Comment by jerf | Hacker News Reader

Comment by jerf | Hacker News Reader

Parent Full thread

"'consumer-grade antivirus products can’t protect against targeted malware created by well-resourced nation-states with bulging budgets'"

That's not the relevant bit. This is the relevant bit (emphasis mine):

"As far as we can tell, before releasing their malicious codes to attack victims, the attackers tested them against all of the relevant antivirus products on the market to make sure that the malware wouldn’t be detected."

This means that they can be certain they've bypassed the signatures, and whatever imperfect heuristics are being used have been bypassed, with the attackers essentially having all the time in the world to play with and understand the heuristics, up to and including a complete disassembly of the heuristics if necessary. And you can't have perfect heuristics (hi, halting problem!).

Yes, when the enemy has full access to all these things and sufficient resources to use them, the antivirus loses. Other malicious hackers don't have this scale of resources, and that's the sole reason they can't do it.

>And you can't have perfect heuristics

1. All my computers have finite memory 2. You could in theory make heuristics with false positives but without false negatives.

It's not that theoretical, the following complex program fits that description:

def IsProgramAVirus(program): return True

But it's not particularly useful. In practice the false positive rate is extremely important, because if it gets too annoying users will switch it off.

In the best of worlds, developers could make an effort not to do anything shady, like self modifying code, dll-injection etc, making heuristics complaining about such behaviours viable.

So what they're saying is: "We can't possibly defend against any attack if the attacker bothers to take the time to test their attack against our software."

That's a startling admission, not just because they're saying "our software ain't that good" but because they've also gone and told you exactly how to defeat it.

[insert conspiracy theory here]

A nation state might have access to the antivirus source code (and maybe some of the ex-programmers (or present!) as consultants).

What was it the guy said, who was poisoned with Polonium in London? Something like "Spy organisations are made to compete with other spy organisations, with budgets in the billions. As a private person, you're hopelessly outmatched."

> they've also gone and told you exactly how to defeat it.

No, what they said is that since they [hackers] can test their code with antivirus before deploying, they can be sure of the fact that it wont be detected.

So it's obvious that to "defeat" the antivirus, they have to test against it. It's in no way a solution. Anyone with a little common sense will tell you that to defeat an antivirus, the best way is to test against it before you release your malware.

" the attackers tested them against all of the relevant antivirus products on the market"

And the other bad guys wouldn't be able to do this? There are only 2-3 common anti-virus products it's not hard to check if you are detected by Mcaffee/Symantec/AVG

Most antivirus products simply check for signatures. That way you keep paying for updates and they sell themselves on how many 1000s of viruses they detect.

Yes you can't have perfect heuristics and some of these are operating system issues - why does browsing a USB key run a program, why can a game on my phone access to my address book, why can an app connect to the internet without me knowing.

At this point do we just give up on both antivirus AND using general computers to access the web? Should we just use settop boxes with no persistent writeable storage?

Most antivirus products simply check for signatures.

No, I don't think a single AV product can be described this way for many years now. But people like to repeat it.

In which case the zero day isn't a real excuse. If you aren't checking for specific exploit code signatures then if a particular exploit is an unknown zero day or not doesn't matter.

Perhaps it's time to switch back to Harvard architecture. Programs and data are separate - you can't change program codeand you can't execute data.

In which case the zero day isn't a real excuse.

0-day exploits aren't the problem. You're focusing on just one type of malware behavior.

Even if all of our software today was free of exploits, it wouldn't do anything to stop the bad guys from building trojan horses, and using that to bootstrap into broader pwning.

You say it as if checking for signatures it the ONLY effective method and you seem to be saying it's not that effective, so all AV's are useless. Well, it's not the only method and there are other effective methods.

"And the other bad guys wouldn't be able to do this?"

Yes, absolutely. Part of the fear is that they indeed have. But your average bad guy isn't an intelligence agency. The antivirus vendors can outclass the guy in a basement, or even a few guys working in a basement, and right now our threat profile is such that stopping those guys is still a big gain. There is definitely a large class of threats they can prevent.

I know for a fact that the average bad guy does this. Google "fud crypter", they are programs that take malware and makes it Fully UnDetectable by encrypting it, similar to how upx does it. Even skiddies use them.

Heh, I went back and forth between highlighting the "can" in my post. I think you can make a great case that they do not do all the things they could be doing, and there's been rather more focus on the sort of things that have produced bloatware rather than better virus scanning.

But it should be pointed out that in the arms race it should generally be expected that the mid-level underground is always pretty much exactly one step ahead of Symantec etc. It's the nature of the arms race that they are in that the attackers have the temporal advantage. The question is less about whether a given technique works today and more about how long it works. The big advantage an intelligence agency and a large attacker has that doesn't apply to the mid-level underground is that their malware won't (or shouldn't) be detected by the various early-detection techniques that the anti-virus companies have, because they aren't necessarily just going to release their stuff into any place the antivirus company will see. Ideally, they'll simply never see it, which is why its interesting when these "escape".

Reply on news.ycombinator.com