Text 12928, 58 rader
Skriven 2006-09-11 14:23:46 av Rich Gauszka (1:379/45)
Ärende: anti-virus programs useless?
====================================
From: "Rich Gauszka" <gauszka@hotmail.com>


http://www.infoworld.com/article/06/09/08/37OPsecadvise_1.html?source=NLC-STOAD
V2006-09-11

Over the last two years, malware has become professional crimeware. No longer
coded by kids hoping to impress their friends, crimeware is big business. It's
more sophisticated, hides better, and contains more tricks; instead of one
attack vector, it contains 10. The professionals intentionally code their
malware programs to escape detection. Often, the latest crimeware bug is
nothing but the same old Spybot or Sobig variant malformed just enough to
escape anti-virus scan detection.

There are several Web sites (e.g. virusscan.jotti.org or www.virustotal.com)
where users, rogue and legitimate alike, can submit their malware program to
find out which of the top anti-virus scanners detect it. These days, most of
the malware programs I find go undetected by any of the scanners, or at best,
are detected by maybe one out of five.

Several recent studies, including one by Consumer Reports (subscription needed
to access the CR study, but the results are available in this Dvorak Uncensored
post), conclude that anti-virus companies aren't doing a great job in detecting
slightly modified malware threats. The best anti-virus program only detected 87
percent of the newly modified threats; many of the most popular programs were
in the 50-to-70-percent range. Virustotal reports that only 2 percent of
submitted viruses are detected by all anti-virus scanners.

In my personal experience, the most popular anti-virus programs are only about
20 percent accurate against new threats. I can't tell you how many times I've
heard my customers say, "But I've got an up-to-date anti-virus program!" when I
find an infection on their PC. It's about all I ever hear these days when
cleaning up a system after a malware attack.

It's not as if anti-virus programs can't recognize new threats. Most of them
have behavioral checkers (i.e. heuristics), but these mechanisms don't work
very well, or they minimize behavioral checking or turn it off entirely. Either
they aren't accurate (giving you false negatives), or they cause too many false
positives. And when they are turned on, they slow down the user's system. The
end result is that most anti-virus scanners are inaccurate at detecting new
threats.

Accuracy problems get even worse when other threats are added to the mix.
Anti-virus companies came late to the anti-spam and anti-spyware battlefield,
and half a decade later, most still do a poor job defending against those
threats.

Aside from becoming less accurate, anti-virus scanners are more frequently
cited by administrators as a major cause for downtime. They are buggy, often
falsely flag common operating system and application files, and frequently
contain exploitable holes themselves. Add the predatory nature of their update
schemes, and the anti-virus industry -- whether it realizes it or not -- is
headed for a consumer precipice.

It all begs the question: Is the anti-virus scanner necessary?

--- BBBS/NT v4.01 Flag-5
 * Origin: Barktopia BBS Site http://HarborWebs.com:8081 (1:379/45)