Why popular antivirus apps 'do not work'
Summary: Are less popular AV brands better at detecting new viruses?
Antivirus applications from Symantec, McAfee or Trend Micro -- the three leading AV vendors in 2005 -- are far less likely to detect new viruses and Trojans than the least popular brands.
This has nothing to do with the quality of the software or how long it takes the respective firms to update their clients with signatures and other malware countermeasures.
AV companies continue to refine their products and most will tell you they stopped relying on purely signature-based systems many years ago. These days they use all sorts of clever methods to try and detect suspicious behaviour but the problem is that malware authors are also very clever. Very, very clever.
On Wednesday, the general manager of Australia's Computer Emergency Response Team (AusCERT), Graham Ingram, described how the threat landscape has changed -- along with the skill of malware authors.
"We are getting code of a quality that is probably worthy of software engineers. Not application developers but software engineers," said Ingram.
However, the actual reason why the top selling antivirus applications don't work is because malware authors are specifically testing their Trojans and viruses to make sure they can bypass these applications before releasing them in the wild.
"The most popular brands of antivirus on the market... have an 80 percent miss rate... So if you are running these pieces of software, eight out of 10 pieces of malicious code are going to get in," said Ingram.
Although Ingram didn't mention any of the leading losers by name, Gartner's figures for 2005 show that Symantec is the clear leader with 53.6 percent of the market. McAfee and Trend own 18.8 percent and 13.8 percent of the market respectively.
One vendor Ingram did mention was Russian outfit Kaspersky, which in the same tests managed to block around 90 percent of new malware.
According to Gartner, Kaspersky's market share is a lowly 0.7 percent.
Most large firms already use more than one antivirus application but I wonder how many use two of the Symantec, McAfee and Trend trio?
If you do then I suggest investing in yet another -- but whatever you do, stay well away from the bestseller shelf.
Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.
Talkback
Should we be supprised
But there is more
Additionally, running two virus scanners on a single system (especially if the combo is McAfee and Symantec) often causes an incredible loss of computing power because on access scanners are constantly scanning eachother and the files you touch. (VA1 scans file because you touched it, VA2 scans it because VA1 did, VA1 scans it because VA2 did, loop)
this article is misleading
I think that this article does more to mislead than inform. and recommending that users will be "safer" by avoiding the best seller shelf is bad advice.
Is he a used car salesman?
Sure... I'll propose this to my management. We'll see how fast I find myself on the street.
I whole heartedly agree . . .
Go and read a write up on Symantec or McAfee's site about a virus, and on 90% of them, listed in their own write up the first thing virus writers do is disable the most popular AV programs.
I do understand Chris's comments about Enterprise manageability, something Symantec has really pushed and does a decent job of, but others are coming on board and there are definitely better products available that can be used in an Enterprise.
Would it be better to get a product that works and make a little more work for yourself, or try to explain to management why the entire forest has been down for two days because your AV product didn't catch the latest threat? Which of those do you think will lose you your job faster???
Malware and the BIG 3
What the?
Advising people to go with lesser known software, not because it's superior, but because.. Its less known?
Here I was thinking we were past the point where main stream media pushed "Security through obscurity" as the way to go.. While we're changing our AV, perhaps we should switch all our machines to MAC and replace Office with Wordperfect?
Malware
My antivirus experiencies
After reinstall I have brought Symantec AV - after 1 month the same - virus destroyed my HDD.
After 2nd reinstall of WinXP, I was looking for some antivirus test - I founded 100% Virus Bulletin test - and the winner of this test was NOD32 - so I brought it - my experiences? 100% protected PC.
Exactly correct
Real-life experience speaks volumes
What the?
Kaspersky
Why popular antivirus apps 'do not work'
(Two articles, 7/19 and 7/21):
http://www.zdnet.com.au/news/security/soa/Eighty_percent_of_new_malware_defeats_antivirus/0,2000061744,39263949,00.htm
http://www.zdnet.com.au/blogs/securifythis/soa/Why_popular_antivirus_apps_do_not_work_/0,39033341,39264249,00.htm
It's OK (sort of) for an operating system to be full of holes.
Right? If every computer OWNER makes up for it with their own
time and money, and with personal diligence, "keeping their
antivirus package up to date"?
Yeah, right. Anyone who intends to write an exploit capable of
getting past antivirus programs can be certain of eventual success.
All they have to do is ... unit testing! "QA", as it's called in
the respectable world.
"Unit Test 0: check that your new code slips by McAfee."
Or Symantec. Or Trend Micro. Or several of them, or all
of them. You simply hold off releasing your virus until it
meets "minimum ship criteria".
There's no chance that the "antivirus" will stop you. Testing
PROVES that your virus will slip by. Users' machines are yours
for the taking, nyaahaaaa. You can run as many test trials it
takes. No one is watching; you have time. YOU have THEIR code
to test against. THEY don't know you're coming. And the best
part: the users will get the blame.
Graham Ingram, general manager, CERT Australia, writes:
"the bad guys, the criminals, are testing their malicious code
against the antivirus products to make sure they are undetectable."
(Oo. Are they allowed to do that?)
"the most popular brands of antivirus on the market...have an
80 percent miss rate."
Eighty percent miss! (But CERT should know -- it's what they do.)
"That is not a detection rate that is a miss rate."
It's not possible, obviously, to to develop an antivirus to detect
the signature or behavior of a virus which no one will see until
after it has begun its infection. The antivirus vendors don't stand
a chance. Analyses in the security literature show that a truly
effective virus can take over the monoculture part of the entire
Internet before the vendors have finished their coffee.
But vendors are not unhappy. THEY like things the way they are: bugs
are good for business. Customer anxiety is where dollars come from.
Not just antivirus vendors -- one OS vendor, too, has gone into the
antivirus business, turning bugs into a profit center. (How clever
is that?) Vendors are not about to tell customers that there's a
real fix, and that it's choosing non-buggy software.
"This is the dilemma that is building up here and the success
rate is becoming quite worrying"
What's should be "worrying" is that an expert could be surprised at
virus writers' "success". It couldn't be otherwise. Nothing could
be more certain than eventual defeat of any "antivirus" program which
you can bring into your own lab and test against, in privacy and under
conditions and a schedule of your choosing. Perhaps you have to be
clever to find a bug in the underlying operating system to exploit
in the first place (or maybe not), but you only need to be persistent,
to keep working, to prove that your exploit slips by so-called
"antivirus" programs before releasing it.
Eighty percent miss. Is there any business transaction other than
PC software in which customers can be led to expect (and put up with)
such gloomy results?
</essay>
One piece of good news. The miss rate will stop increasing in about
20 more points.
There is a difference between anti-virus and anti-spyware software
dangerous article
dangerous article
dangerous article
What's worse is that they are recommending us to select obscure security software just because it's not one of the top 3. I expeted a higher standard from this web site
Traditional defense is out-to-date.
Rational arguments always win
This article, and the one before that, "Eighty percent of new mallware defeats antivirus" are just BS, because the don't really argument their statements. Fair tests/benchmarks of the current AV software are done (couple of months interval) by Virus Bulletin - the famous VB100 Award. So how can you beat that. In the last test (June 2006 - Windows XP) McAfee, SAV and TrendMicro scored 100% detection. Then give me an reason to believe this author.