False Positives and False Virus Epidemics

There are several types of false positives. One is regular programs detected as infected (proper false positive). Second are double use programs detected as infected or Trojan (see two references below); the third are virus hoaxes.

See The Problem of False Positives in the Malware Defense

There is also the additional type of false positives that is present only in large corporate environment and can be called "pseudo-epidemics". In this case update of AV signature lead to detection of the files that previously were undetected and that often does not represents any danger being just a remnants of the virus/worm activity. This abrupt wave of pseudo-infections that can be in dozens of hundreds can be quite destructive due to misjudgment of personnel which assumes that this is a real threat and tries to take adequate (or non-adequate) defense measures. 

Security like a cleaning survives does not attract the brightest and most capable programmers and administrators. More often then not, the responsibility for AV defense in a large company is offloaded to a person with no specific knowledge or technical skills or even slightest interest in his area. But such a "placeholder" approach can backfire by overreaction to false epidemics as such staff is unable to distinguish them from real events. That just increases the damage from the virus adding to it the damage from incompetence.  

NEWS CONTENTS

• 190620 : Antivirus scanning for potentially misused tools is a doomed security strategy. ( Antivirus scanning for potentially misused tools is a doomed security strategy., )
• 190620 : Reform the AV Industry ( Reform the AV Industry, )

Old News ;-)

Antivirus scanning for potentially misused tools is a doomed security strategy.

There is a growing trend with AntiVirus scanners today. The scanners are scanning for more and more software that does not contain virus or trojan code. The new category of software the scanners are looking for is common software that has the *potential* to be misused by malicious persons. Usually this software is in the security auditing tool, network monitoring, or remote control category.

Corporate customers of AntiVirus software have requested that these potentially misuseable programs be flagged and, in some cases, "disinfected" by the scanning software. The AntiVirus vendors seem more than happy to comply. Even going so far as to label this new category of detected software as a "virus" or "trojan" when found, no matter how misleading to the user this label is.

Another controvertial twist in this new AntiVirus category is the fact that the AntiVirus vendors do not scan for their own tools that fall into the new "potentially misusable program" categories. Symantec's Norton AntiVirus will scan for the remote control programs, NetBus or BO2K, but not the company's own PC Anywhere. Network Associates' McAfee VirusScan will detect the NT password auditing tool, L0phtCrack, but will not detect the company's own vulnerability auditing tool, Cybercop scanner, or their network sniffers, Sniffer Basic or Sniffer Pro.

It is a fallacy that commercial tools are not misued by malicious individuals. They are usually available as free trial downloads or available on pirate software sites. However, the whole notion of protecting a network by scanning for potentially misuseable tools is a fallacy unto itself!

Using AntiVirus client scanning technology to find programs that can exploit the security problems on a network is a losing battle. AntiVirus software can be turned off. New tools or new versions of older tools will soon become available. Other machines without AntiVirus software can be attached to the network. Machines can be booted with alternative OSes.

You need to actually fix the network security problems! It is foolhardy to scan for tools that could exploit problems rather than just fixing the problems. This scanning scenario just gets OS and application vendors off the hook. Now they don't have to fix the problems. They will just rely on the AV vendors to scan for programs or code that can exploit the problems. Why fix, for example, Win 95/98 challenge-response network authentication? Each client on the network should be scanning for all known tools that can sniff the network or crack the passwords. Obviously this is not a good security model.

Reform the AV Industry

Dual function program listed as trojan.

Who remembers the case of Netbus? In February '99 Netbus released version 2.0 to the public as shareware. They removed many of the stealth features and changed it's functionality so it was no longer a trojan horse but an actual product from an actual company. It even achieved a 5 cow rating on Tucows when released.

Well, about a month later, the A/V industry started listing this new version of Netbus as a trojan, this action prompted Tucows to remove Netbus 2.0 even after it gave it's 5 cow approval. Ultraaccess.net, the makers of Netbus, tried to talk to the A/V vendors after it was listed, most would not even return their phone calls. Panda was the only one to respond in any fashion to ultraaccess.net. Data fellows and a few other vendors didn't list it until the big vendors and "customer response" prompted them to add it to their definitions. Ultraaccess.net is not a large company, they have however, hired a lawyer and are trying to get all their legal material together for their next version release sometime in spring next year, but it appears to be an up-hill battle. (Thanks go to Judd Spence at Ultraaccess for providing me with the history of Netbus.)

Another example of the A/V vendors logic is L0phtcrack. L0phtcrack was released in 1997 and the latest version in January 1999. It has since become one of the premier tools for NT password auditing. L0phtcrack was recently listed as a trojan by one company then others started adding similar descriptions. A/V vendors follow each other on their latest listings, when one company lists a new piece of code, all the others just copy it, as was mentioned by Weld Pond on NTBugtraq (http://www.ntbugtraq.com/default.asp? pid=36&sid=1&A2=ind9912&L=ntbugtraq&F=&S=&P=5026). So if one company doesn't like your product they can have it added to their definitions and all the other ducks fall into a row and list the same program blindly.

These situations sound like classic David vs. Goliath battles of the little developer being quashed by big business. With certain A/V producers also having remote administration products, does this not seem like a major conflict of interest? What is to keep them from listing the competition with muddy descriptions as virii and trojans to scare and annoy the customer into using their product? In talking to various security scanner companies I kept hearing the same situation with Netbus; clients had bought and paid for it, but their A/V package was constantly deleting it. What sane person is going to disable their virus protection so they can run a program? Not a very good plan. This usually has the effect of forcing the person to change remote administration tools to one of the big names or to change A/V packages, but since all the vendors share definitions your going to have the same problem. This can severely hurt small business with products like Netbus if their clients are getting frightened with virus warnings. Yet, equally featured products are never given a second glance.

If you feel your software was erroneously listed, there is very little recourse in trying to talk to the companies to have some action taken. The big vendors haven't returned Ultraaccess.net's phone calls and the smaller vendors follow the definitions of the big boys. So even if you successfully remove yourself from one package, one has to go to each vendor and plead your case all over again. The A/V industry seems almost like a monopoly that can do what it wants and list anything with impunity, always falling back on the excuse of "customer demand" (though this is how many programs get on the list in the first place, but it's hard to verify if it's a legitimate response or a conjured up one). It's gotten to the point where the industry can make or break products.

With big companies like Symantec and NAI that have interests in other products of their own, I can't believe that they aren't abusing the public trust to leverage their own products in the marketplace. Again, as Weld Pond pointed out in his Buffer Overflow article "Symantec's Norton AntiVirus will scan for the remote control programs, NetBus or BO2K, but not the company's own PC Anywhere. Network Associates' McAfee VirusScan will detect the NT password auditing tool, L0phtCrack, but will not detect the company's own vulnerability auditing tool, Cybercop scanner, or their network sniffers, Sniffer Basic or Sniffer Pro". If this is not using your product to force another, I don't know what is.

The A/V industry is very necessary, but has gotten too complex for it to continue in the current state. In the very near future, any product that can be misused to any tiny degree will be listed, and what recourse will companies have to protect themselves from the abuses by the industry?

I propose an agency, commission, organization, board, watchdog group or something that all A/V vendors are a part of and follow the decisions of, so you only have to appeal your case to one group to clear your products name. A sort of better business bureau for the industry. Many A/V vendors belong to various Internet Security Bodies but there is no body for Anti-Virus.

Etc

Society

Groupthink : Two Party System as Polyarchy : Corruption of Regulators : Bureaucracies : Understanding Micromanagers and Control Freaks : Toxic Managers :   Harvard Mafia : Diplomatic Communication : Surviving a Bad Performance Review : Insufficient Retirement Funds as Immanent Problem of Neoliberal Regime : PseudoScience : Who Rules America : Neoliberalism  : The Iron Law of Oligarchy : Libertarian Philosophy

Quotes

War and Peace : Skeptical Finance : John Kenneth Galbraith :Talleyrand : Oscar Wilde : Otto Von Bismarck : Keynes : George Carlin : Skeptics : Propaganda  : SE quotes : Language Design and Programming Quotes : Random IT-related quotes :  Somerset Maugham : Marcus Aurelius : Kurt Vonnegut : Eric Hoffer : Winston Churchill : Napoleon Bonaparte : Ambrose Bierce :  Bernard Shaw : Mark Twain Quotes

Bulletin:

Vol 25, No.12 (December, 2013) Rational Fools vs. Efficient Crooks The efficient markets hypothesis : Political Skeptic Bulletin, 2013 : Unemployment Bulletin, 2010 :  Vol 23, No.10 (October, 2011) An observation about corporate security departments : Slightly Skeptical Euromaydan Chronicles, June 2014 : Greenspan legacy bulletin, 2008 : Vol 25, No.10 (October, 2013) Cryptolocker Trojan (Win32/Crilock.A) : Vol 25, No.08 (August, 2013) Cloud providers as intelligence collection hubs : Financial Humor Bulletin, 2010 : Inequality Bulletin, 2009 : Financial Humor Bulletin, 2008 : Copyleft Problems Bulletin, 2004 : Financial Humor Bulletin, 2011 : Energy Bulletin, 2010 : Malware Protection Bulletin, 2010 : Vol 26, No.1 (January, 2013) Object-Oriented Cult : Political Skeptic Bulletin, 2011 : Vol 23, No.11 (November, 2011) Softpanorama classification of sysadmin horror stories : Vol 25, No.05 (May, 2013) Corporate bullshit as a communication method  : Vol 25, No.06 (June, 2013) A Note on the Relationship of Brooks Law and Conway Law

History:

Fifty glorious years (1950-2000): the triumph of the US computer engineering : Donald Knuth : TAoCP and its Influence of Computer Science : Richard Stallman : Linus Torvalds  : Larry Wall  : John K. Ousterhout : CTSS : Multix OS Unix History : Unix shell history : VI editor : History of pipes concept : Solaris : MS DOS :  Programming Languages History : PL/1 : Simula 67 : C : History of GCC development :  Scripting Languages : Perl history   : OS History : Mail : DNS : SSH : CPU Instruction Sets : SPARC systems 1987-2006 : Norton Commander : Norton Utilities : Norton Ghost : Frontpage history : Malware Defense History : GNU Screen : OSS early history

Classic books:

The Peter Principle : Parkinson Law : 1984 : The Mythical Man-Month :  How to Solve It by George Polya : The Art of Computer Programming : The Elements of Programming Style : The Unix Hater’s Handbook : The Jargon file : The True Believer : Programming Pearls : The Good Soldier Svejk : The Power Elite

Most popular humor pages:

Manifest of the Softpanorama IT Slacker Society : Ten Commandments of the IT Slackers Society : Computer Humor Collection : BSD Logo Story : The Cuckoo's Egg : IT Slang : C++ Humor : ARE YOU A BBS ADDICT? : The Perl Purity Test : Object oriented programmers of all nations : Financial Humor : Financial Humor Bulletin, 2008 : Financial Humor Bulletin, 2010 : The Most Comprehensive Collection of Editor-related Humor : Programming Language Humor : Goldman Sachs related humor : Greenspan humor : C Humor : Scripting Humor : Real Programmers Humor : Web Humor : GPL-related Humor : OFM Humor : Politically Incorrect Humor : IDS Humor : "Linux Sucks" Humor : Russian Musical Humor : Best Russian Programmer Humor : Microsoft plans to buy Catholic Church : Richard Stallman Related Humor : Admin Humor : Perl-related Humor : Linus Torvalds Related humor : PseudoScience Related Humor : Networking Humor : Shell Humor : Financial Humor Bulletin, 2011 : Financial Humor Bulletin, 2012 : Financial Humor Bulletin, 2013 : Java Humor : Software Engineering Humor : Sun Solaris Related Humor : Education Humor : IBM Humor : Assembler-related Humor : VIM Humor : Computer Viruses Humor : Bright tomorrow is rescheduled to a day after tomorrow : Classic Computer Humor

The Last but not Least Technology is dominated by two types of people: those who understand what they do not manage and those who manage what they do not understand ~Archibald Putt. Ph.D

The statements, views and opinions presented on this web page are those of the author (or referenced source) and are not endorsed by, nor do they necessarily reflect, the opinions of the Softpanorama society. We do not warrant the correctness of the information provided or its fitness for any purpose. The site uses AdSense so you need to be aware of Google privacy policy. You you do not want to be tracked by Google please disable Javascript for this site. This site is perfectly usable without Javascript.

Last modified: March 12, 2019