Poll: Do you use antivirus software? | Hacker News Reader

Poll: Do you use antivirus software?

41 pointsbmaeser93 comments

I am extremely bias, as I work for Malwarebytes, but it always amazes me how many smart people, who know a lot about computers, think that it's unnecessary to run some sort of protection software. Zero day exploits in browsers and their plugins (flash, java, even pdf readers) happen all the time, and malware authors love taking advantage of them. In a world where just browsing to a website can get you infected it's probably a good idea to have something to stop that. There is no set of "safe habits" that makes you immune to this- even going to reddit has gotten people infected when their ad network was compromised, and stuff like that happens constantly.

My other favorite thing is all the people who say they've never run antivirus/antimalware, but then also claim to never have been infected. How would they even know? Modern malware tries to go undetected, it doesn't want to get detected and removed so it tried to remain as unobtrusive as possible.

Those of you running linux or osx are exempt from this minirant ;-)

The problem is that if you actually look at how this AV software works (and at how many AV companies behave), there are clear reasons not to trust them.

For example: https://lock.cmpxchg8b.com/sophailv2.pdf

The problem of malware is systemic, and can't be solved by adding complex, poorly-constructed add-on software.

That doesn't mean you can't use AV that's not shitty, or Bit9 (application whitelisting, which a lot of AV products have built in now) like Tavis goes on to suggest at the end of the paper.

Whitelisting is clearly superior to blacklisting if you have the patience and knowledge to whitelist the right applications.

You should qualify your last sentence by adding that the only real reasons that that is the case is that 1. Most Linux installations are headless, removing a humongous attack surface, and 2. Both have either not had a lot of market share historically, or they haven't had a lot of users that were easy to fool. Despite popular belief, neither platform is in some way inherently more secure than recent versions of Windows.

The market share situation is changing now, and there's no reason to think that if Windows went away tomorrow the world would be malware-free.

Those are common beliefs and do have some truth to them, but I don't believe they tell the whole story.

Market share is only one part of the equation, the other is effort. Even if linux jumped in desktop adoption that wouldn't make it easier to write malware for, not just because of the security but because of the segmentation. Different distros will have different kernels, patches, libraries and settings that make writing malware that affects the entire ecosystem far more difficult.

With OSX the introduction of malware has never followed market share, although the reasons are more varied for why. One of the biggest reasons, funny enough, is Preview. By not shipping Adobe PDF engines, but writing their own, they've managed to avoid a number of exploits that took advantage of PDF exploits.

This isn't meant to be a conclusive list of differences, but just a couple of examples to show that although market share is a factor it's not even close to the only one there.

I'm not saying it's the only one, just that it's by far the biggest one. If you have a choice between writing malware that could affect 70% of computers or 10%, you pick the 70% demographic. If Mac suddenly had the biggest demographic of users, we'd be seeing a lot more malware for it.

The malware might not exploit X application, and sure, Windows has been plagued by Adobe, but there's nothing that makes OS X fundamentally more secure. Especially considering that a lot of malware today actually relies on social engineering rather than 0days.

Most malware goes after exploits, not social engineering. You see more social engineering and less exploitation on OSX because there is far less to exploit on OSX.

A lot of malware uses social engineering to become deployed, including on Windows, with or without exploits. If you don't think so, I seriously doubt that you work at Malware-Bytes in an R&D capacity, given that Malware-Bytes is the most popular tool for removing stuff that relies entirely on social engineering, e.g. Fake AV malware.

> You see more social engineering and less exploitation on OSX because there is far less to exploit on OSX.

That statement might be true for applications that users typically install on these systems, but it's not true for the operating systems themselves.

In absolutely nothing I said did I make the claim that social engineering wasn't used by malware.

You made the claim that there was a level playing field with regards to security between Windows and OSX, "especially considering that a lot of malware today actually relies on social engineering rather than 0days". My response was simply that this isn't 100%, that many malware variants still use exploits to get onto systems, and that your statements based around that are also incorrect.

> "especially considering that a lot of malware today actually relies on social engineering rather than 0days"

That doesn't mean "most".

> My response was simply that this isn't 100%, that many malware variants still use exploits to get onto systems, and that your statements based around that are also incorrect.

I'm saying that if Windows disappeared tomorrow, malware--the pieces that exploit software or social-engineer users--wouldn't go away by any stretch of the imagination. Malware distribution would immediately and significantly increase on the now most attractive platforms.

There is nothing about the architecture of the other operating systems that make them any more resistant to malware than Windows--in fact, Windows' UAC is superior to the equivalents on both OS X and Linux.

Take something like the Chromebook or iPhone, and we'll talk.

Yes, you are extremely biased, and not in any of the good ways.

1. There's plenty of malware out there for Linux. The only difference is the delivery method - i.e., attacks against service endpoints (web apps, mail transfer agents, DNS servers, and so on) instead of user agents (web browsers, mail user agents, file managers, and so on).

2. Detecting novel malware isn't some dark magic only practiced by antivirus vendors such as yourself. People are capable of detecting when their computers behave oddly. These detections do not require antivirus or even particularly clueful users.

3. Antivirus can't see into the future. Novel malware can sneak past Malwarebytes, VirusScan, etc. because detections get created only _after_ someone notices something hinky (point #2 above). Put another way, it always amazes me how many smart people, who know a lot about computers, think that antivirus will make you immune to malicious code injection attacks delivered through user agents such as a web browser. Novel malware gets written /constantly/.

4. As with antivirus, "safe habits" (privilege separation, data execution prevention, content filtering, etc.) greatly reduce the risk of a successful attack. In fact, I'd argue that safe habits alone will have a lower risk of successful attack than antivirus alone, given some set of threats and vulnerabilities. I'd go a step further and aver that solely making it difficult to be socially engineered will approach the effectiveness of antivirus alone (but here my own biases are showing: I admit to lacking the data and analysis to back up that claim).

Those of you running Linux or Mac OS X are most certainly _not_ exempt from this minirant.

If you don't download warez you don't need an antivirus. Just follow good old fashioned policies, like not opening executable attachments in emails, don't install codecs from companies you don't know etc., and install a firewall to monitor outgoing traffic.

I have a Windows 7 desktop and occasionally I might run a scan from an antimalware software. That's as far as I'm willing to go, I don't install special av software because they consume a lot of resources especially with real time analysis.

EDIT: Furthermore, if you’re a tad paranoid you can enable AppLocker in Windows to eliminate any chance of an unwanted program wreaking havoc on your machine. Anything that’s not signed by a company you approve doesn’t run.

I'm going to say that's not true, because that opens you up to being exploited through methods you trust. You might not think a PDF can hurt you, but without AV you don't even stand a chance.

That might have been true a few years ago but it just isnt these days. Malware is being injected into ad networks on a semi-regular basis (I see Adblock as a defensive mechanism morese than something to get rid of ads). Sites also get hacked and can infect you that way.

Its like saying people only care about NSA spying because they have something to hide -- its faulty logic.

> If you don't download warez you don't need an antivirus

this is just plain false with all the other attacks out there today.

There are many methods of malware delivery which are easily accidentally triggered, even if you're following the basic rules

Drive-by downloads, clickjacking, having java installed, etc can get you infected even if you're a savvy user

Trying to give out this type of help is counter productive, visiting a website could get you infected. Antiviruses won't tell you when you have been infected with a zero-day but they will help you out later. It's best to have or to run files in a sandbox before you use them on a production system.

> If you don't download warez you don't need an antivirus.

That works most of the time, but it's not the only attack vector around: browser exploits (e.g. via ads), malevolous attachments sent by known contacts, direct attacks over networks and so on.

In any case, it only takes once if you lower your guard; I'd run at least a lightweight one if I were you.

At work I'm required to use a locked-down Windows 7 machine, which has antivirus software I can't disable. (I would disable it if I could.)

At home I use Linux and do not use antivirus software.

I also always log in as root. I like to live dangerously. :)

> I also always log in as root. I like to live dangerously. :)

Man... I cannot even begin to express how bad this is.

Especially if there are drive-by attacks.

Running as a privileged user protects other users and the OS, not you. If code runs as you, it has access to your data, your cookies, your cache, etc.

Protecting the OS does protect you: stealing my data/cookies today is different than installing OS level backdoor / keylogger and stealing my bank password, tax prep, etc next month/year/etc.

So, installing a backdoor / keylogger in user level isn't that bad? why?

If they've stolen your cookies, they can already login as you. The keylogger is already going to run in user space, as you.

You don't need to compromise root/a privileged user in order to get the keys to the kingdom. Once I've compromised whatever user your browser environment runs as, mission accomplished.

its really not a big deal to type sudo when installing stuff.

Also if you have any hope of dealing with servers in the wider world, you want to shake that habit pronto (and learn ssh keys).

Also your ironically complaining you can't disable your anti-virus software, but the fact is you have a sloppy approach to security that your IT department is protecting everyone in the company from.

I only stay logged in as root on my personal server. For more public servers I of course disable password logins, ssh in using a key file, etc.

(I wonder what about my post makes you think you should talk down to me and make (incorrect) assumptions about my approach to security?)

> I also always log in as root. I like to live dangerously. :)

Noob mistake. Never log in as root. Isn't sudo enough for you?

Why on earth would I "never log in as root"? And I'm pretty sure it's not a "noob mistake" if I've been using Unix since 1994.

Because then any malware that gets installed by you (or a program you run, like, say, your browser) has root privileges. If you were not logged in as root, anything running as you would not have root privileges and therefore would have much less power to ruin your computer.

It's not a controversial statement. It's security 101. Hell, even Windows Vista implemented the same strategy once Microsoft realized logging in with admin rights was a bad idea.

I'm logged in as root to a headless server that doesn't even run a GUI. I pretty much only install software from the Ubuntu repository. The server is only used by me.

I think it's okay if I log in as root if I want.

If you read about the technical implementation of the AV software that's been analyzed, you might not think it's that dangerous after all:

http://www.cso.com.au/article/441070/google_security_researc...

My existing Windows machines run ESET but I'm considering not for my new Win8 machine.

I love ESET and have found it finds and stops viruses missed by others. However I found that the built in AV with Win8 was finding things that ESET missed.

This leads me to believe that the stock AV is sufficient, and running an additional malware scanner periodically will give me the best results.

I user to use MSE under windows, and did the occasionally scan with MBAM.

Then I ditched Windows for Linux, and never saw an AV again :)

Anyway, Windows has got considerably more secure than the past. I feel that I used to run an antivirus "just because", and not because I felt the need for it.

The "trick" is to always keep your system update (which mean, always install the latest patches as soon as they come out), always use an up-to-date browser, remove/disable (with click2play) any browser plugins, block ads (unblock them on sites that you feel secure/trustable, but ads are one of the main vector of diffusion for viruses), and obviously don't run any "sketchy" software you might find on the net (VirusTotal and similiar help with that, but for one-time/few uses, it's better to run a virtual machine and then restore it).

Microsoft security essentials.

I was using Avast for years before that but then they started showing ads and other BS so I decided to let it go.

http://xkcd.com/272/

I have a HTPC running Windows 7 that has Microsoft Security Essentials installed (mostly to stop it from bugging me). My audio/video editing machine is a Mac without any antivirus software installed. And my development machine is running Ubuntu LTS without any antivirus. What's awkward is I don't even know which option to upvote.

Properly named antivirus have little sense in Linux, something runs as user and have the ability to modify system executables and spread to other systems probably are only experimental at best.

But that don't take out following the by default security practices in distributions (install only from the distribution, be root only for the essentials, don't have by default enabled remote services, firewalls with everything denied by default, updating, etc).

Trojans, vulnerabilities in enabled services, or even in browsers/plugins/etc are still a concern, but those kinds of attack are not the ones that antivirus usually spot. Checking for rootkits (i.e. with rkhunter), browsers with improved security, and portknocking to make visible private services only to the people/computers that will use them are examples of measure that you can take.

And, of course, you can always install clamav in your linux mail/file server if your users use windows.

One option that's missing is self-monitoring.

I don't run any antivirus software on my PC, but I do keep a very close eye on my running processes and network traffic.

The same goes for applications/code downloaded from the internet or email attachments.

My internet connection is also very slow, especially the upload speed, so you do notice right away if a program is uploading data.

Also, at least on my Windows PC, I do clean reinstalls every now and then, so my OS install is usually less than a year old.

I know this isn't foolproof and there are always ways to get around this, but the same goes when you're running antivirus software.

There is no 100% safe option, the tricky part is finding a solution that works for you in both performance and convenience.

I never used anti-virus in Windows.

Once I was happily searching the web for a solution to programming problem and a windows-like very good looking dialog popped up asking me something I could not answer no. All of a sudden my computer became unusable and, as fast as I could, I turned my router off. Then started a two hours fight to find what happened and solve the problem. Some Java code installed some things when I clicked yes in the dialog. I was using a vulnerable Java runtime, which had been recently exploited.

I still don't use anti-virus in Windows. But I turned the Java plugin off. And now I use more Linux to do web development.

I've tried almost every Antivirus out there.

After I started earning, I started buying Antivirus software. I started with Norton, which crashed my hard disk one day because of a virus, I tried McAfee, which wasn't very good taking large amounts of memory, and finally I had to settle to E-Set NOD 32. I'm not trying to promote the product, But that is one top notch Software. But the Customer Care at E-set is uh-oh, shit.

On Linux, I never had the reason to use any Antivirus, because those who write viruses target Windows(mostly) because of its market share.

While no system is 100% safe from viruses and malware, on my Linux machine I am guilty of not installing any AV. In the last decade or more, I have had no reason to -- although times may be changing. My web browser does not have flash, pdf readers are disabled, I'm always prompted on downloads, and Java can only run under user 'ohgodno' (and yes, it does have a passwd.)

In most cases if there is an issue with a Linux machine, you can wipe out a user and their files to remedy the problem -- the core system is very rarely impacted.

On Windows machine it's pretty much impossible not to. Try installing Windows XP on a virtual box without any firewall setup, and within a day(or even hour) you will get infected. Windows Defender is fairly reliable as far as I've heard, but I'd be happier knowing that someone more qualified who specifically does that for a living is looking over.

Also, when you have non-tech-savvy families you generally want to just get a cover-multiple-pc-at-a-license deals, just because it saves you a lot of hassles.

Even if you're tech savvy it's still fairly easy to get infected by a trojan on a hijacked site. I use ff/chrome and avast! on Windows, which seems to be sufficient protection.

I'm a Mac guy, but come on. Windows XP is 12 years old. That's hardly a fair test. I haven't seen reports of Windows 7/8 machines getting rapidly infected like XP did.

I think you can be assured that the Windows Defender team does antivirus stuff for a living, just as much as AV vendors do.

cryptolocker, winxp to win8, it's a problem

Cryptolocker requires the user to run the executable. Users doing that are going to get infected regardless of OS.

Yes, but the expected time of survival of a newly-installed WinXP machine was extraordinarily short eight or so years ago - not really long enough to enable one to connect to Windows Update and get the thing protected.

But that would be a firewall and not an antivirus software.

On an un-patched, un-updated Windows XP machine, maybe. From Vista onward, the built-in software firewall and UAC make a default install relatively safe. I never ran any real-time virus protection on Vista and 7 (though I did run a few manual scans just to be sure, which were all clean) on a variety of machines and never had any issues.

What, like the original release of XP from 2001? I'm trying to find a worm that uses a vulnerability that works on an out of the box, unpatched XP SP3 and the closest I can find is Conflicker and related MS08-067 worms, but even that requires turning off the on-by-default firewall or enabling non-default sharing settings.

Is there any good real-time AV for desktop linux available?

I'm guessing they mean AV software for removal of windows viruses on thumb-drives? AV software for linux is 100% unnecessary AFAIK. Maybe a sysadmin could chime in?

Didn't they say the same thing about iMacs? Can't comment though, I personally don't run an AV on linux.

AV software is effectively a really complicated blacklist-based form of access control, which is a terrible way to do security in the first place.

There's no reason for antivirus software of this kind of exist on desktop Linux, because the whole operating system is free software, so if we want to fix some vulnerability that malware exploits, we can just do it (for example, by sandboxing applications), rather than implementing kludgy workarounds that turn users' machines into battlegrounds.

From what I hear, Wayland should help a lot with this, since it's much simpler and provides better isolation than X11.

No. My knowledge might be a bit dated, but as far as I know, there is nothing good. But you also don't need realtime Antivirus software for Linux, there still are no real active viruses for Linux.

The scanner for detecting windows-virus while using Linux were said to be ok (ClamAV, I think).

There are active worms for insecure software that runs on Linux (and weak SSH passwords), so that'd be detectable.

Something more like an IDS that detects known-insecure software and configurations is probably more useful than a pattern-matching evil bytes detector though.

Maybe make add a call & to a script containing something like this (not tested) to your .bashrc?

  inotifywait -mre modify /home/$USER |
  while read DIR EVT FILE; do
  do
      clamscan $FILE --move=/tmp/noexec_prison/$USER/
  done

Good idea. Maybe add some ionice?

Is there any good real-time AV available? For any kind of system?

I use windows defender because it comes with windows 8 and it's enabled by default (if that counts). I don't remember the last time I was infected by malware though.

Under OS X 10.9: No, Under Win 8.1: No

When I'm in Windows I'm only playing games or casually browsing the web so attacks aren't a concern and if I do get infected I'll just wipe it and let Steam re-sync things. On my Mac I've got Time Machine just in case things get weird but, while I know OS X isn't virus-proof, I'm really not worried about catching something.

I started using an anti-virus on Windows a few years ago, but it never detected anything. There are other ways to stay secure. (Common sense when dealing with downloaded files, Sandboxy, JS blocked by default in the browser.)

Overall, I feel that a truly secure system shouldn't need an anti-virus at all. Maybe some detection software like Tripwire, but not a scanning antivirus.

Being part of AV beta programs is a great way to have reliable AV without the need of purchasing licenses every year. I'am myself part of F-Secure beta programme, which I use to protect my Windows. Despite of few crashes with their banking protection, I feel safe to say that beta programs are as protective as any stable builds.

I run MSE. I dont have adobe or java products exposed by the browser nor do I download random binarys from the internet.

OS X since 10.4, and I've never even considered installing one. I'm aware that there's been trojans for OS X, but I don't open strange attachments, and I make sure I know where all my software is coming from.

Although OS X does actually have a file scanner built in, it's not a full anti-virus suite though.

I use Gentoo Linux and do not have any antivirus software. There doesn't really seem to be any for Linux systems. If someone knows of one please recommend it so I can take a look.

Then again, there's fairly few viruses targeted at Linux systems and I'm sure even fewer I'd be likely to get on my Gentoo system.

The only one I've heard of is http://www.clamav.net/lang/en/ I installed it once on a mailserver due to the guide I was using recommending it but I do not use it on any systems I use day-to-day.

even fewer I'd be likely to get on my Gentoo system

I think you've just pointed out exactly why even though Linux viruses exist, they don't get a foothold (go "epidemic"). There's huge software diversity. I run Arch, you run Gentoo, others run Debian... The same goes for any given piece of software that's regularly infected in the Windows culture: email clients, web servers, web browsers.

So, why was the Dan Geer "against monoculture" thing suppressed so enthusiastically a few years ago?

I use Windows 8 which has built in MSE. I also have Malwarebytes Pro which does active monitoring.

Nope. It's always off.

I turn it on and scan about once a month or so. At most, I have some spywares.

From experience, all the viruses that managed to infect me couldn't be fixed by the antivirus software and I had to do it manually, which is a pain.

My question for AV is... what's the actual detection rate for viruses and malware?

As far as I understand, most of AV detection is still based around hash matching. Someone should correct me if I am wrong, though.

> what's the actual detection rate for viruses and malware?

It's a surprizingly hard to answer that. The set of virus change every day, and is always unknown.

> most of AV detection is still based around hash matching.

Things are not that clear cut here either. The most usefull matching is hash based. Anti-virus also use other algos, they are just less reliable.

Windows, I use the free microsoft security essentials. Linux, none.

I usually use a mac, but on my windows machine (which I use rarely) I run deepfreeze which resets my computer back to a predefined pint every time I restart it.

I assume that for the purposes of your survey, running ClamAV as part of a junk mail filter (all hosted on FreeBSD or Linux) counts as a "yes".

By [other] I assume they mean [Android], since that's the 4th biggest mainstream OS to sport modern antivirus software.

My chromebook doesn't appear to need one.

You know what they say about security through obscurity...

I use ClamXAv but it's not running all the time, just for certain files. Does it count as yes or not?

May I suggest: [mobile] yes [mobile] no

please use [other] yes/no and specify in comments.

I wonder how many Windows users who voted no are running Windows Defender without realizing it.

Probably just about all of the Windows 8 users.

I have sophos on all my home systems, it works well and has a pretty small memory footprint.

I have Microsoft Security Essentials installed but I only run it on-demand.

it is a waste of resources, my files are stored on the cloud and my dev env is a softlayer instance, so if my computer have a virus or someone steals it, I won't give a s..t

surprised at how close total number of mac/win/linux are. also wonder what the 3% of people on 'other' are usiing.. just ios or android?

They might be running one of the BSDs.

I'm under both windows and other. My others are openbsd and dragonflybsd.

I answered no for Windows, Linux and other (Android). (Yes, I assume "Linux" == "GNU/Linux".)

What's that?

Microsoft security essentials is what I use. Primarily because I have been using it on my older windows 7 machine.

only basic users on mac would need antivirus because they can't tell what software is trust-worth and which is not.

figures some noob would flag my comment.

Reply on news.ycombinator.com