Staying a step ahead of malware

The malware landscape is a notoriously organic environment, with the relationship between virus and antivirus vendors shifting constantly. The latest seismic upheaval is the revelation that the most popular brands of antivirus packages have an 80 percent miss rate, if we're to believe Australia's Computer Emergency Response Team (AusCERT).

On the surface, we should expect this.

Security companies have a finite number of resources to examine new threats and update their software. This means that on any given day they have to make a call on which threats they will address. Typically — and understandably — they address the biggest threats, targeting a small proportion of malware that they reckon will cause a proportionally large amount of trouble to their customers. And of course this could easily leave 80 percent of threats never analysed.

For the antivirus vendors it is an approach that worked well when virus writers did it for the fame and thus with the aim of compromising as many machines as possible in the shortest possible time. But in today's world of viruses being written for commercial purposes, it fails miserably.

A virus writer motivated by money is likely to be far more interested in seeding machines unnoticed and ready for a spam mailout or DDoS attack. That means the skill lies in slipping under the radar — hitting as many machines as possible, but not enough to attract the attention of the antivirus companies. Outsourced email companies have been wise to this for years now and routinely use two, three or even more antivirus packages to widen the net.

But this doesn't explain the detailed figures from AusCERT, which show that the brand leaders among antivirus companies have the highest miss rate. Can it really be that they have fewer resources to fight the good fight than their smaller competition? Much more likely is that virus writers are practising their own form of triage: spending more time analysing the leading antivirus packages, all the better to get around them.

For businesses, the lesson is clear: use products that slip under the radar of the virus writers. This means considering smaller antivirus vendors, and several of them if possible. It means staying ahead of the crowd, and if the crowd follows your migration route then it means moving on again. And if that's just too much trouble, then it probably means simply moving away from Windows.