by now you've probably heard that microsoft plans to get into the anti-virus industry (again) and has already entered the anti-spyware industry... they apparently are planning to release a complete security package for a fee (see Techdirt)...
now, Techdirt makes an interesting argument for why giving away the security package might be problematic for microsoft - that they might get accused of anti-trust violations with regard to the desktop security industry...
so it would seem that they can't not charge money for their product - but here's a different angle... a big part of the problem that their product will be addressing is the insecurity of their other products... the argument has been made that anti-virus companies are the ones behind the viruses and it's an easy argument to debunk (the industry is very competitive and the companies would use that information against their competitors if it were true), but when it comes to security exploits microsoft IS behind many of the vulnerabilities being exploited... they're basically charging you to protect you from the threats posed by their other software - which sounds an aweful lot like a protection racket to me...
worse still, however, is that with their complete security package they would have less motivation to actually fix the security problems in their other software... they could say that the threat posed by vulnerability X is mitigated by Microsoft Security Suite (tm), so the severity of the problem is less than critical so fixing it will be a lesser priority... they've been trying to address security for years now and so far it's been an abject failure - we have no greater confidence in the security of their software now than we did when they started... this could mark the end of their efforts to write more secure code - it could be the sign that they're giving up... writing software to protect people from exploits when you should be fixing the vulnerabilities certainly sounds like a cop-out to me...
so really, there doesn't seem to be any moral highground for microsoft in this venture - either they kill the desktop security software industry by giving their own product away for free (like they did to netscape), or they can charge money for their product and at best admit defeat at writing secure code or at worst be guilty of protection racketeering...
maybe they should just stay out of the security industry entirely... they've tried their hand at it before (msav) and that was an abject failure too...
Monday, May 16, 2005
Thursday, April 14, 2005
blogs are dangerous?... wtf?!
well, it looks like some tool over at the bbc thought it would be a good idea to report on how blogs were increasingly being used as a way to get malware onto the computers of people who visit those sites... what this person missed entirely was that blogs are just web pages and the threats they pose are exactly the same as for any other type of website... these are just web threats, web threats of one kind or another have been around for years, there's nothing new here and blogs don't pose any threats that are specific to just blogs...
what really struck me, though was how Viruslist.com picked up on the story and did nothing but parrot the message that blogs pose a threat... they could have set the record straight, they could have explained that these are just the same old threats in the same old medium (the world wide web), but apparently it's more important for them to use this opportunity to urge readers to use anti-virus software (and look at the pretty product placement at the bottom of the page)...
let's be perfectly clear here, web based security threats are not new and packaging them as though they're blog based security threats and are new effectively creates Fear, Uncertainty, and Doubt... the bbc news drone i can forgive for simply being ignorant, but Viruslist.com is part of kaspersky labs so they really should have known better...
what really struck me, though was how Viruslist.com picked up on the story and did nothing but parrot the message that blogs pose a threat... they could have set the record straight, they could have explained that these are just the same old threats in the same old medium (the world wide web), but apparently it's more important for them to use this opportunity to urge readers to use anti-virus software (and look at the pretty product placement at the bottom of the page)...
let's be perfectly clear here, web based security threats are not new and packaging them as though they're blog based security threats and are new effectively creates Fear, Uncertainty, and Doubt... the bbc news drone i can forgive for simply being ignorant, but Viruslist.com is part of kaspersky labs so they really should have known better...
Thursday, March 31, 2005
scanner decrepitude
a question that just keeps coming back is whether or not it's ok to use an old scanner if you apply the latest signature updates to it... this seems especially popular for NAV, and especially for NAV2002 (symantec take note, you were obviously doing something really well that year, maybe you should go back to that)...
the answer, of course, is no it's not ok... older scanning engines can't make proper, effective use of newer signatures so if you try this you won't be getting the full benefit you could be getting from an anti-virus product...
let's examine why... as new viruses are written, new techniques to confound anti-virus products are employed and so the anti-virus scanning engines need to be updated... it's not enough to just create new signatures, signatures only tell the scanner what to look for not how to look for it...
some people think this is fiction, but some people also believe the earth is flat... it's a demonstrable fact that over time older scanning technologies become obsolete and need to be replaced - the scanning engines in use before polymorphic viruses hit the scene were completely incapable of dealing with polymorphics, so too with macro viruses... those are the extreme examples; there are less critical circumstances where making modifications to the scanning technology is simply more ideal, where the existing technology could have done at least part of the job but to get optimal detection performance a change in the engine is needed...
of course they keep the engine backwards compatible so that it can use all (or at least most) of the old signatures, but there's no such thing as forwards compatibility - older scanning engines can't make proper use of new signatures written to take advantage of the capabilities of newer engines...
as such, you have to keep your scanner engines up to date as well as the signature databases in order to get the full protection the product is supposed to be capable of...
the answer, of course, is no it's not ok... older scanning engines can't make proper, effective use of newer signatures so if you try this you won't be getting the full benefit you could be getting from an anti-virus product...
let's examine why... as new viruses are written, new techniques to confound anti-virus products are employed and so the anti-virus scanning engines need to be updated... it's not enough to just create new signatures, signatures only tell the scanner what to look for not how to look for it...
some people think this is fiction, but some people also believe the earth is flat... it's a demonstrable fact that over time older scanning technologies become obsolete and need to be replaced - the scanning engines in use before polymorphic viruses hit the scene were completely incapable of dealing with polymorphics, so too with macro viruses... those are the extreme examples; there are less critical circumstances where making modifications to the scanning technology is simply more ideal, where the existing technology could have done at least part of the job but to get optimal detection performance a change in the engine is needed...
of course they keep the engine backwards compatible so that it can use all (or at least most) of the old signatures, but there's no such thing as forwards compatibility - older scanning engines can't make proper use of new signatures written to take advantage of the capabilities of newer engines...
as such, you have to keep your scanner engines up to date as well as the signature databases in order to get the full protection the product is supposed to be capable of...
Monday, March 28, 2005
funny business
having one blog is good... having 2 blogs is bad... so says whatever universal process/concept/thing it is that makes me post entries to the wrong blog...
Saturday, March 26, 2005
let's be part of the problem
DVForge - Virus Prize 2005
what the hell are these people thinking, offering to pay people to write viruses for the mac and spread them in the wild? like virus writers don't already have enough motivation to write and spread viruses - especially when it comes to being the first one for a new platform or the first one in the wild for a new platform... those sorts of things already make them (in)famous...
these folks have clearly had a break our ethical reality - you do not need a proof of concept virus to prove viruses can spread on the mac - mac OS X is basically a form of unix and the very first viruses that fred cohen wrote when doing his seminal work on viruses back in the '80s worked on unix systems... and they did work, they spread on production systems...
come on, folks - all general pupose computing platforms are susceptible to viruses... all of them... it's been proven - and i don't mean the way you prove things in court with evidence, because there will always be new platforms for which there is no evidence yet... i mean it's been proven on paper with logic - the only facilities a virus needs are those that are already present in the definition of general purpose computer...
these people are not solving any real problem by offering a reward to virus writers for writing yet more viruses (and you know damn well there are going to be a lot more viruses written than rewards handed out)... all they are doing is making virus spreading (because you do need to spread your virus so that it makes it's way onto the target systems naturally in order to get the reward) seem more legitimate by wrapping it up like it's some sort of good deed that puts a set of misconceptions by uninformed people to bed... the fact is that they are soliciting behaviour that is illegal under canadian laws (criminal mischief pertaining to data) as well as laws in a variety of other countries that have unauthorized-access-related legislation...
john mcafee reputedly paid for virus collections and thus became a pariah in the anti-virus industry for supplying virus writers with financial motivation to write viruses... these people here are supplying financial motivation to write & spread viruses and that absolutely contributes to the problem, rather than the solution... these people are not interested in the greater good, they're only interested in making a name for themselves and they don't care how much damage they cause in the process...
update 5:30pm: well, that was quick... seems a lot of people contacted the guy in charge and convinced him to stop the contest... hurray!... now let's move on...
what the hell are these people thinking, offering to pay people to write viruses for the mac and spread them in the wild? like virus writers don't already have enough motivation to write and spread viruses - especially when it comes to being the first one for a new platform or the first one in the wild for a new platform... those sorts of things already make them (in)famous...
these folks have clearly had a break our ethical reality - you do not need a proof of concept virus to prove viruses can spread on the mac - mac OS X is basically a form of unix and the very first viruses that fred cohen wrote when doing his seminal work on viruses back in the '80s worked on unix systems... and they did work, they spread on production systems...
come on, folks - all general pupose computing platforms are susceptible to viruses... all of them... it's been proven - and i don't mean the way you prove things in court with evidence, because there will always be new platforms for which there is no evidence yet... i mean it's been proven on paper with logic - the only facilities a virus needs are those that are already present in the definition of general purpose computer...
these people are not solving any real problem by offering a reward to virus writers for writing yet more viruses (and you know damn well there are going to be a lot more viruses written than rewards handed out)... all they are doing is making virus spreading (because you do need to spread your virus so that it makes it's way onto the target systems naturally in order to get the reward) seem more legitimate by wrapping it up like it's some sort of good deed that puts a set of misconceptions by uninformed people to bed... the fact is that they are soliciting behaviour that is illegal under canadian laws (criminal mischief pertaining to data) as well as laws in a variety of other countries that have unauthorized-access-related legislation...
john mcafee reputedly paid for virus collections and thus became a pariah in the anti-virus industry for supplying virus writers with financial motivation to write viruses... these people here are supplying financial motivation to write & spread viruses and that absolutely contributes to the problem, rather than the solution... these people are not interested in the greater good, they're only interested in making a name for themselves and they don't care how much damage they cause in the process...
update 5:30pm: well, that was quick... seems a lot of people contacted the guy in charge and convinced him to stop the contest... hurray!... now let's move on...
Sunday, March 13, 2005
rootkits for windows
this page tries to explain what rootkits are and the emerging threat they pose for the windows platform...
that's all well and good but there's something that just doesn't sit well with me... let's take a closer look:
i like this explanation... it's simple, it's consistent, it makes sense.... a rootkit is a tool used to gain root (*nix speak for administrator) privileges...
now this is not so good... apparently rootkits for windows don't really have anything to do with giving a principle administrative privileges... it does a bunch of the other things it's unix counterpart does (i.e. it uses sophisticated techniques to hide) but no elevation of privilege...
does that make sense to you?
if i take the self-replication out of a virus, regardless of the fact that it can still do all the other things it used to be able to do, it is no longer a virus...
why then if i take the root granting functionality out of a rootkit does it remain a rootkit?
it doesn't seem to make a lot of sense, it is not logically consistent... by rights, what they're calling rootkits for windows should be called (in keeping with the spirit of the rootkit name) stealthkits...
now, this was an f-secure description so you may well be thinking that maybe those f-secure folks are a little confused... but no, if that were the case then why does sophos also seem to think that rootkits are more about hiding than they are about privilege elevation (which they don't even mention)... and then there's sysinternal's explanation of rootkits which also focuses on hiding rather than privilege elevation...
this seems like it might actually be industry wide, in which case i can just site here in awe and wonder because the industry appears to be from a completely different planet than you and me...
that's all well and good but there's something that just doesn't sit well with me... let's take a closer look:
The term rootkit is very old and is dated back to the days when UNIX ruled the world. Rootkits for the UNIX operating system were typically used to elevate the privileges of a user to the root level (=administrator). This explains the name of this category of tools.
i like this explanation... it's simple, it's consistent, it makes sense.... a rootkit is a tool used to gain root (*nix speak for administrator) privileges...
Rootkits for Windows work in a different way and are typically used to hide malicious software from for example an antivirus scanner. Rootkits are typically not malicious by themselves but are used for malicious purposes by viruses, worms, backdoors and spyware. A virus combined with a rootkit produces what was known as full stealth viruses in the MS-DOS environment.
now this is not so good... apparently rootkits for windows don't really have anything to do with giving a principle administrative privileges... it does a bunch of the other things it's unix counterpart does (i.e. it uses sophisticated techniques to hide) but no elevation of privilege...
does that make sense to you?
if i take the self-replication out of a virus, regardless of the fact that it can still do all the other things it used to be able to do, it is no longer a virus...
why then if i take the root granting functionality out of a rootkit does it remain a rootkit?
it doesn't seem to make a lot of sense, it is not logically consistent... by rights, what they're calling rootkits for windows should be called (in keeping with the spirit of the rootkit name) stealthkits...
now, this was an f-secure description so you may well be thinking that maybe those f-secure folks are a little confused... but no, if that were the case then why does sophos also seem to think that rootkits are more about hiding than they are about privilege elevation (which they don't even mention)... and then there's sysinternal's explanation of rootkits which also focuses on hiding rather than privilege elevation...
this seems like it might actually be industry wide, in which case i can just site here in awe and wonder because the industry appears to be from a completely different planet than you and me...
Wednesday, March 09, 2005
update from crazyworld
so guess what - Publishing exploit code ruled illegal in France...
guillermito will have to pay 5,000 euros if he publishes security vulnerabilities again... that's right, security research is basically illegal in france now so don't you be making fun of any of those french products that really, really suck...
but wait, there's more (there always is with this case)... if you read this article you'll see that tegam is defending it's actions by saying that guillermito's claims are false and his motives questionable... ooops! if his claims are false then the exploits he supposedly published must not actually exploit weaknesses in the product - in which case he didn't publish exploits, only defamatory material, in which case tegam's current claims against him are baseless... but since a court of law agreed with tegam's claims they must not be baseless, in which case the exploits are real, in which case his claims are true rather than false... you can't have your cake and eat it too, tegam...
i swear this company must be run by untrained monkeys...
guillermito will have to pay 5,000 euros if he publishes security vulnerabilities again... that's right, security research is basically illegal in france now so don't you be making fun of any of those french products that really, really suck...
but wait, there's more (there always is with this case)... if you read this article you'll see that tegam is defending it's actions by saying that guillermito's claims are false and his motives questionable... ooops! if his claims are false then the exploits he supposedly published must not actually exploit weaknesses in the product - in which case he didn't publish exploits, only defamatory material, in which case tegam's current claims against him are baseless... but since a court of law agreed with tegam's claims they must not be baseless, in which case the exploits are real, in which case his claims are true rather than false... you can't have your cake and eat it too, tegam...
i swear this company must be run by untrained monkeys...
legality of virus writing
someone at f-secure is clearly frustrated...
how many times have i seen someone say that virus writing should be illegal? i don't know, i've lost count it's been said so many times... i'm sure it probably seems entirely reasonable too... except wait, oh my goodness, it's not!...
huh? what am i talking about? i'm talking about the fact that enforcing such a law would be an unprecedented contravention of fundamental human rights...
let's face facts - abstracted from all other related activities, simply writing a virus is analogous to writing in a personal journal... it's a matter of freedom of thought and as such one of the most fundamental freedoms there is... it doesn't affect anyone until the writer tries to communicate his/her idea with others... if i write a virus and no one else ever sees it, have i contributed to the virus problem? if i utter a racial slur and no one's around to hear it, have i offended a minority group? no on both counts... what i do in the privacy of my own home or the privacy of my own computer should be of no concern to anyone else...
if you're going to outlaw something, outlaw something that actually causes a problem... outlaw spreading viruses, maybe even outlaw publishing viruses (see here for why full disclosure shouldn't be usable as a valid argument against such free speech limitations), but keep the thought police out of the picture...
that's important so i'll repeat it - outlawing virus writing would be a contravention of a person's freedom of thought, keep the thought police out of the picture...
how many times have i seen someone say that virus writing should be illegal? i don't know, i've lost count it's been said so many times... i'm sure it probably seems entirely reasonable too... except wait, oh my goodness, it's not!...
huh? what am i talking about? i'm talking about the fact that enforcing such a law would be an unprecedented contravention of fundamental human rights...
let's face facts - abstracted from all other related activities, simply writing a virus is analogous to writing in a personal journal... it's a matter of freedom of thought and as such one of the most fundamental freedoms there is... it doesn't affect anyone until the writer tries to communicate his/her idea with others... if i write a virus and no one else ever sees it, have i contributed to the virus problem? if i utter a racial slur and no one's around to hear it, have i offended a minority group? no on both counts... what i do in the privacy of my own home or the privacy of my own computer should be of no concern to anyone else...
if you're going to outlaw something, outlaw something that actually causes a problem... outlaw spreading viruses, maybe even outlaw publishing viruses (see here for why full disclosure shouldn't be usable as a valid argument against such free speech limitations), but keep the thought police out of the picture...
that's important so i'll repeat it - outlawing virus writing would be a contravention of a person's freedom of thought, keep the thought police out of the picture...
Thursday, January 13, 2005
anti-virus developers, listen up!
take a look here... (Message-ID: wa6dnTcvF_JsK3jcRVn-qA@comcast.com if the link is broken)
this poor user has a virus stuck in his email and he can't figure out which message it is that he needs to delete... folks, do me a favour, when you detect a virus inside what you recognize to be an email envelope could you report not just the virus name and filename but also some kind of identifying information for the email in question (From:, To:, Subject:)?
i mean really - when your product detects a virus in an email database and it can't clean it, without this information you might as well be telling the user "there is a virus somewhere on your computer"... that's just too vague to be useful...
this poor user has a virus stuck in his email and he can't figure out which message it is that he needs to delete... folks, do me a favour, when you detect a virus inside what you recognize to be an email envelope could you report not just the virus name and filename but also some kind of identifying information for the email in question (From:, To:, Subject:)?
i mean really - when your product detects a virus in an email database and it can't clean it, without this information you might as well be telling the user "there is a virus somewhere on your computer"... that's just too vague to be useful...
more from crazyworld
f-secure's blog had 2 good links showing both supposed sides of the guillermito vs. tegam issue...
tegam's press release described their displeasure at having their company violently depreciated (violently? ok, maybe thats just a translation thing, but they're obviously trying to appeal to our emotions rather than logic) for years and how a hardheaded search for vulnerabilities (what might otherwise be called persistence) is somehow wrong and unfair and that other companies don't get treated that way (even though they do - one need only look as far as invircible and it's creator zvi netiv for an example of that; martin overton's chekmate didn't escape notice either, and there are plenty more examples)...
guillermito's side seems reasonably well laid out and unmired by marketing double-talk, along with examples (scanned full page advertisements) of tegam claiming he was a terrorist and that the FBI was looking for him...
tegam's press release suggests they're upset at the negative publicity guillermito has caused them, that it's hurt their public image, and yet they are the ones making false terrorist accusations... their legal complaint against guillermito doesn't seem to contest the validity of his claims, it only charges that he reverse engineered their product in a way that was not legal... you'd think if guillermito's claims about their software was false and that it hurt their reputation so much that there would be some sort of charge of defamation or something... i suppose guillermito must have a strong defence against such a defamation charge (like his claims being the truth)...
tegam - stop being such petulant children and take responsibility for your failures...
tegam's press release described their displeasure at having their company violently depreciated (violently? ok, maybe thats just a translation thing, but they're obviously trying to appeal to our emotions rather than logic) for years and how a hardheaded search for vulnerabilities (what might otherwise be called persistence) is somehow wrong and unfair and that other companies don't get treated that way (even though they do - one need only look as far as invircible and it's creator zvi netiv for an example of that; martin overton's chekmate didn't escape notice either, and there are plenty more examples)...
guillermito's side seems reasonably well laid out and unmired by marketing double-talk, along with examples (scanned full page advertisements) of tegam claiming he was a terrorist and that the FBI was looking for him...
tegam's press release suggests they're upset at the negative publicity guillermito has caused them, that it's hurt their public image, and yet they are the ones making false terrorist accusations... their legal complaint against guillermito doesn't seem to contest the validity of his claims, it only charges that he reverse engineered their product in a way that was not legal... you'd think if guillermito's claims about their software was false and that it hurt their reputation so much that there would be some sort of charge of defamation or something... i suppose guillermito must have a strong defence against such a defamation charge (like his claims being the truth)...
tegam - stop being such petulant children and take responsibility for your failures...
Tuesday, January 11, 2005
and in crazyworld, people can go to jail for finding bugs... did i say crazyworld? i meant france...
on fark this would probably get the [Asinine] tag... if you haven't heard about guillermito vs. tegam then count yourself lucky for the bliss that is your ignorance...
long story short: tegam produced a very, very bad anti-virus product, called viguard, and made classic snake-oil claims... guillermito (ok, not his real name but i always go by the first name i know a person by) produces a report that documents how bad the anti-virus is, complete with exploits... tegam sues guillermito for counterfeiting/criminal copyright infringement... guillermito faces 4 months probation in france (kind of a long way to go to see your probation officer when you currently live in the states and are working at harvard - assuming probation works in a similar fashion there) and a hefty fine...
what is the moral of this story? do you think it's that you should keep your mouth shut when companies LIE to the public? do you think it's that france's justice system is borked?
no, the moral of this story is that tegam cannot silence criticism with lawyers - the publicity from this case will point everyone towards the truth - any possibility of them re-establishing secrecy for their product's problems is gone - the only purpose the lawsuit can serve is to punish someone for telling the truth - and on the internet things have a habit of never going away, ever...
the free market works best in the presence of an informed consumer... tegam may win in a court of law, but the court of public opinion is a different beast entirely... vote with your wallet, folks...
long story short: tegam produced a very, very bad anti-virus product, called viguard, and made classic snake-oil claims... guillermito (ok, not his real name but i always go by the first name i know a person by) produces a report that documents how bad the anti-virus is, complete with exploits... tegam sues guillermito for counterfeiting/criminal copyright infringement... guillermito faces 4 months probation in france (kind of a long way to go to see your probation officer when you currently live in the states and are working at harvard - assuming probation works in a similar fashion there) and a hefty fine...
what is the moral of this story? do you think it's that you should keep your mouth shut when companies LIE to the public? do you think it's that france's justice system is borked?
no, the moral of this story is that tegam cannot silence criticism with lawyers - the publicity from this case will point everyone towards the truth - any possibility of them re-establishing secrecy for their product's problems is gone - the only purpose the lawsuit can serve is to punish someone for telling the truth - and on the internet things have a habit of never going away, ever...
the free market works best in the presence of an informed consumer... tegam may win in a court of law, but the court of public opinion is a different beast entirely... vote with your wallet, folks...
Wednesday, December 29, 2004
viruses and disclosure
let me make this perfectly clear - i do not support the indiscriminate sharing of viral materials...
you should not share viruses, source code, etc. with people you don't know you can trust (both competence and ethics-wise) and you should not ask for such materials from people you have no reason to expect trust from...
the argument for not sharing materials with people you don't know you can trust should be obvious... they might do something bad or stupid with the materials you give them... the argument against asking is that it legitimizes the sharing of materials in situations where it deserves no legitimacy...
there are some misguided notions that the full disclosure policy that works so well for vulnerabilities would be equally well applied to viruses... lets examine that more closely...
a vulnerability, ultimately, is a mistake... whether it's a mistake in the design or in the implementation doesn't matter, it's a mistake that in an ideal world could have been avoided and in the real world can (hopefully) be fixed... full disclosure of vulnerabilities benefits us in a variety of ways...
viruses, on the other hand, are not mistakes nor do they depend on mistakes (though some particular viruses may depend on particular vulnerabilities)... the ability to support viral infection is inherent to ALL general purpose computing platforms... it cannot be fixed or avoided - and since it cannot be fixed or avoided, it cannot be used as a discriminating factor when judging the quality of the platform or organization (the fact that windows has more viruses than linux has more to do with the number of windows users there are and the nature of those users than with the fact that windows is garbage)... none of the benefits we receive from full disclosure of vulnerabilities are achievable in the virus realm... what is achievable is
as such, sharing viruses with people you don't know you can trust cannot be considered to be responsible handling of viral materials and is to be discouraged... instead, one should only share such materials with people one knows one can trust (who in turn do the same - leading to a 'web of trust') and only request such materials from those who you can reasonably expect will trust you...
you should not share viruses, source code, etc. with people you don't know you can trust (both competence and ethics-wise) and you should not ask for such materials from people you have no reason to expect trust from...
the argument for not sharing materials with people you don't know you can trust should be obvious... they might do something bad or stupid with the materials you give them... the argument against asking is that it legitimizes the sharing of materials in situations where it deserves no legitimacy...
there are some misguided notions that the full disclosure policy that works so well for vulnerabilities would be equally well applied to viruses... lets examine that more closely...
a vulnerability, ultimately, is a mistake... whether it's a mistake in the design or in the implementation doesn't matter, it's a mistake that in an ideal world could have been avoided and in the real world can (hopefully) be fixed... full disclosure of vulnerabilities benefits us in a variety of ways...
- first and foremost it places pressure on the people/organization responsible to fix the problem in a more timely manner than they may have otherwise been inclined to do.
- it helps us learn more about the mistake so that in the future we might better avoid it or similar mistakes.
- it helps us identify when a program or system no longer meets our expectations of trustworthiness if/when an unacceptable number of vulnerabilities are uncovered or not enough is done to rectify them.
viruses, on the other hand, are not mistakes nor do they depend on mistakes (though some particular viruses may depend on particular vulnerabilities)... the ability to support viral infection is inherent to ALL general purpose computing platforms... it cannot be fixed or avoided - and since it cannot be fixed or avoided, it cannot be used as a discriminating factor when judging the quality of the platform or organization (the fact that windows has more viruses than linux has more to do with the number of windows users there are and the nature of those users than with the fact that windows is garbage)... none of the benefits we receive from full disclosure of vulnerabilities are achievable in the virus realm... what is achievable is
- a state where it is easier for people learning to write and spread viruses to get their hands on examples.
- a state where it is easier for people who wish to use existing viruses as weapons of vengeance to get their hands on viruses.
- a state where it is easier for novices to get their hands on samples even though they don't have sufficient competence with viruses to deal with them safely.
as such, sharing viruses with people you don't know you can trust cannot be considered to be responsible handling of viral materials and is to be discouraged... instead, one should only share such materials with people one knows one can trust (who in turn do the same - leading to a 'web of trust') and only request such materials from those who you can reasonably expect will trust you...
Monday, November 29, 2004
vx'er crackdown
Police raided another virus writer
Benny, Ratter questioned
looks like law enforcement is starting to get more serious (and capable) about getting their hands on virus writers... i said this kind of thing was coming, years ago, but do the vx'ers listen to me? no...
well ok, maybe some of them did... but obviously not enough...
there should be billboards with pictures of stern looking cops and captions that read "write viruses? that's fine. let 'em out and you're mine."...
and i'm not even suggesting that the vx'ers referenced in those articles actually let anything out - but obviously someone has been doing so, and that endangers the whole 'scene'...
Benny, Ratter questioned
looks like law enforcement is starting to get more serious (and capable) about getting their hands on virus writers... i said this kind of thing was coming, years ago, but do the vx'ers listen to me? no...
well ok, maybe some of them did... but obviously not enough...
there should be billboards with pictures of stern looking cops and captions that read "write viruses? that's fine. let 'em out and you're mine."...
and i'm not even suggesting that the vx'ers referenced in those articles actually let anything out - but obviously someone has been doing so, and that endangers the whole 'scene'...
Thursday, August 12, 2004
100% protection? we know what that means!
page: MessageLabs Services: Virus Protection - FAQs
excerpt: "MessageLabs offer all new customers 100% guaranteed protection on all known and unknown viruses (in applicable countries). If we do let a virus infect any of our customers, they will be refunded a month's premium."
can you spot the snake-oil?
"100% guaranteed protection on all known and unknown viruses" sort of flies in the face of the 2 decade old realization that detecting all possible viruses is reducible to the halting problem and therefore is not possible....
but wait, it gets better!
page: MessageLabs
excerpt: "The only solution in the world to provide complete 100% protection against all known and unknown virus, trojan and other malware threats, even during critical 'zero-hour' outbreaks before anti-virus signatures are available."
it's not just viruses that they guarantee 100% detection of, it's basically all malware, including trojans... somehow, the difficulty the rest of the known universe has with context sensitivity of trojan classification just isn't a problem for them...
i think they must have licensed dr. solly's perfect.bat technology - you know the batch file that says everything is a virus and thus has a 100% detection rate (the 100% false positive rate is just an unfortunate side effect)...
where does the industry dig up these snake-oil marketers? haven't they learned their lesson yet?
as always, folks - vote with your wallet... when companies go bad the only thing left that they will understand is market pressure...
excerpt: "MessageLabs offer all new customers 100% guaranteed protection on all known and unknown viruses (in applicable countries). If we do let a virus infect any of our customers, they will be refunded a month's premium."
can you spot the snake-oil?
"100% guaranteed protection on all known and unknown viruses" sort of flies in the face of the 2 decade old realization that detecting all possible viruses is reducible to the halting problem and therefore is not possible....
but wait, it gets better!
page: MessageLabs
excerpt: "The only solution in the world to provide complete 100% protection against all known and unknown virus, trojan and other malware threats, even during critical 'zero-hour' outbreaks before anti-virus signatures are available."
it's not just viruses that they guarantee 100% detection of, it's basically all malware, including trojans... somehow, the difficulty the rest of the known universe has with context sensitivity of trojan classification just isn't a problem for them...
i think they must have licensed dr. solly's perfect.bat technology - you know the batch file that says everything is a virus and thus has a 100% detection rate (the 100% false positive rate is just an unfortunate side effect)...
where does the industry dig up these snake-oil marketers? haven't they learned their lesson yet?
as always, folks - vote with your wallet... when companies go bad the only thing left that they will understand is market pressure...
Thursday, July 29, 2004
Fight Virus With Virus - microsoft folks display once again that they just don't get it
ok, technically it's slate, not microsoft... but microsoft *owns* slate, so...
Fight Virus With Virus - That's the only way to stop MyDoom. By Paul Boutin
this is such a dead horse these days that i don't know if i should even bother with a rebuttal except to point the reader to Are "Good" Computer Viruses Still A Bad Idea? and then answer - of course they are!...
people who think anti-virus viruses are a good idea either don't have the background to know what they're talking about or haven't thought things through...
Fight Virus With Virus - That's the only way to stop MyDoom. By Paul Boutin
this is such a dead horse these days that i don't know if i should even bother with a rebuttal except to point the reader to Are "Good" Computer Viruses Still A Bad Idea? and then answer - of course they are!...
people who think anti-virus viruses are a good idea either don't have the background to know what they're talking about or haven't thought things through...
Wednesday, July 21, 2004
this public roasting is long overdue
check out
Billgates
and
Fewster.1781
notice anything amiss? no? well you should...
both of these are examples of anti-virus companies FAILING to comply with a long standing naming standard that (among other things) states that viruses must not be named after real people unless you know for sure the virus was written by them.... rod fewster is an anti-virus professional and did not write the virus named after him - i dare say bill gates didn't write any virus named billgates either...
both of these examples are quite old, but they don't outdate the naming convention of which i speak... further, it doesn't take a rocket scientist to figure out what's wrong with letting viruses be named after real people...
not only are these companies showing a distinct lack of concern for the reputations of these people, they're also showing a distinct lack of concern for the public at large... naming standards are made for good reasons, not the least of which being reducing confusion and making it easier for people with virus problems to find information on the virus they have...
and it's not like virus names don't get changed - they do, quite regularly, it's the only way to coordinate a common name used across multiple products... but those 2 examples have been sitting around for nearly a decade now... where's the effort to make your life easier? where's the concern for the customer? certainly doesn't look like it's anywhere near these 2 companies right now...
(thanks to art kopp for digging up these examples...)
Billgates
and
Fewster.1781
notice anything amiss? no? well you should...
both of these are examples of anti-virus companies FAILING to comply with a long standing naming standard that (among other things) states that viruses must not be named after real people unless you know for sure the virus was written by them.... rod fewster is an anti-virus professional and did not write the virus named after him - i dare say bill gates didn't write any virus named billgates either...
both of these examples are quite old, but they don't outdate the naming convention of which i speak... further, it doesn't take a rocket scientist to figure out what's wrong with letting viruses be named after real people...
not only are these companies showing a distinct lack of concern for the reputations of these people, they're also showing a distinct lack of concern for the public at large... naming standards are made for good reasons, not the least of which being reducing confusion and making it easier for people with virus problems to find information on the virus they have...
and it's not like virus names don't get changed - they do, quite regularly, it's the only way to coordinate a common name used across multiple products... but those 2 examples have been sitting around for nearly a decade now... where's the effort to make your life easier? where's the concern for the customer? certainly doesn't look like it's anywhere near these 2 companies right now...
(thanks to art kopp for digging up these examples...)
Monday, July 19, 2004
IDG News Service gets it wrong
it's a short article, give it a read..
InfoWorld: First Windows CE virus emerges: July 19, 2004: By : APPLICATION_DEVELOPMENT : SECURITY
notice right at the beginning how it says the new WinCE virus was designed to demonstrate security holes in the WinCE operating system? this is a subtle point, one that far too many people fail to grasp, but the ability of viruses to infect a platform has nothing to with security holes in that platform... virus infectability is a 'feature' of all general purpose computing platforms... *all of them*... you can't create a general purpose computing platform that isn't susceptible to viruses...
therefore you cannot (as the article's author does) infer security holes in an OS simply because the system is vulnerable to viral infection... it's a shame mass media doesn't have a better grasp on what they're talking about when they're talking about viruses... this one article is being picked up by a number of tech related news sites, spreading this rubbish far and wide...
InfoWorld: First Windows CE virus emerges: July 19, 2004: By : APPLICATION_DEVELOPMENT : SECURITY
notice right at the beginning how it says the new WinCE virus was designed to demonstrate security holes in the WinCE operating system? this is a subtle point, one that far too many people fail to grasp, but the ability of viruses to infect a platform has nothing to with security holes in that platform... virus infectability is a 'feature' of all general purpose computing platforms... *all of them*... you can't create a general purpose computing platform that isn't susceptible to viruses...
therefore you cannot (as the article's author does) infer security holes in an OS simply because the system is vulnerable to viral infection... it's a shame mass media doesn't have a better grasp on what they're talking about when they're talking about viruses... this one article is being picked up by a number of tech related news sites, spreading this rubbish far and wide...
Sunday, July 18, 2004
all anti-virus products fail
if you haven't figured this out yet (and apparently most folks haven't) there is no such thing as a perfect anti-virus product... they all fail to stop a virus at one time or another either because the virus is too new, or it spread in ways that the anti-virus couldn't do anything about (network share enumeration, exploits, etc), or a host of other reasons...
for years now i've seen people 'discover' the lack of perfection in their anti-virus and the overwhelming response to this is to jump ship and try a different product... the assumption is that because their anti-virus didn't protect them there must be something wrong with it and they should try and find a better one...
the reality is that no matter what product you use, or even how many you use, your anti-virus product will fail at some point... the fact that it failed to prevent an incident (or 2 or 4 or however many it failed to prevent) does not necessarily mean there's anything wrong with the product - it could be that there's something wrong with the user...
the security of a system is only as strong as it's weakest link and most of the time that link is the computer operator - either s/he takes unnecessary risks, or s/he doesn't keep the anti-virus up to date, or s/he doesn't take any other safe-hex measures, etc . . . there's only so much these products can do to protect someone from themselves...
i'll be blunt - the knee-jerk reaction to blame the anti-virus for failing to prevent a virus incident needs to change... users need to start asking themselves if there was something they could have done to prevent the incident - some security precaution they could have taken, some policy they could have put in place... the anti-virus should not be the sole defence against malware, it should be one of many and it should be the one that acts when all other measures fail to prevent the incident...
and what other measures are those?
even after all that, you can still expect a virus/worm/malware incident once in a while... no security is perfect, that's just something we have learn to accept and plan for (i.e. make sure you have a plan for disaster recovery)...
for years now i've seen people 'discover' the lack of perfection in their anti-virus and the overwhelming response to this is to jump ship and try a different product... the assumption is that because their anti-virus didn't protect them there must be something wrong with it and they should try and find a better one...
the reality is that no matter what product you use, or even how many you use, your anti-virus product will fail at some point... the fact that it failed to prevent an incident (or 2 or 4 or however many it failed to prevent) does not necessarily mean there's anything wrong with the product - it could be that there's something wrong with the user...
the security of a system is only as strong as it's weakest link and most of the time that link is the computer operator - either s/he takes unnecessary risks, or s/he doesn't keep the anti-virus up to date, or s/he doesn't take any other safe-hex measures, etc . . . there's only so much these products can do to protect someone from themselves...
i'll be blunt - the knee-jerk reaction to blame the anti-virus for failing to prevent a virus incident needs to change... users need to start asking themselves if there was something they could have done to prevent the incident - some security precaution they could have taken, some policy they could have put in place... the anti-virus should not be the sole defence against malware, it should be one of many and it should be the one that acts when all other measures fail to prevent the incident...
and what other measures are those?
- the use of a firewall
- the closing of network shares and unnecessary ports
- keeping up to date with security patches and the migration away from the most often targeted applications (to minimize the impact of patch maintenance failure)
- minimizing the amount of outside active content (applications, word documents, excel spreadsheets, etc) that are introduced into the system
- turning off unnecessary active content support in your browser
- not accepting attachments from strangers
- not accepting attachments from legitimate contacts until after verifying that they intended to send it and what it is
- the use of strong passwords
- the scanning of all incoming material, preferably after a suitable 'cool down' period so that it's novelty doesn't play a part in avoiding detection of any malware that may be present
even after all that, you can still expect a virus/worm/malware incident once in a while... no security is perfect, that's just something we have learn to accept and plan for (i.e. make sure you have a plan for disaster recovery)...
Friday, June 25, 2004
terminology proposal
i hear a lot about people's machines becoming infected with spyware or infected with trojans or infected with adware or ...
i'm sorry, since when are these things considered infectious? if i connect to a network that has a spyware infected machine on it, is my computer going to become infected? how about if i share disks/programs/word documents/etc with such a machine? no, of course not...
VIRUSES infect, not spyware or adware or whatever... i realize people need a way to indicate that very bad software has been installed on their system but lets not confuse the issue by using terms that already have a different meaning in this field, lets try a new word shall we?
we could use "contaminate"... 'my machine became contaminated with spyware'...
but maybe "contaminate" is too fancy (thus "afflict" is also out of the question) or maybe just not pejorative enough... then the answer is simple - the word we want is "poison"... 'my machine has been poisoned with spyware'... that conveys that something noxious has gotten onto the system and it is quite pejorative...
i'm sorry, since when are these things considered infectious? if i connect to a network that has a spyware infected machine on it, is my computer going to become infected? how about if i share disks/programs/word documents/etc with such a machine? no, of course not...
VIRUSES infect, not spyware or adware or whatever... i realize people need a way to indicate that very bad software has been installed on their system but lets not confuse the issue by using terms that already have a different meaning in this field, lets try a new word shall we?
we could use "contaminate"... 'my machine became contaminated with spyware'...
but maybe "contaminate" is too fancy (thus "afflict" is also out of the question) or maybe just not pejorative enough... then the answer is simple - the word we want is "poison"... 'my machine has been poisoned with spyware'... that conveys that something noxious has gotten onto the system and it is quite pejorative...
Wednesday, June 23, 2004
false authority syndrome finds it's way to The Register
in reference to the following artice:
Beastie Boys CD installs virus | The Register
the author of this article is Thomas C. Greene... consider the byline:
[quote]
Thomas C Greene is the author of Computer Security for the Home and Small Office, a comprehensive guide to system hardening, malware protection, online anonymity, encryption, and data hygiene for Windows and Linux.
[/quote]
there seems to be every reason to take his word as gospel, doesn't there... one problem, the article he wrote for The Register indicates that he clearly has no idea what viruses, worms, or trojan horse programs (3 major classes of malware) are...
the DRM software installed by the new Beastie Boys album is not a virus for 2 reasons... most importantly, it does not self-replicate - it does not make copies of itself, copies aren't placed on your existing music CD's, the installer is not (as far as i can tell) get placed on any new CDR's you happen to burn - the most fundamental requirement for classifying something as a virus is that that something has to self-replicate (this has been true ever since the invention of computer viruses by Fred Cohen in 1983, and you can refer to his numerous works on the subject if you don't believe me)... second, it does not infect any host program - by which i mean that it does not attach itself to any program in such a way that when an attempt is made to execute the host program the DRM software does not get executed as well as or instead of the host program... infection of host programs is generally regarded as a requirement for calling a self-replicating program a virus instead of a worm (another kind of self-replicating malware) or something else...
so it's not a virus because it doesn't self-replicate and it doesn't infect host programs...
Mr. Greene makes further errors in his justification of calling it a virus rather than a worm... there is an argument (that is not particularly well thought out) that says that viruses require user intervention and worms do not - however that argument is meant to be applied to the way the virus or worm gets executed, not how it gets copied (as Mr. Greene seems to think)... clearly, as the DRM software autoexecutes, the DRM software in question better suits the classification of worm under this (dubious) argument...
what the DRM software in question actually is, is the payload of a trojan horse - a trojan horse being something that advertizes itself as performing some desirable function but does something bad in addition to or instead of that desirable function... even a passing familiarity with the field of malware should have made this readily apparent to Mr. Greene....
the legal implications are pretty much the same, though... that much he got right...
Beastie Boys CD installs virus | The Register
the author of this article is Thomas C. Greene... consider the byline:
[quote]
Thomas C Greene is the author of Computer Security for the Home and Small Office, a comprehensive guide to system hardening, malware protection, online anonymity, encryption, and data hygiene for Windows and Linux.
[/quote]
there seems to be every reason to take his word as gospel, doesn't there... one problem, the article he wrote for The Register indicates that he clearly has no idea what viruses, worms, or trojan horse programs (3 major classes of malware) are...
the DRM software installed by the new Beastie Boys album is not a virus for 2 reasons... most importantly, it does not self-replicate - it does not make copies of itself, copies aren't placed on your existing music CD's, the installer is not (as far as i can tell) get placed on any new CDR's you happen to burn - the most fundamental requirement for classifying something as a virus is that that something has to self-replicate (this has been true ever since the invention of computer viruses by Fred Cohen in 1983, and you can refer to his numerous works on the subject if you don't believe me)... second, it does not infect any host program - by which i mean that it does not attach itself to any program in such a way that when an attempt is made to execute the host program the DRM software does not get executed as well as or instead of the host program... infection of host programs is generally regarded as a requirement for calling a self-replicating program a virus instead of a worm (another kind of self-replicating malware) or something else...
so it's not a virus because it doesn't self-replicate and it doesn't infect host programs...
Mr. Greene makes further errors in his justification of calling it a virus rather than a worm... there is an argument (that is not particularly well thought out) that says that viruses require user intervention and worms do not - however that argument is meant to be applied to the way the virus or worm gets executed, not how it gets copied (as Mr. Greene seems to think)... clearly, as the DRM software autoexecutes, the DRM software in question better suits the classification of worm under this (dubious) argument...
what the DRM software in question actually is, is the payload of a trojan horse - a trojan horse being something that advertizes itself as performing some desirable function but does something bad in addition to or instead of that desirable function... even a passing familiarity with the field of malware should have made this readily apparent to Mr. Greene....
the legal implications are pretty much the same, though... that much he got right...
Subscribe to:
Posts (Atom)