they were asking for - and there's evidence to suggest they don't. 

stuxnet is generally believed to have been a targeted, covert operation, but it used a noisy, untargetable* type of malware - a computer virus (or more specifically a worm). there were and are better ways to achieve the ends we believe the creators of stuxnet were after, so one can only assume that high level decisions were made in ignorance of the differences between malware types and the consequences those differences would have on that type of operation.

the question, then, of whether to put in the effort to educate people about the proper use of the term virus can no longer be answered by looking exclusively at the victims who want their computers to be clean. it is now also necessary to consider aggressors who want to use malware as a weapon to serve national interests. as misguided as such behaviour is, we have to accept that it's happened and will continue to happen, and actually knowing the differences between malware types may mean the difference between a surgically precise operation, or one with a lot of collateral damage. 

this isn't to say that i think we should start helping aggressors create and/or launch their digital weapons. i still don't believe in helping the bad guys, and even if i believed such nationalistic aggressors weren't bad guys (which i don't), i don't believe there's any way to help them without also helping those who are much more unambiguously bad. what i am saying, however, is that this particular form of ignorance that experts have been too lazy to address can cause real harm and ignoring it means ignoring the opportunity to reduce the unintended harm such people will cause.

(*many believe stuxnet was highly targeted, but there's a distinction to be made. while it's destructive payload was highly targeted to a very specific environment, it's self-replication was not - it spread far beyond it's intended target)

an inconvenient truth about race to zero

from noah shiffman's article av vendors race-to-zero clue:

New viruses will not be created and no modified or variant code will be publicly released.

it's amazing to me how many people don't seem to realize that when you modify something you are effectively creating something new... this has been one of the more prevalent misunderstandings i've seen from people in favour of the race to zero contest at defcon this year and one i really didn't expect...

now, i realize i haven't always had as good a definition of variant as i do now... i should be more understanding of people who may not know as much as i do on the subject of malware... but even long before my understanding of variants reached it's current state i still had the logical capacity and intuition to realize that when you modify a virus, especially when you modify it to the point where anti-malware products can no longer detect it, then it is no longer the same as the original virus, it is no longer like anything anyone has seen before, it is (dare i say it) new...

the only way the race to zero won't be producing new virus variants is if cdman83 is right about them probably not using actual viruses in the first place (we can only hope they were dumb enough to misuse the terminology)...

even then, though, they will still be producing new malware... creating new threats is really all this contest will accomplish... demonstrating that known-malware scanning can't detect things that no one has ever seen before (ie. things that aren't known) is like demonstrating a spoon can't cut through bone...

race to zero in the security special olympics

news has started floating around about a contest in virus obfuscation being held at defcon this year... there have been a couple of mentions of it elsewhere as well, such as robert graham's "race to zero" post, sunnet beskerming's post "defcon competition has antivirus vendors complaining", and even an ars technica post titled "antivirus vendors pan free research from defcon contest" by david cartier...

now i'm obviously opposed to this and think it's irresponsible and unethical... not to mention they've chosen just about the worst malware type to play with - viruses... note to contest organizers, participants, and proponents: in the event that something goes wrong, self-replicators have a tendency to go on and on and on long after they are released or spread (old viruses never die)... they aren't called viruses because they make your computer feel bad, they're called viruses because they spread by themselves just like any infectious biological pathogen... this contest and those in it aim to play with fire...

with that out of the way, it's time i got to debunking a lot of the wrong thought surrounding this contest...

contest organizers (as quoted by pcworld):

Contest organizers say that they're trying to help computer users understand just how much effort is required to skirt antivirus products

if i'm not mistaken one of the key aspects to presenting things is to know your audience... the computer users at defcon already know it's easy to evade a scanner...

race to zero website:

The event involves contestants being given a sample set of viruses and malcode to modify and upload through the contest portal. The portal passes the modified samples through a number of antivirus engines and determines if the sample is a known threat.

this is a logical failure... a modified sample is by definition not a known threat until such time as a signature has been added to the scanner... if you're going to put on this kind of contest you might want to make sure you know what the difference between a known and unknown threat are...

Signature-based antivirus is dead, people need to look to heuristic, statistical and behaviour based techniques to identify emerging threats

this represents a complete failure to understand what the heck they're testing... changing a single bit can often foil signature detection - for contestants to get anywhere in this contest they will have to foil the heuristic, the statistical (also arguably a heuristic), and the behaviour based (heuristic here too) techniques that the scanners also implement... there are no naked known-malware scanners anymore (at least not as far as consumer products go), they all have some kind of heuristic engine in them...

Antivirus is just part of the larger picture,

and this is failure to understand their own messaging/marketing... how can anti-virus be part of the picture if it's dead?... on the one hand they want to tear down the practice of using anti-virus (anti-virus is dead) and on the other they expect people to keep it around as part of the picture... someone needs to make up their mind...

We are not creating new viruses

contrary to their mistaken belief, modifying existing viruses until such time as they're different enough from the original that neither known-malware scanning nor heuristics can recognize them is creating new viruses...

modified samples will not be released into the wild

one wonders how precisely they're going to keep that from happening? they're presenting contestants with samples, not a locked down environment that prevents them from taking their samples with them at the end of the day and doing something stupid/careless/malicious with them after the fact... how do i know this? because providing that kind of environment would be prohibitively expensive and restrictive... it might work in an educational institution (where the costs are offset by student tuition) but not as a contest..

robert graham:

The 'protectors" (product vendors) have big marketing
budgets to tell us their side of the story

it's not their side of the story, it's their attempt to get people to buy their product... on some level we all know that marketing and advertising is just another kind of lying... you don't honestly believe a whopper looks as perfect and juicy in real life as it does on tv, do you? then stop being disingenuous by treating av marketing as anything more factual than that...

We only get one side of the story

that is bullshit... we hear about the failures of anti-virus all the time, we hear about people giving up entirely on anti-virus, and we hear about anti-virus being dead... we get a lot more than just the vendor's side...

Yet, such contests also help customers

defcon isn't a customer education setting, this contest isn't going to teach them anything because they aren't going to be there...

The educating needed here is that the mainstream anti-virus technologies are easily evaded, and that such evasion happens a lot

if it happens so much then why do people need to be educated about it? surely they'll have seen it for themselves or they'll know someone who's seen it and has related the story to them?

Anti-virus vendors publish tests "proving" a 99% detection rate

this is the point where one realizes that robert graham is playing the part of an uninformed crank... anti-virus vendors do not publish tests like that... that kind of self-serving behaviour would absolutely NOT be tolerated by competitors or by the community... vendors point to tests carried out and published by independent 3rd parties...

However, that doesn't apply to customers. Often, the best way to test an anti-virus product is to create your own virus.

this is beyond stupid... you don't test your airbags by smashing your car into things and you don't test your anti-virus product by making new viruses... you leave such testing to the people with the expertise and resources to do it properly... customers generally have neither...

sunnet beskerming:

It should also show up the antivirus tools that
are making use of poor signature detection mechanisms

just like the race to zero website, this is a failure to understand what the contestants will really be bypassing... in order to not be detected by the scanners the samples will have to bypass the heuristic engines in those scanners... getting past a good signature scanner can be as easy as changing a single bit (because a good signature scanner will be very exacting so as to avoid false alarms)...

and those that are using weak heuristics to detect previously unknown malware.

heuristics have to be weakened in order to reduce the number of false alarms to an acceptable level... customers are generally unprepared to resolve potentially false alarms...

It is strange, though, how competitions like CTF, or the recent 0-day competition at CanSecWest, do not attract much complaint, but as soon as antivirus or antimalware tools are targeted it is too much for people

an interesting point, but one that highlights the fact that those other contests revolve around software flaws, whereas showing that new malware doesn't get picked up by blacklists is no more a flaw than notepad's inability to act as a hex editor...

david chartier/ars:

Instead of trying to deride Race to Zero, the AV industry could have a chance at working with the contest to harness what, in reality, could turn out to be some of the best research available on new malicious techniques. "You get what you pay for," as the old saying goes, but in the case of Race to Zero, the AV industry could be passing up a veritable gold mine of free ideas on how to better fight new threats.

except there's nothing for the av industry to learn from this contest... it's already known that malware can be modified, it can be modified in a countably infinite number of ways and if you protect against one the bad guys will just choose (not even find, choose) another... uninformed people think that things would be different if we used heuristics or behaviour blockers or application whitelisting, but the reality is that those can be bypassed in an equally numerous ways... their failures aren't discussed as much because because few people make use of them except for heuristics... and as far as heuristic failures
go people just misinterpret that as a failure in signature scanning, as most people involved in or commenting on this contest have already done...

to repurpose a train of thought from the riskanalys.is blog, the chance of any malware authors coincidentally creating the same malware or using the same modifications as the participants in this contest is basically 0 (n/infinity) so the value of trying to anticipate malware creation/modification techniques and use that knowledge for prevention is also generally 0... conversely, the chance of malware creators/users making use of what is revealed by this contest is greater than zero (because they're lazy, just look at eeye's bootroot to see an example of this having happened) so the value in adding detection for these new samples after the fact (or better still, avoiding the creation of those samples in the first place) is greater than zero...

ultimately i'm reminded once again of something david harley wrote some time ago... he hit the nail on the head when he said the rest of the security industry still doesn't understand av technology, practice, or issues - what people (including the contest organizers) have been saying about this contest proves that much... worse still, robert graham's maligning the credibility of vendors with false statements underscores one of david harley's other points; that the av industry and community remain hugely untrusted...

one has to wonder about the security industry when it doesn't understand one of it's oldest segments (and it's not like the information and people involved aren't available)... the mistrust, on the other hand, is completely understandable under these circumstances - you fear/hate what you do not understand, after all... schneier recently stated that the security industry would be coming to an end and i'll admit i had a bit of a knee-jerk reaction to that (though not so much that i wrote about it - if i did that everytime i disagreed with schneier . . .) but rothman (i think) made a subtle change by saying that security as we know it will come to an end... that's a possibility i almost look forward too - not because i think security should be subsumed by other things, but because the things i'm seeing make me think the security industry has become fundamentally broken (and/or gone mad)... of course, long time readers might recall i have my own prediction about security...

what happens when the malware stops?

not too long ago there was a post about wabisabilabi on the authentium blog that was interesting on a couple of different levels...

rjs' primary angle was ethics, and i can't really fault anything he wrote - it sounds dead-on to me, not to mention being very much in line with sentiments i've seen many other av personalities make over the years...

but there was one question that the wabisabilabi blogger asked and rjs answered that i think bears closer examination... the question is, essentially, what happens if/when everyone stops writing malware... both the asking of the question and the answer given seem to operate under the assumption that malware will cease to be a problem if/when people stop writing it...

however, as i've observed previously, old viruses never die so that assumption doesn't seem to hold... in fact, as i've suggested on more than one occasion, self-replicating malware will continue to pose a threat long after anyone associated with it's release loses interest and moves on... so long as it poses a threat there will be a need for anti-malware software so the shareholders that wabisabilabi's blogger feigned concern for shouldn't need to worry about their investment becoming completely worthless...

of course one could make the argument that without new malware the nature of what anti-malware companies do would be irrevocably changed - and while that's true it's not as big a change as one might think (at least not right away)... you see, the products detect hundreds of thousands of instances of malware but do they do so perfectly? do they do so optimally? what about removal, is that perfect or optimal in all cases? the answer is no on all counts so there is still plenty of room for malware analysts and engine designers to make improvements... even after all that gets taken care of, it's not like the lack of compelling reasons to upgrade have hurt the word processor market or stopped microsoft from regularly releasing new versions of word...

so it really doesn't seem like the end of malware writing would be all that damaging to the anti-malware business, but what i'd like to do now is take a step back and look at look at what the end of malware would mean... as i've mentioned before malware is (or at least starts out as) a proxy for the intent of a human attacker so why would such attackers stop employing this particular technique for attacking digital assets and resources? malware is a way for an attacker to benefit from automation and make their attacks easier to perform - the most likely reason (though still very unlikely) for them to give that up would be that they were giving up attacking digital assets/resources entirely... in which case, by rjs' reasoning it shouldn't just be the anti-malware folks throwing parties and getting blitzed, it should be the entire computer security industry because the giant pain in the ass that protecting those resources represents will be over...

but let's go further... attacking digital assets/resources is just one of many avenues that people use to attack each other - why give up one and not the others? either computers stop being a useful avenue of attack (which likely can only happen if computers simply stop being useful - seems like a rather apocalyptic change) or people just stop attacking each other... when man stops attacking his fellow man it will be just as much the end of the world as we know it as if it were a conventional apocalypse, only nicer... either way, the end of malware writing would signal the end many other things...

that's not to say that the end of malware writing would cause an apocalypse or that writing malware keeps the world from falling off it's axis - malware is not the cause of things, it is a symptom of the human condition and the only way for it to go away is if the human condition itself undergoes a fundamental and profound change... as such, there's really no problem with anti-malware vendors discouraging malware writing... nobody's under any illusions about whether or not it's going to stop malware from being written, but it is the ethical high road and it is the right thing for them to do...

and if anyone has an even longer view i'd love to hear it...

malware creation in academia

i wrote about one instance of academic malware writing not too long ago... in that case a virus was made to prove that viruses could be a threat on what was essentially a tricked out windows box (paging captain obvious)...

another pair of incidents have grabbed people's attention recently even though they aren't exactly new... one involves mobile malware created and released for download by the university of santa barbara which symantec actually linked to and then quickly removed the link (thanks guys, it's nice to see i'm not the only one trying to follow an anti-malware linking policy) and which predictably (and rightly) drew criticism...

and of course there's also our old friends from university of calgary (who gained infamy for running a course where the curriculum involved writing viruses, which many people spoke out against) deciding to branch out into spam and spyware... this too drew criticism, and rightly so... if you're anti-drugs then you don't create/use/sell drugs, if you're anti-violence then you don't create violent situations (at least not intentionally), so how can you pretend to be anti-malware if you create malware? have we forgotten what the prefix anti- means?

well, not everyone has forgotten what it means - the anti-malware industry, for example, remembers quite well and for the most part will not hire those who create malware (although not all sectors of the anti-malware industry are as principled as others)... ed moyle thinks the av industry is being unfair to punish students for taking such courses, but he misses the point - it's not a punishment, it's a consequence... there are plenty of fields where previous breaches of the fields' mores disqualifies you from being employed in those fields... police, firefighters, even school bus drivers have to be people you can trust not to do something that is a taboo in the context of their respective jobs... any job you can think of has a similar requirement because all jobs involve trust at some level... i hardly think it's unreasonable to expect that people who create malware shouldn't be able to get jobs in the anti-malware industry...

on the other hand, when a professor or academic adviser teaches or endorses this type of pursuit knowing full well what the consequences will be for the students (and the professor in question most certainly did), certainly more than the students themselves, then shouldn't the finger of blame spend some time pointing in his general direction? and if the professor later compounds that affront by branching out into addition malware fields so as to disqualify his students from even more segments of the anti-malware industry, can there be any question about whether he's serving his students' interests or if he's teaching them material they'll actually be able to use in the fields they would otherwise expect to be able to use it in (i know if i learned about viruses i'd expect to be able to put it to use in the anti-virus field)...

of course proponents of this kind of training will talk a good game about needing to understand how malware works, but what most fail to recognize (or perhaps they're just hoping your own thinking is sloppy enough to miss this) is that learning how a thing works and learning how to make that thing are actually quite different... learning how to make a thing is not required in order to learn how it works - i don't need to know how to make a shiv in order to know how a knife works, i don't have to learn how to build a car in order to make it go... moreover, just because you wrote malware X doesn't mean you know how it actually works, all you really know is how you intended it to work - making malware doesn't really teach what you'd expect it to... were these malware creation activities to be replaced with reverse engineering of existing malware, the students would learn not only how the malware worked but they would also learn a skill that would be directly applicable to a career in the anti-malware industry and they might even wind up being sought after by multiple competing anti-malware vendors... wouldn't that serve the students' interests better? wouldn't that better prepare them to use the knowledge they gain in the field it applies to best?

ethics of virus creation

one thing that the current controversy over the consumer reports av test brings to light is that people really don't understand the ethical considerations involved...

if you create a virus and no one ever hears about it or encounters it there is no ethical problem... it's analogous to that old question of if a tree falls in the forest and no one is around to here it, does it make a sound?... sound being merely an interpretation of vibrations in a medium, without anyone or anything to measure and/or interpret those vibrations there is no sound (of course this assumes an incredibly empty forest)...

if someone simply hears about it then there is a problem as it lends credence to the argument put forth by those who are not careful or even slightly responsible with the viruses they create that what they're doing is OK...

if they encounter it as an advertised virus sample (ie. something to be handled with care to avoid the live infection scenario) then it is up to that person to treat it carefully and responsibly... and if that person should share it with someone else that person must also treat it carefully and responsibly or else it might escape... the more people it gets shared with the greater the likelihood of it's escape, thus creating the live infection scenario... this is a problem because of the impact such an escape can have and the fact that once you share it with someone you basically have no control over whether that escape happens or not...

if someone does encounter it as a live infection then there is a problem, because viruses cost time and money to get rid of, they damage the integrity of all they infect, and they can (either intentionally or not) destroy data and render services and/or resources inaccessible/inoperable... worse still, live infections can live on for a long time after their release - unlike an exploit that stops being a threat after the people using it move on to something else, a virus will just keep going and going without intentional assistance... the monkey virus, for example, was in the wild for over a decade despite the fact that anti-virus software was able to detect and remove it for almost that entire time...

what, then, if the purpose for making the virus outweighs the risks? vesselin bontchev covered this hypothetical condition in his paper Are "Good" Viruses Still a Bad Idea? and the conclusion was that no matter what the virus was intended to do, the function could be just as easily be performed by non-replicative code and thus without many of the risks inherent with self-replicative code...

vesselin didn't specifically cover anti-virus testing as one of his examples in that paper, but then again the viruses used in virus detection tests don't actually carry out any function good or bad, they just sit there waiting to either be detected or not...

obviously viruses are needed in order to carry out virus detection testing, but do we need to create new viruses for the task? viruses are being created by the bad guys at an ever increasing rate and there's no sign of that ever stopping so there's certainly no shortage of viruses to use, not even if you're constraining yourself to just look at new viruses... furthermore, while the risk of virus escape is pretty much the same whether it's a virus captured from the wild or a virus you create in a lab, the implications of the escape of a virus you create are much worse... accidental escape of a real world virus means you're responsible for contributing to the spread of an existing threat while accident escape of a virus you create means you're responsible for the spread and creation of a brand new threat... that is the very definition of being part of the problem rather than being part of the solution...

of course critics will say "but you can take precautions against accidental release so it's really not an issue"... this is foolish, preventative measures are never 100% effective - the av industry, inspite of the extreme care they take, have still had accidents... nevermind the fact that proper virus detect tests don't use first generation samples, they often replicate the samples to 3 or more generations to ensure they actually are viruses - a high risk activity... add to that the fact that for the test to be good science it has to be exactly reproducible, which means other people have to be able to get samples of the viruses - at which point the precautions would be moot because the viruses would no longer be under your complete control and never would be again...

given that and the fact that tests using slightly old anti-virus products against viruses that appeared after those products were released give essentially the same results (ie. the av products don't fare well at all) as tests using viruses you create in a lab, we once again have the same principle that vesselin's conclusion gave us - that making viruses represents an unnecessary risk, and not just a risk to ones own computers or data but a risk for society at large... creating new risks and deciding unilaterally that society should be subject to those risks so that you can achieve some goal (especially when that goal can be achieved without those risks) is quite clearly unethical...