I have felt the current anti-virus approach is unsustainable and less secure than we think for some time. But recent news events have really driven home the issues. (I personally think anti-virus is dead…yep, dead)
Some points to ponder:
It’s less secure than we think because of the “zero-day” problem that nobody really likes to talk about – under a signature-based approach I can only detect what is in the signature file. An antivirus vendor has to “capture” a virus to create a signature – and then distribute the updated signature to me before I am actually protected. So we think because we run AV software we are protected – we aren’t. Much like there is a gap between when a new human virus emerges (H1N1) and a vaccine is produced (months later) we are only protected from virus the AV vendor knows about and has had the time to update and distribute the “vaccine” (signature file). The much publicized Google China hack was a zero-day exploit.
This approach works, sort of, when there are 40 new viruses released per day, or 400. What about when there are 4 billion released per day? Clearly this process can be overwhelmed right? There is already clear evidence that virus manufacturers know this vulnerability and are trying to exploit it.
“Beginning in June 2009, Google charted a massive increase in the number of unique fake antivirus installer programs, a spike that Google security experts posit was a bid to overwhelm the ability of legitimate antivirus programs to detect the programs. Indeed, the company discovered that during that time frame, the number of unique installer programs increased from an average of 300 to 1,462 per day, causing the detection rate to plummet to below 20 percent.” [1]
The other news item of course was the MacAfee fiasco (and this has happened to others in the past). If you haven’t heard the story MacAfee recently distributed a bad/corrupted signature file.[2] This falsely identified the SVCHOST.EXE Windows file as a virus, effectively killing the PC. Among those affected were US police forces and Intel. If you stop and think about it running AV software on your computer creates another attack vector – if I can get in the middle and send your computer an “engineered” signature file I can kill anything on it, including the OS.
So what’s the solution?
Whitelisting and its variations (signed code + whitelisted vendors, etc.). Think about the positives from a security standpoint:
- Impervious to the zero day problem. Only whitelisted code can run. Period.
- No signature file to update every day. Only have to update the whitelist when I add or change software on the machine.
- Less/no performance degradation. Instead of scanning every file all time against thousands or millions of AV signatures I just check the file hash (which is basically instantaneous).
- Built into the Windows 7 OS – something Microsoft never did with Anti-Virus.
Yes, I realize that managing the whitelist is more work (probably). But there is real value in the extra effort in terms of additional security.
- The Wandering CIO
Sources:
- http://krebsonsecurity.com/2010/04/fake-anti-virus-peddlers-outmaneuvering-legitimate-av/
- http://arstechnica.com/business/news/2010/04/broken-mcafee-dat-update-cripples-windows-workstations.ars
