Hacker News Reader

Comment by skinney6 | Hacker News Reader

I'm at a loss trying to capture the absurdity of this, but I'll try.. Smith finally escaped Oceania and made a nice home for himself in a free land with free peoples. One day agents from Oceania show up at his door. "No hard feelings bud. In fact we brought a gift. We think it will help you. We want to install these little black boxes all throughout your home." Smith is all ... "ok".

View on HN

It's probably more "Our customers have policies/certifications requiring they have antivirus software everywhere, even if that's stupid. We could tell those customers that we can't offer a solution and they'll go somewhere else. Or we could make the thing they 'need' and get their business". Not very absurd at all.

Can those customers not install ClamAV? Does that not count as anti-virus?

Can I buy an enterprise support contract for it? I honestly don’t see an option on the site. That’s usually a hard requirement in the enterprise.

Cisco AMP is just re-badged ClamAV.

Fun fact that doesn't actually pass on pci-dss1 audit. You need a commercial antivirus with active subscription and centralized monitoring of that.

Also I'm guessing it's easier for admins of mixed infra to have a single threat definition (ie. So your storage server catches the same threats as your endpoints)

Actually, most assessors won't require A/V on Linux.

5.1 Deploy anti-virus software on all systems commonly affected by malicious software (particularly personal computers and servers).

It's typically an ignorant CISO/CSO who wants to mark a checkbox...

It's not necessarily ignorance, but also risk management. Who is the CIO to say that Linux is exempted from that condition? He'd need a stack of evidence that it's not commonly affected, which would need to be kept up to date .

Easier just to say "AV on everything".

A CSO/CISO should be aware of what the threats to their environment are. Otherwise how can they effectively mitigate the risk? They should rely upon SMEs who can keep them abreast of changes in threat models.

Pretending Linux can't host or be affected by malware is a pretty ignorant thing for any ciso/cto to do.

If you were to test ClamAV on a few thousand malware samples you would probably find that the detection rate would be in the low single digits.

At the same time, ClamAV has a terrifying CVE track record.

There's no upside, and all downside.

CVE track record for ClamAV is not perfect, but doesn't seem out of line with similar products.

ClamAV: https://www.cvedetails.com/product/15657/Clamav-Clamav.html?...

Norton AV: https://www.cvedetails.com/product/398/Symantec-Norton-Antiv...

Windows Defender: https://www.cvedetails.com/product/9767/Microsoft-Windows-De...

It may be safer to say that the CVE record for most AV software isn't great.

As I understand it, Microsoft Defender may not be open source, so you have to trust that what you're running really is Microsoft Defender and that it's behaving correctly.

Given that, a possible upside with ClamAV could be that you could verify the behaviour of the processes on the installed systems, to make sure you're up-to-date and have the correct software and signatures installed.

That's not unreasonable - Microsoft's software delivery pipeline should be trustworthy and their security reputation could be damaged if an issue were discovered here.

> Microsoft Defender may not be open source, so you have to trust that what you're running really is Microsoft Defender and that it's behaving correctly.

That’s true of everything installed on a system - if you don’t control the software you’re running, Defender is the least of your worries. Unless you’re doing a full analysis of every binary you’re trusting the source.

God I wish - central management and logging is mandatory under all of these compliance regimes.

We’re in the middle of adopting HiTrust and I’ve been forced to install Cisco AMP on all of my servers. The product is absolute garbage and frequently eats up all available RAM, causing itself to crash and leave a core dump filling up my root partition.

The worst part? AMP on Linux is literally ClamAV plus a kernel module to monitor file access, network connections and process creation.

We've deployed AMP across our RHEL environment, and experienced the exact issues you've described. Cisco's general remediation is to increase the exclusion policy til the core dumps stop occurring. On some systems, AMP is barely monitoring any filesystems...

I've experienced this at one workplace, and I had to install some anti-virus software on my Linux workstation. But it already existed. (It may have even been open source.) I'm not sure how it helps Microsoft to also introduce a product for this.

> I'm not sure how it helps Microsoft to also introduce a product for this.

People don't give Microsoft money for a product that's not by Microsoft. If Microsoft offers one, and can even claim that they cover all platforms with one overarching offering, companies pay them for it.

Google Cybersecurity Maturity Model Certification

You may not want a product like this on Linux. But if you do business in the DoD supply chain, even way down the chain, then you will be required to do so.

You've just defined an absurd and then said that it's not absurd...

This whole thing is a catch 22 - to be taken ”seriously” with enterprise IT you need this badge to show that you are vulnerable.

If you’re not vulnerable and don’t need the badge you can’t be taken seriously.

It’s all very amusing!

fair. But IMHO not absurd in the sense the parent said, and not absurd for MS to do to get benefit in a somewhat absurd situation.

I work at a similar cybersecurity company and I can almost guarantee this is the case. Company policy will be to put an AV on everything, and the CSO/procurement always prefer a one size fits all solution so they only have to deal with one vendor. How well it works on Linux is secondary to the fact that it makes it easy for them to hit all the checkboxes in compliance reports.

This is absolutely the reality. Spot on mate. I am one of those people ensuring compliance. Even though it doesn't matter, I guess it's a compliance thing. For some businesses GRC matters!

In my experience, Trend Micro's antivirus is bullshit not only on Windows but also on Linux. I'm happy if MS Defender for Linux is available and corp adopted it.

Had to double check if we were reading the same post. This isn't meant for home users. It costs a lot of money and is targeting enterprise users. Defender ATP is like Carbonblack or Crowdstrike falcon which support windows and Linux. MS finally supports Linux to compete better. It's a great product but you need E5 license for it.

So it's not the same windows defender product given to consumers? What additional features does Defender ATP have?

Defender ATP is closer to an EDR tool, which means it's designed for detection and response teams, not individual users. It'll take more a reporting and contextualizing approach than an av that is typically blocking.

It's not an antivirus, it doesn't care about binary signatures. It looks attack patterns based on known attacker behavior.

A good linux example would be httpd starting netcat that connects to a remote port. Or firefox spawning a bash shell. For windows a simple example would be when an office app starts wscript or powershell and that child process schedules taks, wmi, downloads a payload,etc... Those are simple examples but they track more complex attack scenarios, for cloud hosted solutions like defender atp and crowdstrike they also collect everything that happens on every device of every customer, so if they find new malware or an attacker with a certain TTP on one device, they will deploy rules to catch that for all their customers.

I think it depends if it's free (GPL/MIT/etc) software or not. Then it's truly a gift, rather than a black box

Though I have a hunch this won't be free software and will have all kinds of telemetry you can't disable.

I mean, it's designed to capture telemetry and push it into Azure for IT to figure out whats going on in the enterprise. It isn't aimed at consumers.

If this does what it designed for that is great.

The Linux ecoystem has consistently p it their fingers in their ears and stop informing the very real and long outstanding problems of malware and apts

What about the very real and long outstanding problems of antivirus software?

What about it? Are those applicable to my reply at all?so worst case scenario Microsoft took the scamiest approach to it possible but it still defeats something. Vs no protection at all because Linux users blatantly ignore apts

Those are the options. Head completely in sand or get some sand in your eyes

Reply on news.ycombinator.com