Hacker News Reader

Comment by jconley | Hacker News Reader

The business of antivirus, especially, has a huge incentive to shove it IN YOUR FACE that the software is detecting things whether they're false positives or not. This scares people into re-upping their subscription. Most computer users don't understand there can even be such a thing as false positive. For all those support calls you get, there are probably 10x that number that simply take the security software on its word and let it delete/block your application.

An aptly timed popup from the antivirus vendor will appear shortly thereafter asking the user to pre-purchase 2 more years of complete computer protection! Oh, the business of fear mongering. . .

EDIT: This is one of those very hard problems startups should be solving.

View on HN

It's flat out wrong of you to say that antivirus companies don't care about FP's.

There are over 25k new malware samples coming out daily, and everybody is just trying to cut through them as fast and efficiently as possible. Yes there are innocent casualties of this -- False positives -- but these are sincere mistakes .

False positives are very embarrassing for the security company. It is something that can even cause people their jobs. Don't you think for a second that these are not looked at.

I make malware definitions for a living, and you can trust me when I say that I check the FP reports first thing every morning, several times during the work day, & I check our forums every night at home to make sure we don't have any FP's rolling in.

At most security software companies, FP's taken very seriously & I know that personally I would love to be able to educate Indie developers about what triggers detections and ways we can both work together to reduce them. It's easier said then done, however, and also it is delicate info that you don't really want to yell off the rooftops - because malware creators could really use the same info to their advantage.

I didn't say the industry doesn't care. But, the business model relies on detecting as much as possible and shoving that in your face to get more bookings. I have no doubt you take false positives very seriously at an engineering level.

However, the bottom line impact of a false positive on some indie software has to be negligible.

All of this. False positives are horrible for both antivirus companies and their customers, and great care is typically taken to avoid them.

Not to mention that if you start alerting the user too much, they'd start tuning out the alerts; that becomes a big problem if and when they're infected with something.

I'll respond with a variation of what naner describes ( http://news.ycombinator.com/item?id=3511551 ).

Specifically with Norton, I've received warnings/quarantines where it's rather non-obvious and difficult to learn what the actual problem is. The program's interface allows one to click and drill down one or two levels, but the descriptions are often more non-descriptive than descriptive. And then one faces a link (which is, by the way, not tooltipped or otherwise designated as a link) that fires up your browser and takes you to a web page on the security software vendor's (in this case, Norton) web site.

Well, that's f-ing annoying. And then, to boot, often the page that is navigated to contains content that is little or no more helpful in telling you what specifically they detected or why specifically the warning/action triggered.

I recall one case in particular, where going through all this and reading between the lines, it appeared that the quarantine was the result of a "reputation" trigger. Norton wasn't familiar with the executable and it didn't have much or any presence in their reputation system, so the default action was to flag it a "high security" risk and to "quarantine" it.

I understand there is a balancing act. If you don't keep it simple and use strong enough language, Joe Blow user may start to disregard the warnings, until soon enough s/he has a real problem.

But as a more advanced user, this is completely frustrating. I want to know what the problem is, so that I can make an informed decision with regard to the "security event".

(And yes, on the Windows machine, I do run Norton. Comes with my only Internet connectivity option, anyway, and it makes an acceptable, and useful, component of a layered defense.)

I got bit by this reputation thing just this morning. I'd sent out a link to a .exe for a dead simple app (open serial port, tx commands, rx replies, output to screen) and sure enough, someone tried to download it and got blocked by Norton. I sent it in as a FP, not in the hopes they'll do anything about my little .exe, but just to make more work for them.

I wrote a Windows program for my dad about a year ago. It would have worked great. I was thinking about selling it, actually!

Except, the antivirus flagged it. I called the AV vendor and they (probably the first-line tech support) said unless that my dad called the vendor, they could do nothing.

The only false positive that might be remotely reasonable is my executable name is identical to a virus. rte.exe or something similar, as I recall. Whatever. A binary difference should have demonstrated substantial difference between my exe and the virus.

So, my dad didn't get his program, and I got left with a renewed awareness that AV vendors are ruinously unhelpful, and I'd rather work on moving my family and friends to Linux or OSX.

So you spent the time to write a program, one good enough to consider selling it even, but couldn't be bothered to try changing the executable name? Or ask your dad to call the AV vendor?

Am I mis-reading you?

I did ask my dad to call. Nothing seemed to come of it. I was working in a hurry and didn't think to simply change the exe name, making the presumption that such a simple thing shouldn't influence the AV decision.

The name of the .exe certainly matters.

When going through airport security, do you think it matters at all if your name is Osama Bin Laden? Such a person is going to experience a much larger degree of scrutiny from TSA then a person named John Smith.

If a mere name alone is enough to create a false positive and changing this is a living nightmare, why are you in the least bit surprised that customers and developers are livid at having to deal or workaround the closed and disparate world of AV?

Neither is it the least bit surprising that support personnel and developers consider the shear number and consistency of false positives as "fear-mongering".

It would only take a further small step to then consider, what is the point of having AV at all in the first place since the best it can do is fill an increasingly small hole in prevention for ordinary user behaviour and a static role for precursor forensics (actual forensics would not need the service).

TL;DR. AV industry has a LOT to answer for, to the point where it maybe should not exist in its current form.

I think it can be justified. It's not common, it's known as being one of the more crude methods of detecting malware -- but hey -- we use what works and what fixes peoples machines. That is why it is in use by some vendors today.

Here's an example:

Some companies block anything named 'svchost.exe' that isn't in system32. Create a txt doc and name it svchost.exe and drop it on your desktop and some antivirus software will detect and remove that item.

Why? Because there is no good reason for someone to have svchost.exe anywhere other than SYSTEM32 and also because svchost.exe is one of the top 10 most common names for malware. So, at risk of some FP's -- some companies have a rule that simply removes these if found anywhere else.

If I'm a 6 foot white guy with blond hair and blue eyes with the name bin Laden, I would expect some funny looks and nothing more.

Names - particalarly short ones - are not what you might call unique identifiers.

It's idiotic to match on names like rte.exe.

Of course it is. No legit anitvirus company is blocking all files named rte.exe. That's insanity. I am just saying in some circumstances, the name of a file can be a huge help in indicating that maybe you should take a closer look.

Why didn't you install the AV software on your machine, get the false positive, then call the company on your own behalf?

Or just impersonate your father on the phone?

Which is why MS Security Essentials really is a fresh breath of air compared to everything else (that I've tried).

A false positive is very bad for the AV Company if the file is part of the OS of a lot of computes. For example;

AVG update bricks Windows 7 (Dec 2010): http://www.theregister.co.uk/2010/12/02/avg_auto_immune_upda...

McAfee update shutting down XP machines (Apr 2010): http://www.engadget.com/2010/04/21/mcafee-update--shutting-d...

A lot of virus protection software seems like the electronic equivalent of [protection racket](http://en.wikipedia.org/wiki/Protection_racket).

They throw up these scary pop-ups that basically say "this is a nice computer you have isn't it? It would be... terrible if something were to happen to it, wouldn't it?"

Interestingly, the best AV I've found seems to be the one from microsoft.

"Oh, the business of fear mongering."

couldnt agree more. I am using PC with XP/7 for years now and never had a virus. I go online into some questionable websites and downloads sometimes but if user uses a common sense, he wont open that AllPrinterDrivers.exe from unknown source just to install drivers to his printer.

I never needed and I think I never will need an AV.

Until you get hit with a zero-day browser exploit that doesn't need you to install an exe to run.

Question: if he's hit with a zero-day exploit, how does having AV installed help?

Answer: Good definitions are crafted so that are intended to detect not only all existing versions seen but also allows room for change and file characteristic changes so that future versions of the malware family can be caught with the same definition.

Good definitions will go on killing items in the wild well past the date the initial zero-day came out (the one that caused the need for the definition in the first place).

This is why brand new generations of malware drop and they are detected by a few security guys. This is also why some people have huge #'s of FP's -- because they allow so much room for flexibility to catch future malware - that they accidentally kill off legit files in the process.

Well, ok, that makes sense; I thought the OP was trying to say that AV provides protection against brand new zero-day exploits which seems like wishful thinking.

No, I meant basically what jgmmo said, the AV scanners pick up a lot more than the virus they were written to prevent. Anything that triggers virus-like behavior will let you know you're infected (might not be able to clean it though). That's one of the points made in the article about false positives.

how will AV help against zero-day browser exploit? Zero-day, by their very definition, have no antivirus definition that will catch them yet.

On my personal machine, I don't run any anti-virus software, but I also don't use adobe pdf and enable flash only on sites I trust.

One of the reasons the author is complaining about AV is the very reason an AV will likely catch a browser exploit that runs local code. The program the author tells you to write in C doesn't have a definition either, but the code matches an signature that the AVs will look for, same with browser exploits. Native code running without the OS knowing why will usually end up being flagged.

Safe Hex is an important part of keeping a machine clean. (See, for example, RSA being hit because someone opened an Excel attachment.[1])

But as malware authors find more holes and use more exploits it becomes harder to know what's safe or not. Having some weird defaults in operating systems (don't show file extensions; perform an action based on the extension and not the type of file; build a web-browser into the OS; use a preview pane that auto-opens a lot of things so you don't need to "open" an email message it's been opened for you by the pre-installed email client etc etc) really didn't help.

There's also a problem with users. (This comment in not aimed at you!) Some operating systems have very many users who believe themselves to be clueful but who really really are not. The arrogant 19 year old who can slot together a motherboard and GPU and PSU and put them in a case, who can connect his aunt's computer to the Internet, who can install add-ons to his web browser. These are people who think they know what they're doing, who think that the pirated OS they use is fine because they checked an MD5 hash, and who think the pirated software they use is fine because someone would have said something in the torrent comments if it wasn't. And then, if they have a problem, they'll download a pirate AV and hope that isn't infected. These are the people most mocking of the "wipe and re-install; that's the only safe option" philosophy. They'll spend a day using various bits of anti-malware and scanners and web-searching. And they won't find the infected WMV file and they'll get re-infected a few days later.

[1] (http://blogs.rsa.com/rivner/anatomy-of-an-attack/)

It drives me crazy when we find an infected computer at work and the solution posited by both the user and the desktop team is "run the corporate AV". No. We have a backup system for a reason. If you don't use it (like the policy mandates you do), that's your fault. The machine gets completely wiped and reimaged.

AVs are a first-line and an indication that something is wrong. If you need to run the AV to clean an actual, real virus, you should be reloading the machine.

Reply on news.ycombinator.com