Security Beyond Antivirus Programs
83884
It happens all the time to unlucky or unwise Windows users: A new computer crashes and burns after a crippling virus or worm attack. But things can fall apart inside a new PC without such outside help; everyday use can cause a slower form of rot that eventually hobbles the system as thoroughly as a virus might.
716663
Networked multifunction devices share PC vulnerabilities to worms, hackers.
537829
New packages promote promise of improved PC security.
762204
Science & environment: Creators of malware are no longer script kiddies after kudos - they're criminals after your cash. Wendy M Grossman asks if protection can keep pace with them.
356771
While corporations are monitoring ports and using advanced security tools to fend off infection and attack, home users -- who have less technical sophistication -- are left more susceptible, sometimes
426077
Unwanted programs that spy on PC users, deliver pop-up ads and track Web surfing habits will be a hot topic at a security conference that's usually more focused on viruses, hackers and the encryption of sensitive information.
395125
New Web applications--such as wikis, blogs, and podcasts--that foster increased collaboration and communication bring with them a number of new security challenges.
419178
Evil twin hash bash Antivirus firms are concerned about the emergence of techniques that could render meaningless the use of checksums to mark applications as safe.â¦
324468
A vulnerability in Windows XP and other products means JPEG viruses may not remain just a hoary myth.
91685
Many of you can't be trusted with your own computers. Stupidity isn't the problem. It's laziness, mostly, combined with a penny-wise stinginess that resents the $40 price of a good antivirus program.
35029
Unpatched vulnerabilities may leave computers open to remote attacks.
195221
Windows XP Service Pack 2 promises to raise the security bar for the sometimes beleaguered operating system. Unfortunately, one of the new features could be spoofed so that it reports misleading information
185711
Also: High security built right into $100 laptop's OS. Read these stories and more from around the Web at News.com Extra.
576139
eTrust Antivirus mistook a critical security process for malware.
405621
Computer users could stop most viruses and cyber attacks by fixing a small number of common flaws, according to new research. Viruses, spam and distributed denial of service attacks could
503690
(InfoWorld) - Antivirus software is frequently tested for performance, so picking a top product should be straightforward: Select the No. 1 vendor whose software kills off all of the evil things circulating on the Internet. You're good to go then, right? Not necessarily. The increasing complexity of security software is causing vendors to gripe that current evaluations do not adequately test other technologies in the products designed to protect machines. Relations between vendors and testing organizations are generally cordial but occasionally tense when a product fails a test. Representatives in both camps agree that the testing regimes need to be overhauled to give consumers a more accurate view of how different products compare. "I don't think anyone believes the tests as they are run now ... are an accurate reflection of how one product relates to the other," said Mark Kennedy, an antivirus engineer with Symantec. Representatives of Symantec, F-Secure,Â and Panda SoftwareÂ agreed last month at the International Antivirus Testing Workshop in Reykjavik, Iceland, to design a new testing plan that would better reflect the capabilities of competing products. They hope all security vendors will agree on a new test that can be applied industrywide, Kennedy said. A preliminary plan should be drawn up by September, Kennedy said. One of the most common tests involves running a set of malicious software samples through a product's antivirus engine. The antivirus engine contains indicators, called signatures, that enable it to identify harmful software. But antivirus products have changed over the last couple years, and "now many products have other ways of detecting and blocking malware," said Toralv Dirron, security lead system engineer for McAfee Inc. Signature-based detection is important, but an explosion in the number of unique malicious software programs created by hackers is threatening its effectiveness. As a result, vendors have added overlapping defenses to catch malware. Vendors are employing behavioral detection technology, which may identify a malicious program if it undertakes a suspicious action on a machine. A user may unwittingly download a malicious software program that is not detected through signatures. But if the program starts sending spam, the activity can be identified and halted. Also, a program can be halted if it tries to exploit a buffer overflow vulnerability, where an error in memory can allow a bad program to run. Host-based, intrusion-prevention systems, which can employ firewalls and packet inspection techniques, can also stop attacks. The ways in which a computer can be infected also make comprehensive testing complex. For example, users may infect their computers by opening malicious e-mail attachments or visiting harmful Web sites designed to exploit known vulnerabilities in a Web browser. The different modes of attack also involve different defenses, all of which would need to be tested to arrive at an accurate ranking, analysts said. By contrast, signature-based tests can take as little as five minutes. "This is a very basic test," said Andreas Marx of AV-Test.org, who wrote his master's degree thesis on antivirus testing. "It's easy, and it's cheap." Other concerns remain, over sample sets of malicious software, the age of the samples and the relative threat those samples pose on the Internet as they become older. Security vendors also think tests should check how well security applications remove bad programs, a process that can affect a computer's performance. For vendors, a failed test can be embarrassing, since the testing companies often issue news releases highlighting the latest results. Testing companies make money in various ways. AV-Test.org is often commissioned by technology magazines such as PC World (a magazine owned by IDG). Virus Bulletin licenses its logo to companies for use in promotional material and publishes a monthly online magazine. Earlier this month, Virus Bulletin announced that its latest round of testing produced some "big-name failures," including products from Kaspersky Lab and Grisoft SRO. The company's VB100 tests antivirus engines against malware samples collected by the Wildlist Organization International, a group of security researchers who collect and study malware. To pass the VB100, products must detect all samples. Kaspersky briefly removed a signature for a worm out of its product for "optimization" purposes on the day of the test, wrote Roel Schouwenberg, senior research engineer for Kaspersky, in an e-mail. The signature has since been put back in, he said. "Obviously, we would have rather passed than failed," Schouwenberg wrote. "Had the test been conducted a day earlier or a day later, we would have passed." Similarly, F-Secure initially failed its test also because of a technicality, but the failed rating was later reversed. All vendors are told after testing which samples they failed to detect, thus most end up adding signatures to their products. So what should a user do? John Hawes, a technical consultant for Virus Bulletin, cautioned that the signature-based tests are "not enormously representative of the way things are in the real world." But Hawes also noted that signature-based tests can indicate the reliability and consistency of a vendor's software. Virus Bulletin also writes reviews of AV suites, which take into account aspects such as usability, which may be just as important as detection for consumers. The company is developing more advanced tests that will test new security technologies. AV-Test.org is already performing more comprehensive tests, although it uses between 30 to 50 malware samples, a much smaller sample set compared to the Wildlist, which uses more than 600,000 samples, Marx said. Those tests may give a better indication of how a security software suite performs. At a bare minimum, through, users should install some security software, as computers without it can face high risks, Marx said. Several free suites are available that may be fine for light Internet use, he said. Ironically, Marx doesn't use any antivirus software. That's because AV-Test.org collects malware for its testing, most of which comes through e-mail from other researchers. "I'm getting about 1,000 viruses a day," he said. "It [antivirus software] would be counterproductive." Â
564167
Viruses and worms just keep getting smarter and more devious. While the best defense is not opening e-mail attachments, you still need a solid antivirus program.