Security Vendors Challenge Antivirus Tests
103643
Makers of security software question the thoroughness and accuracy of evaluations.
509953
During a weeklong period in mid-November, security experts with Symantec observed roughly 65,000 new applications being downloaded onto the computers of customers participating in a new research project -- based on their analysis of the software, as many as 60 percent of the programs were malicious.The involved timeframe represented a relative high point for the percentage of unknown applications being downloaded by Symantec's project participants, and the basis for the company's assessment of the programs as malicious was predicated largely on the programs' use of obfuscated naming conventions.However, the numbers point to a disturbing trend that the researchers say may force the security company to change its fundamental approach for warding off threats -- that being that the number of malicious applications coming to life on the Web appears to be outpacing the volume of legitimate programs.With malware authors using fuzzing tools to find holes in popular applications such as Web browsers, and testing their work against commercial anti-virus (AV) products to ensure that the attacks evade detection by the tools, leading researchers at Symantec admit that defending against threats using traditional methods has become something of a losing battle."The reality is that most new malware is going undetected by commercial security products, and not just Symantec's, but we have to recognize that like all other AV products we are probably missing a sizeable amount of this malware," said Carey Nachenberg, a member of the company's Security Response team who also wears the title of Symantec Fellow."Eventually we write [virus] signatures and get those out to customers, but it appears that a sizeable proportion of this malware never gets detected," he said. "Instead of distributing one copy of each malware program to thousands of people, they're producing a copy for as few as two or three people and then re-writing it; so, if we get one version we can remove it from a few computers, but not all the variants. The problem with this is that there is the potential over time for almost everyone to have some form of infestation, maybe in only a few years time."The trend toward malware authors using small runs of attacks to evade detection and hook as many victims as possible, known as server-side polymorphism, is forcing Symantec to reassess how it goes about protecting its users.Since it can't hope to keep up with every flavor of threat that is being created, traditional countermeasures such as the use of malware signatures or behavioral heuristics will need to be augmented with new tactics, Nachenberg said.One such alternative is the use of the same distributed data collection capabilities that Symantec is using to track the proliferation of malware. By creating a system of file and Web site reputation by studying applications usage patterns among its customers, the researcher said, Symantec hopes to use a community approach to help people determine which programs they decide to use, or avoid.Much as many people turn to the reviews section on Amazon.com or the buyer feedback system on eBay to get a real-world take on products before they decide to buy, Nachenberg contends that by watching how people are using various applications the security vendor can use a process of elimination for weeding out malware from legitimate software.If only a few people among the millions of Symantec customers who could contribute usage data to such a program were utilizing some application in question, it would be prudent to recommend that people avoid the program until its nature has been better determined, he said.Using opt-out tools that provide anonymous feedback on applications that were built into Symantec's existing Norton AntiVirus and Internet Security 2008 products, the company is already gathering the type of data necessary to create such a system of recommendation."Right now this is just a long-term research project, but we hope that as we get more users involved in the system, we can truly get a better idea of what is on people's computers so that we can identify malicious software based on the demographics of who is using it, versus what it does," Nachenberg said. "We're hoping to get more clarity through the large base of users we have; by collecting this data we should be able to get the most comprehensive view of the usage patterns to derive reputation information for everything they use."Faced with questions over potential privacy issues driven by Symantec's ability to watch just who is using what applications and how, the researcher reiterated that users must be made aware of the data collection, allowed to opt-out, and guaranteed that all the information aggregation is done in an anonymous fashion.By offering users the ability to decide whether or not to use an application based on demographics, versus simply blocking programs based on its own observations, the company will also give people more freedom to determine what tools they feel are appropriate to use, he said."If we know that only five people are using a program, given the tens of millions of users we ultimately hope to have in the system, we can be totally objective and recommend that people wait until it is scrutinized further before using it," the researcher said. "We will need to have some manual process for white-listing programs as well, but we think that using this approach we can deliver a reasonable amount of quality with a low false positive rate."If the volume of new malware strains arriving on the Web continues to outpace the proliferation of legitimate programs, Nachenberg said that AV vendors including Symantec may need to move to a white-listing approach in general, and focus more attention on identifying good applications instead of trying to chase down all the bad."If there is less software to analyze that is good, it makes more sense to spend our time scanning for good programs and simply telling our users to avoid everything else," he said. "We're considering models where we can produce the world's largest up-to-date white list of software, but it's not something we can put together in a year; maybe in two-to-three years time."
632565
As malware threats and regulatory compliance demands continue to grow more complex, IT will become increasingly dependent on SaaS (software as a service) offerings that let them respond to problems faster while also saving money, according to top executives at the world's largest anti-malware vendors.In addition to continued adoption of managed security services delivered on- and off-site by professional consultants, IT customers will be able to resolve some of the problems they have with existing IT systems defense and compliance automation tools by shifting away from on-premise technologies in favor of adopting more hosted applications, vendor executives contend.While security technologies such as end-point protection suites and IDS (intrusion detection systems) will likely always require the use of software agents that reside on customers' devices and network infrastructure, vendor executives claim that a range of technologies, including exploit-prevention tools and compliance-monitoring filters, will gradually move to the SaaS model.As a result, providers such as McAfee, Symantec, and Trend Micro, among others, are already ramping up their SaaS portfolios to adapt to the shift."We believe that [SaaS] is the wave of future, and we already deal with the issue of updating tens of millions of machines remotely multiple times per day in multiple geographies. It's one of most complex things to do in all of technology, and one of the most impressive assets that I think we have," said David DeWalt, CEO of McAfee."IT budgets are not growing, but the threats and regulatory demands are, and customers are finding themselves thin on resources. SaaS will be a great way for businesses to save on infrastructure and maintenance costs while improving protection," said Jeff Hausman, Symantec's senior director of product management. "There's no question that the hosted model is growing dramatically."McAfee expects a SaaS transition over time Building on the infrastructure that vendors such as McAfee have already established to distribute anti-malware signatures and other product updates to their customers, the companies will add new SaaS offerings incrementally as customers warm up to the ideal.The security software providers themselves must also figure out the appropriate mix of on- and off-site tools, as well as refine pricing policies for the services over the next few years, CEO DeWalt said.However, DeWalt recognized that the process of designing and delivering SaaS products -- and selling customers on their benefits -- won't be achieved overnight. "It's a very complicated technology project, sometimes not even related to development of our own technology, but based on the IT infrastructure needed to deliver SaaS as effectively," he said. "We've learned a lot through our experiences building [anti-malware] products for the consumer and small-business markets, and we'll use those lessons to move into the SaaS business over time."As part of its move into SaaS, McAfee announced the acquisition of ScanAlert, a provider of hosted e-commerce Web site security services, for $51 million in October 2007. The company will consider additional deals in the area if there are targets that can aid in its development of the business, DeWalt said.Trend Micro, others see Intelligence in the cloud Along with e-mail filtering services -- one breed of security SaaS application that has already proven a hit with customers of companies such as Postini, which Google acquired for $625 million in July 2007 -- vendor executives contend that hosted tools used to provide end-point and network security management services will be among the first to find favor with IT and end-users.Trend Micro CEO Eva Chen said a growing number of the firm's small-business customers are already using its Remote Manager hosted tools to maintain configuration of their security programs and prevent their end-point systems from being altered by malware programs such as rootkits."We began quietly moving forward in this direction several years ago, but I believe 2008 will be a big year for SaaS development, not only because of vendor initiatives, but because of the need to deal with new threats among customers," Chen said."We think that there will be a need to move anti-threat knowledge from the customer into the cloud," Chen said. "Instead of having them download a virus pattern file, we will filter things and compare them to intelligence in the cloud, and then go to the end-user and update them without having to download the larger files used today."Keeping the channel involved Established SaaS applications in other markets, such as Salesforce.com's hosted sales-force automation tools, have traditionally bypassed resellers and other channel players and instead been provided directly to customers by vendors themselves. That may not be the case for SaaS-delivered anti-malware, Chen said.The reason? Even though SaaS tools are meant to alleviate many of the management concerns related to traditional on-premise products by handing the responsibilities back to the vendors, channel partners will be important in providing any services necessary to help users transition to the delivery model, or to customize the applications to individual business environments and provide any needed support services, Chen said.Symantec, which has pledged to turn as many of its products into SaaS offerings as it can do profitably, has also promised to keep its resellers in the loop as its brings new hosted services to market. Most customers adopting SaaS services will still consume traditional security products, leading the company to pursue a hybrid strategy that mixes the two disciplines, said product director Hausman."We have the infrastructure to provide the service, but resellers will still maintain a lot of the relationships," Hausman said. "We're the brand behind delivery to the customer, but the partner is still the same name and face that customers have grown comfortable dealing with over time."Diverse opportunities Symantec's maiden foray into SaaS is its Protection Network online secure backup service aimed initially at smaller customers, hundreds of which are already piloting the offering, according to Hausman. But Symantec is preparing several other hosted products for release.E-mail security is one area where Symantec sees SaaS opportunities, built on the success of acquired companies such as Postini. Other services that the company is pursuing might come as a surprise, including its bet that elements of DLP (data leakage prevention) and compliance monitoring can be moved to the SaaS delivery model.Vontu, the DLP gateway specialist that Symantec purchased in November 2007 for $350 million, didn't have a SaaS offering under development, but Hausman believes that under Symantec's wing, the unit can create new capabilities by tying some of the on-premise capabilities of its technology with in-the-cloud services for message filtering and archiving.Other opportunities for SaaS will emerge around anti-virus protection, security policy management, remote systems management and IT continuity protection, he said.
274144
(InfoWorld) - They just don't make malware like they used to. Or at least like they did earlier this year. Even low-quality malware, however, is taxing the resources of security companies, since it is being detected in ever-higher numbers. Over the last six months, the technical creativity of malware has fallen along with the ability to cause massive damage, such as that created by the MyDoom and Sasser worms of years past, wrote Alexander Gostev, senior virus analyst for Kaspersky Lab, in a recent report. Gostev's lab intermittently sees highly technical malware, but most is "the same unending stream of Trojans, viruses and worms," he wrote. In many cases, hackers simply take existing malware and create variants, by tweaking the older code to evade antivirus software. At times, the process is simple trial and error. Malware writers use online scanners such as Virustotal , which check to see if their new code will be detected by antivirus software, said Mikko Hypponen, chief research officer for F-Secure. If the code is detectable, they can make a slight modification and run it through the scanner again. "I'd like to tell you that we're winning this war," Hypponen said. "But frankly, I'm not so sure. We need new kinds of solutions." Because much of the code is not new, it tends to remain effective for shorter periods of time before antivirus companies detect it. Still, the time it takes to identify and create a signature for a new virus, which can range from a few minutes to a few hours, is often long enough for hackers to infect computers. "Antivirus companies are working at the limits of their capabilities in terms of speed," Gostev wrote. To be sure, some malicious hackers are doing creative work. This year saw some sophisticated phishing attacks, and virus writers have been branching into relatively new areas like instant messaging and social networking sites, noted Christopher Boyd, security research manager for FaceTime Communications. But the trend overall, he said, has been "quantity over quality." Kaspersky Lab in Moscow is on the front lines of the battle. Its analysts added 2,000 signatures to their database in January 2005. Last month they added 10,000 signatures -- a five-fold increase, said Stanislav Shevchenko, head of the lab. The virus analysts work 12-hours shifts, pulling up screen after screen of rolling lines of code. Automated tools analyze some pieces of malware, but human analysis is still needed for others. A good analyst should process an average piece of malware within 5 minutes, Shevchenko said. But some of the rarer, more creative code is harder to crack. Polymorphic viruses -- ones that can change their byte sequences to throw off antivirus software -- can take up to a week to analyze, Shevchenko said. The signatures are added to a database used by Kaspersky's antivirus engine, which is licensed by other security vendors such as Juniper Networks, ClearSwift , and F-Secure. The increase in the volume of malicious code can be attributed in part to the impunity enjoyed by malware writers, said Eugene Kaspersky, head of antivirus research. Despite efforts by law enforcement agencies to strengthen international cooperation, most malware writers are never punished. "It's quite safe for them," Kaspersky said. "If they are clever enough, there is almost no risk for them at the moment." The U.S. Federal Bureau of Investigation and Russia's Federal Security Service (FSB), the successor to the country's KGB intelligence agency, frequently ask Kaspersky Lab for information, said Kaspersky spokesman Timur Tsoriev. The FSB, however, approaches Kaspersky less these days since the agency has bolstered its in-house expertise, Kaspersky said. Kaspersky said his lab focuses less on finding the root of criminal activity than protecting the company's customers. But the burden of rising online criminal activity directly impacts security companies, he said. "If there is no help from the police and if they don't reduce the number of criminals, I'm afraid the detection for all antivirus products will go down," Kaspersky said.
443548
Flaws in Adobe Reader and Acrobat are being used to exploit computers; company urges customers to install the patch.
633509
- Security software maker Symantec Corp.   said it sued a large network of distributors selling  counterfeit Symantec software, and sought over $15 million in  damages.
693150
Software vendor mulls how to compensate Chinese comupter users effected by a buggy antivirus update last week.
555292
Online technology retailer Geeks.com displays a security vendor's "Hacker Safe" logo on its Web site. But now it's warning customers of a possible data compromise.
738941
An anonymous researcher has reported through several sources that anti-virus products from six vendors fail to detect malware when it is contained in a corrupted Zip file.
256536
InfoWorld - Four security software rivals are have teamed up to set a baseline standard for application security firewalls, challenging others in the industry to join them.
671001
The U.S. International Trade Commission (ITC) has voted to investigate claims by Trend Micro of competitors&#39; patent infringement involving antivirus products.Trend Micro filed a trade complaint Nov. 21 against fellow cybersecurity vendors Barracuda Networks of Campbell, California; Panda Software International, based in Spain; and Panda Distribution of Glendale, California.Trend Micro&#39;s complaint accuses the three companies of infringing its patent for virus detection and removal apparatus for computer networks. The technology &quot;represents a dramatic departure from the traditional antivirus methods of safeguarding individual computers,&quot; the company says in its complaint.The Trend Micro complaint accuses Barracuda of importing antivirus software that infringes its patent. The complaint says Barracuda uses code from the open-source antivirus product ClamAV, which is written in part in Europe and Australia. Barracuda also imports hardware components, the complaint says.Panda&#39;s products also contain code imported into the U.S., the Trend Micro complaint says.A Barracuda spokeswoman said the complaint is curious. &quot;It is interesting that the ITC has decided to take up an investigation, given Barracuda Networks manufactures all of its products in the United States and does not import anything of significance,&quot; said Kylie Heintz.A Panda representative didn&#39;t immediately respond to a request for comments.The ITC case will be referred to an administrative law judge, who will schedule and hold an evidentiary hearing. The judge will make an initial determination as to whether there is a violation of section 337 of the Tariff Act of 1930. That initial determination is subject to commission review.The ITC will make a final determination in the investigation at the earliest practicable time, the commission said in a news release. Within 45 days, the ITC will set a target date for completing the investigation.
45206
The US Federal Trade Commission last week filed a legal complaint against two companies that allegedly infected computers with spyware and pop-up advertising, then tried to sell their owners spyware-blocking software.
89358
It has been an interesting 24 hours for anybody keen on web application security. Network World Labs Alliance Security Expert Joel Snyder, played down the danger of web application security and challenged Acunetix to hack a website.
33683
The Web site of AvSoft Technologies attempts to install a virus on visiting PCs, security firm warns.
564903
A serious security hole in a wide swath of the company's antivirus products could let an outsider crash or hijack a computer.
200272
Security pros have their say Anti-Virus vendorsâ¦
226075
Test of 15 antivirus packages shows failures in four. Microsoft pledges improvements; McAfee says its updates weren't included.