Hacker News Reader

Comment by verelo | Hacker News Reader

So, what do people run on their servers / macbooks for AV? Anything?

I was in a meeting just last week with our new "head of Security" who exclaimed when i stated our Macbooks nor or Ubuntu severs run any AV software (We run firewalls and things like fail-2-ban, but no traditional AV).

I know i'm going to get into a debate with them over this, so, what would be a good 'win-win' type position for me to fall back on to satisfy this point and not clutter my machines up with junk, if there is such a thing?

View on HN

It depends on your strategy for dealing with endpoint security and why the security folks are demanding it. Usually these requirements are driven by external compliance or some zealous security guy reading NIST docs without context.

For UNIX, try to get ClamAV through or buy whatever solution is cheapest. IIRC, McAfee worked in the most platforms, including AIX.

For Windows, Microsoft stuff (Windows Defender and the "Enterprise" equivalent baked into SCCM) have the lowest impact on the system... But are pretty "meh" solutions. But even the best AV is pretty meh.

Personally, and coming from alot of experience managing lots of computers (or people doing the management), I would recommend running the cheap/free Microsoft AV to check the box and do the following: force users to run without privilege, disallow internet access from privileged accounts, use an application whitelisting solution, use a good proxy/anti malware solution like Palo Alto or zScaler.

The whole point of this stuff isn't to stop threats -- that's a game you always lose. You want layered protection that stops what it can, helps prevent lateral movement and increases the probability of detecting a compromise.

On Windows PCs, I use Microsoft Security Essentials/Defender/Whatever-it's-called-this-release. It's already there, and basically can't be turned off, so why not?

I do not use AV on any other platforms.

Windows MSE can be way more resource hungry than many AVs while providing a worse protection. Symantec might actually be worse than MSE depending on your data etc.

Avira is the best free one right now IMO. No spam you can't opt out of and no pop ups.

> No spam you can't opt out of

nope

What specifically is the pop-up? I don't see any you can't disable.

Any proof for this claim?

I work on a product that required testing of all these AVs in real life scenarios and also requires to improve upon them.

Regarding scanning speed for MSE:

On my current Windows installs (2 VMs - one Win7, one Win10) and one installed on bare metal, it takes up to 5 seconds to scan a 5MB file after it is downloading and before it is run. These systems have a lot of software installed on them so such results may not generalize to everyone.

Also, "antimalware service" sometimes goes nuts and would take up 100% disk usage on non-SSD disks after an update for hours on end. I am not sure what the reason for this is.

Regarding which AVs are faster at scanning:

you can try them all here just for static analysis: https://github.com/joxeankoret/multiav

However, the overhead in many cases doesn't have that much to do with scanning speed but deals with what the AVs choose to scan and what types of files are being scanned.

For example, how do they handle changing files on a live system? Do they take shortcuts with files at a known location with known initial bytes/hash?

Then there is the annoyance factor - Kaspeprsky for example keeps trying to get you to sign up/use their non-antivirus features within the software package.

Finally - efficacy. The only reason we are using the AVs at all.

In the efficacy dept, the best one by far out of traditional AVs is ESET-NOD32. It detects about 70-75% of new threats when they're in PE32 format. Symantec detects roughly 40% in my testing, which is on par with 42% that Microsoft MSE detects. The samples came from a number of sources, but perhaps the best one is virusshare - https://virusshare.com/

Anyone can do their own test if they're so inclined, but nobody should trust the tests where there are claims that the top AVs detect 99.5% of malware. I am not sure where they're getting such numbers but I've never seen more than high 70s on currently circulating recently (within last week) released malware.

I might do a blog post about it later since this is a topic many people disagree on.

Disclaimer: The views expressed here are my own and do not necessarily represent the views of my employer.

Thanks for that lenghty reply! Interesting to hear that NOD32 is still the best.

To be honest, I wouldn't put AV on anything but Windows. There I'd opt for Microsft's Security Essentials since it's the least offensive/annoying solution.

On mac and linux I just don't see the need unless you're doing questionable things or trust shady sources. Be aware that macOS also comes with a very basic and rudimentary protection built-in called XProtect.

Nothing.

The best AV is: - keep everything up to date - uninstall flash, java, silverlight - don't open random junk - use homebrew/homebrew cask to install stuff

> The best AV is: - keep everything up to date - uninstall flash, java, silverlight - don't open random junk - use homebrew/homebrew cask to install stuff

Indefensible. Just browsing a web page is “open random junk.” Ad networks bring malware to mainstream web sites; Adblock is now a major line of defense.

You could wallow in despair, or you could use QubesOS. Which, infuriatingly, does not include IPv6 yet.

IMHO, the best AV for windows is: start a fresh VM at each boot and discard it at shutdown. If your shared folders contains only harmless data, you have almost nothing to fear.

You don't have to discard it each time. You can just have it revert to a snapshot whenever the VM is rebooted.

Web browsers are at least somewhat sandboxed - they have to be. (I'm not sure about adblock - it blocks some threats in an ad-hoc way, but it might add an exploitation vector of its own). QubesOS is only a little bit more sandboxed than a web page; it's relying on Xen (which has a poor security track record) and mostly still using commodity OSes written in C for the insides (though there is some hope e.g. http://roscidus.com/blog/blog/2016/01/01/a-unikernel-firewal... ), so at the moment even running Qubes you're still almost certainly vulnerable in all sorts of places. I agree that something like qubes (that is to say, an OS formed of a number of strictly isolated modules with a small well-defined API between them) is the path to genuine security, but we'll have to at a minimum replace the Xen layer with something proven correct before we can claim to have a genuinely secure system.

Xen has poor security track record compared to which VM or sandbox?

Poor in absolute terms. I don't know that there's a better alternative, but Xen has vulnerabilities frequently enough that at any given time the version you are running is probably vulnerable.

Use a web proxy to block ads and malware sites.

I've never run AV software on any of my Mac computers or any of my Linux PCs. There's no need. I will never get a Mac or Linux virus.

I'm vehemently against running AV software on Linux at the enterprise level, too. The best I've been able to do there, though, is to ensure that on-access scanning (aka "slow the system down to 10 percent of its usual speed for no reason at all") is completely disabled.

Edit: any explanation for the downvotes?

>any explanation for the downvotes?

I noticed that before on this subject: I agree with you and said that before on the subject of AV on Linux and got downvoted. Not claiming there are not viruses on Linux, just saying that, in roughly 20 years of using it, I have never seen one on my servers or workstations. So why would I sacrifice speed?

For workstations I think Linux people are more careful than others (I have no citation just personal experience). I do not need warez and if I have to browse something fishy I do that from a VM or another account; not 100% safe but a lot safer than the entire mess people seem to have on Windows boxes (incidentally it has been around 20 years since I last worked with Windows seriously too).

Just wanted to add on that the down-votes probably come from people that take your comment as perpetuation of the argument that macs don't need AV, vs taking it at face value that its been your experience (and mine) with the OS.

On the flip side, I have 4 infected mac's being flagged by webroot right now because the users downloaded and ran things like fake flash installers. So "every day" users do dumb things on macs and windows. For those user, the AV performance hit is worth it (to me) :)

The thing that kills me is, AV software for Linux is just looking for Windiws viruses. Tripwire seems more appropriate for Linux.

I've had that debate and it was decided that we had to have something. FWIW we use TrendMicro deep security.

Typical AV for Linux is for server products serving mainly Windows clients, and the Windows clients are more probable to run random binaries.

Linux malware, outside of someone trying to crack the computer, largely doesn't exist because have you ever tried to ship binaries for all Linux distros?

ClamAV on public facing smtpd/MX that talk to the world: https://en.wikipedia.org/wiki/Clam_AntiVirus

On Ubuntu you have Apparmor, and mandatory access control (in practice, any sandboxing mechanism) is vastly superior to antivirus, at least in default-deny mode (which, sadly, Ubuntu does not use by default).

If arbitrary software needs administrator level policy set to access the filesystem or devices, rogue software cannot harm your system. If trusted packages also need policy, then exploits in that software cannot do any more damage than the minimum amount of capabilities allocated to the application, which is quite frequently just the apps config file.

I realize that it's better than nothing but be careful with the default AppArmor profiles, they're very coarse grained and allow a lot of stuff that they don't really have to for compatibility reasons (so they just work). I'm not saying they're useless but they could certainly be better and/or tweaked to your needs.

Little Snitch -- at minimum it makes you more aware of who's trying to phone home.

If you know what you are doing, and how the apps you are using work.

It's very easy to shoot yourself in the foot, and prevent apps from working correctly. In addition to driving apps developers mad with bug reports, you can end up being less secure by breaking update mechanisms.

Little Snitch is pretty good at visualizing the traffic, including the blocked traffic. It's not a tool for beginners, however.

You can explain that traditional viruses are less common on Linux. Rootkits and privilege escalation exploits are more likely.

One strategy might be to say that Linux systems are not sheltered from any threat (saying otherwise might lead the other person to consider you as a biased Linux fan), but instead to explain that the threats and consequently the defensive tools to adopt are different.

So, instead of an AV, I would recommend 1) an host-based intrusion detection system (HIDS), like OSSEC or Tripwire, and 2) a kernel patched with Grsecurity.

The HIDS will send you an alert every time an important file (like /etc/shadow) or a new binary / package is installed or modified.

Grsecurity will offer multiple very efficient protection mechanisms against privilege escalation exploits (among other things).

For the MacBooks, I don't know.

That kind of security/noise Avalanche seems only effective for paranoid administrators that can process the data from a small number of servers.

Maybe a little controversial, but I think the most effective solution is simply to replace boxes frequently with full OS updates.

grsecurity[1] for linux.

You don't even have to use RBAC if you don't want to (you can still use AppArmor/SELinux/etc) but RBAC comes with a built-in learning mode which is good and will likely do a better job than you could and generating a profile. Sure you'll probably have to hand tune it a bit but for production servers I see no reason why RBAC couldn't be used with it's training/learning mode.

[1] https://grsecurity.net/

Plugging Alpine Linux, a distro that while known for its small size, which led to widespread adoption as a Docker base image, includes grsecurity by default in its kernel and is very security focused.

It's hard to believe that Alpine is "very security focused", when both the .iso and checksums are served over http/have no https forced.

The ISOs are GPG signed.

True, but public key is also send with http by default and signature doesn't even have proper https. It is possible to securely verify the integrity etc (e.g by using keyservers), but Alpine doesn't help with this at all.

The first tool I run on new Macs is osxlockdown[1] (use [2] if you want a UI). It disables a bunch of features and enables things like the firewall. Make sure you don't disable things you're actually using, though. I don't run any AV, but I use OpenDNS Umbrella, a DNS-level malware blocking service with the capability to switch to "active" traffic filtering (basically a MitM proxy, though that part is completely optional). It's a neat tool with a nice dashboard, and the pricing is okay with $20/year.

OSSEC is a great tool for servers, but not the kind of "Let's just throw some AV at it so we can tick that compliance box" tool many are looking for.

[1]: https://github.com/SummitRoute/osxlockdown

[2]: https://objective-see.com/products/lockdown.html

>[PASSED] Disable IPv6

I'd like to see the rationale behind disabling IPv6 outright.

Edit: https://github.com/SummitRoute/osxlockdown/issues/4

In production you still need to protect from zero days with some form of protection that is not necessarily detection or antivirus such as AppArmor or more commonly SELinux.

On my macbook I run Linux for AV.

https://wiki.archlinux.org/index.php/MacBook

Reply on news.ycombinator.com