linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: daw@cs.berkeley.edu (David Wagner)
To: linux-kernel@vger.kernel.org
Subject: Re: [malware-list] [RFC 0/5] [TALPA] Intro to a linux interface for	on access	scanning
Date: Wed, 6 Aug 2008 22:24:01 +0000 (UTC)	[thread overview]
Message-ID: <g7d8a1$81o$2@taverner.cs.berkeley.edu> (raw)
In-Reply-To: 20080806101028.B87BA2FE88B@pmx1.sophos.com

Tvrtko wrote:
>J. Bruce Fields wrote on 05/08/2008 23:55:24:
>> On Mon, Aug 04, 2008 at 05:00:16PM -0400, Eric Paris wrote:
>> > There is a consensus in the security industry that protecting against
>> > malicious files (viruses, root kits, spyware, ad-ware, ...) by the way
>> > of so-called on-access scanning is usable and reasonable approach.
>> 
>> Can you point to any helpful explanations of that concensus?
>
>I can't, but everyone is doing it so that is at least an implied 
>consensus.

I don't think there is any such consensus, so I'm not expecting a
technical explanation.  As best as I can tell, the primary explanation
for why so many A/V vendors are doing it seems to be that it's a damn
effective business model, and that may have as much of an effect on its
widespread use as any technical merits or demerits.

Think about it: you get users to buy your A/V, then you tell them
they need to pay a monthly subscription fee to get the latest virus
signatures updates.  It's like crack.  Once you convince IT managers that
"every machine needs to run A/V software", it's basically a guaranteed
revenue stream for the A/V industry.  It's lucrative stuff, so it's no
surprise that the A/V industry is nursing this for as long as it can go.
And on many Microsoft platforms, the level of pain has been high enough
that IT managers are willing to accept anything that reduces the level of
pain even partially, so it's no surprise that A/V is so widely used today.
It doesn't necessarily mean that it's the right way to go for the future,
or that it's the right model for Linux, though.

>> Off-hand it's surprising.  (A defense that depends on cataloging every
>> possible individual attack sounds difficult!)

Of course.  Simple signature-based file-scanning has got deep technical
limitations.  It can detect copycats and script kiddies but you'd be
foolish to rely upon it to detect any kind of sophisticated attack.

Let's put some numbers on it, for real commercial A/V software.
I was at the Usenix Security conference last week, where one group of
researchers presented a paper that included a chart showing how quickly
McAfee A/V was able to detect new malware samples.  The researchers
collected a large set of malware samples, and ran McAfee on it once
a day or so to see how long it took for McAfee's signature database
to be updated so it could detect those malware samples.  As I recall,
the basic stats looked like this: about 30% of zero-day malware samples
were detected on the first day they were released (and 70% weren't).
The median number of days until a new malware sample was detected was
about 40 days.  If you wanted hundreds of days, asymptotically McAfee was
able to detect about 70% of the samples (and 30% were never detected).
I expect the situation to get worse in the future, not better.

And keep in mind it's easy for an attacker to write a polymorphic or
"metamorphic" virus that is basically undetectable with straightforward
signature-based file scanning, so in an arms race the attackers have
most of the advantages.

  reply	other threads:[~2008-08-06 22:24 UTC|newest]

Thread overview: 220+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2008-08-04 21:00 [RFC 0/5] [TALPA] Intro to a linux interface for on access scanning Eric Paris
2008-08-04 22:32 ` [malware-list] " Greg KH
2008-08-05  0:26   ` Christoph Hellwig
2008-08-05  0:47     ` Eric Paris
2008-08-05  0:54       ` Christoph Hellwig
2008-08-05  5:49         ` Kyle Moffett
2008-08-05 12:32           ` Alan Cox
2008-08-05 11:31         ` Alan Cox
2008-08-05 14:06           ` Peter Zijlstra
2008-08-05 14:09             ` Alan Cox
2008-08-05 17:58           ` Nick Piggin
2008-08-06  2:41         ` Andi Kleen
2008-08-06 18:04           ` Rik van Riel
2008-08-05  0:32   ` Eric Paris
2008-08-05  0:35     ` Eric Paris
2008-08-05  0:51     ` Greg KH
2008-08-05 11:23       ` Alan Cox
2008-08-05 17:03         ` Greg KH
2008-08-05 18:56           ` Eric Paris
2008-08-05 20:30             ` Greg KH
2008-08-06 18:49               ` Eric Paris
2008-08-06 21:02                 ` Theodore Tso
2008-08-06 21:28                   ` Eric Paris
2008-08-06 21:52                     ` Theodore Tso
2008-08-07 14:16                       ` Eric Paris
2008-08-07 21:55                         ` David Wagner
2008-08-08  2:06                         ` Rene Herman
2008-08-08  2:15                           ` Eric Paris
2008-08-08  2:55                             ` Rene Herman
2008-08-08 11:58                               ` Press, Jonathan
2008-08-08 12:34                                 ` Rene Herman
2008-08-08 13:11                                   ` Press, Jonathan
2008-08-08 13:43                                     ` Rene Herman
2008-08-05 11:25       ` Alan Cox
2008-08-05 17:01         ` Greg KH
2008-08-05 20:36           ` Alan Cox
2008-08-05 19:46       ` Eric Paris
2008-08-05 20:15         ` Greg KH
2008-08-06  9:37           ` tvrtko.ursulin
2008-08-06 15:25             ` Greg KH
2008-08-06 15:41               ` Eric Paris
2008-08-06 16:03               ` tvrtko.ursulin
2008-08-06  9:28         ` tvrtko.ursulin
2008-08-05 14:41     ` [malware-list] [RFC 0/5] [TALPA] Intro to a linux interface foron " Press, Jonathan
2008-08-05 14:56       ` Eric Paris
2008-08-05 16:37         ` [malware-list] [RFC 0/5] [TALPA] Intro to a linux interfaceforon " Press, Jonathan
2008-08-05 17:19           ` Eric Paris
2008-08-05 17:38             ` Arjan van de Ven
2008-08-05 17:29               ` Alan Cox
2008-08-05 18:02                 ` Arjan van de Ven
2008-08-05 20:12                   ` Alan Cox
2008-08-05 20:41                     ` Arjan van de Ven
2008-08-05 18:04               ` Press, Jonathan
2008-08-05 18:11                 ` Greg KH
2008-08-05 18:38                   ` [malware-list] [RFC 0/5] [TALPA] Intro to a linuxinterfaceforon " Press, Jonathan
2008-08-05 18:54                     ` Theodore Tso
2008-08-05 20:37                       ` [malware-list] [RFC 0/5] [TALPA] Intro to alinuxinterfaceforon " Press, Jonathan
2008-08-05 21:14                         ` Greg KH
2008-08-05 21:23                           ` [malware-list] [RFC 0/5] [TALPA] Intro to alinuxinterfaceforonaccess scanning Press, Jonathan
2008-08-05 21:42                             ` Arjan van de Ven
2008-08-05 21:44                             ` Greg KH
     [not found]                               ` <2629CC4E1D22A64593B02C43E855530303E21D47@USILMS12.ca.com>
2008-08-05 22:26                                 ` [malware-list] [RFC 0/5] [TALPA] Intro toalinuxinterfaceforonaccess scanning Greg KH
2008-08-05 23:37                                   ` Al Viro
2008-08-05 23:48                                     ` Eric Paris
2008-08-05 23:57                                       ` Theodore Tso
2008-08-06  0:11                                       ` Greg KH
2008-08-06  0:25                                         ` Eric Paris
2008-08-06  0:46                                           ` Rik van Riel
2008-08-06  1:44                                             ` Theodore Tso
2008-08-08 10:48                                               ` [malware-list] Threat model for Unix Computers Jörg Ostertag
2008-08-08 22:26                                                 ` Peter Dolding
2008-08-09  1:21                                                 ` david
2008-08-09  1:44                                                 ` Ulrich Drepper
2008-08-05 23:55                                 ` [malware-list] [RFC 0/5] [TALPA] Intro toalinuxinterfaceforonaccess scanning Theodore Tso
2008-08-06 10:25                                   ` Pavel Machek
2008-08-05 21:45                             ` [malware-list] [RFC 0/5] [TALPA] Intro to alinuxinterfaceforonaccess scanning Al Viro
2008-08-05 20:18                     ` [malware-list] [RFC 0/5] [TALPA] Intro to a linuxinterfaceforon access scanning Greg KH
2008-08-05 20:28                       ` [malware-list] [RFC 0/5] [TALPA] Intro to alinuxinterfaceforon " Press, Jonathan
2008-08-05 20:51                         ` Eric Paris
2008-08-05 21:08                           ` Arjan van de Ven
2008-08-06  0:51                     ` [malware-list] [RFC 0/5] [TALPA] Intro to a linuxinterfaceforon " Rik van Riel
2008-08-06 12:10                       ` Press, Jonathan
2008-08-06 12:38                         ` Peter Dolding
2008-08-06 13:11                           ` Press, Jonathan
2008-08-06 13:49                             ` Arjan van de Ven
2008-08-06 13:55                               ` Eric Paris
2008-08-06 14:11                                 ` Peter Dolding
2008-08-06 14:20                                   ` Serge E. Hallyn
2008-08-06 13:57                             ` Peter Dolding
2008-08-06 11:31                               ` [malware-list] [RFC 0/5] [TALPA] Intro to a linux interfaceforon " David Collier-Brown
2008-08-06 23:20                                 ` Peter Dolding
2008-08-06 13:44                         ` [malware-list] [RFC 0/5] [TALPA] Intro to a linuxinterfaceforon " Arjan van de Ven
2008-08-06 14:16                           ` tvrtko.ursulin
2008-08-06 14:23                             ` Arjan van de Ven
2008-08-06 15:22                             ` Theodore Tso
2008-08-06 15:54                               ` tvrtko.ursulin
2008-08-07  9:28                             ` Pavel Machek
2008-08-07 14:21                               ` Peter Dolding
2008-08-07 14:31                                 ` Eric Paris
2008-08-08  0:05                                   ` Peter Dolding
2008-08-08  5:17                                     ` James Morris
2008-08-06 15:08                         ` Theodore Tso
2008-08-06 15:33                           ` [malware-list] [RFC 0/5] [TALPA] Intro to alinuxinterfaceforon " Press, Jonathan
2008-08-06 15:46                             ` Rik van Riel
2008-08-06 16:12                               ` tvrtko.ursulin
2008-08-06 16:25                                 ` Rik van Riel
2008-08-06 18:06                                   ` Eric Paris
2008-08-05 20:17                   ` [malware-list] [RFC 0/5] [TALPA] Intro to a linux interfaceforon " Alan Cox
2008-08-06  9:24                   ` tvrtko.ursulin
2008-08-06 15:24                     ` Greg KH
2008-08-05 18:27                 ` Arjan van de Ven
2008-08-05 18:34                   ` Press, Jonathan
2008-08-05 18:38                     ` Greg KH
2008-08-05 20:15                       ` [malware-list] [RFC 0/5] [TALPA] Intro to a linuxinterfaceforon " Press, Jonathan
2008-08-05 20:26                         ` Greg KH
2008-08-06 10:05                           ` tvrtko.ursulin
2008-08-06 10:50                             ` Adrian Bunk
2008-08-06 11:07                               ` tvrtko.ursulin
2008-08-06 11:26                                 ` Adrian Bunk
2008-08-07  0:49                                   ` Mihai Donțu
2008-08-07  4:39                                     ` Arjan van de Ven
2008-08-11 13:45                                       ` Mihai Donțu
2008-08-11 13:56                                         ` Arjan van de Ven
2008-08-11 16:11                                           ` David Collier-Brown
2008-08-11 21:18                                             ` Press, Jonathan
2008-08-11 22:09                                               ` David Wagner
2008-08-12  7:32                                                 ` Alan Cox
2008-08-13 10:28                                               ` Pavel Machek
2008-08-13 10:46                                                 ` Press, Jonathan
2008-08-13 11:08                                                   ` Peter Dolding
2008-08-13 12:56                                                   ` Pavel Machek
2008-08-13 13:52                                                     ` tvrtko.ursulin
2008-08-14 12:54                                                       ` Pavel Machek
2008-08-14 18:37                                                         ` [malware-list] [RFC 0/5] [TALPA] Intro to alinuxinterfaceforon " Press, Jonathan
2008-08-14 22:39                                                           ` Pavel Machek
2008-08-15  0:00                                                             ` Rik van Riel
2008-08-15  0:43                                                               ` Theodore Tso
2008-08-15  1:02                                                                 ` Rik van Riel
2008-08-15  3:00                                                                 ` Eric Paris
2008-08-15  5:22                                                                   ` david
2008-08-15  5:33                                                                     ` david
2008-08-15  5:38                                                                       ` david
2008-08-17 22:14                                                                     ` Pavel Machek
2008-08-17 22:12                                                                   ` Pavel Machek
2008-08-17 22:47                                                                     ` david
2008-08-17 22:58                                                                       ` Pavel Machek
2008-08-17 23:24                                                                         ` david
2008-08-18  0:00                                                                         ` Casey Schaufler
2008-08-18  0:17                                                                           ` david
2008-08-18  0:31                                                                             ` Peter Dolding
2008-08-18  0:39                                                                               ` david
2008-08-18  0:42                                                                             ` Casey Schaufler
2008-08-18  0:07                                                                         ` Rik van Riel
2008-08-19 10:41                                                                           ` Pavel Machek
2008-08-15  8:35                                                                 ` Alan Cox
2008-08-15 11:35                                                                   ` Theodore Tso
2008-08-15 12:57                                                                     ` [malware-list] [RFC 0/5] [TALPA] Intro to alinuxinterfaceforonaccess scanning Press, Jonathan
2008-08-15 13:16                                                                       ` Theodore Tso
2008-08-15 13:22                                                                         ` douglas.leeder
2008-08-15 13:28                                                                           ` douglas.leeder
2008-08-15 13:55                                                                           ` Theodore Tso
2008-08-15 14:19                                                                             ` douglas.leeder
2008-08-15 15:42                                                                             ` Valdis.Kletnieks
2008-08-17 22:10                                                                   ` [malware-list] [RFC 0/5] [TALPA] Intro to alinuxinterfaceforon access scanning Pavel Machek
2008-08-13 13:58                                                     ` [malware-list] [RFC 0/5] [TALPA] Intro to a linuxinterfaceforon " Arjan van de Ven
2008-08-13 13:54                                                   ` Arjan van de Ven
2008-08-13 14:16                                                     ` tvrtko.ursulin
2008-08-13 14:28                                                       ` Arjan van de Ven
2008-08-13 15:19                                                         ` tvrtko.ursulin
2008-08-14 12:56                                                       ` Pavel Machek
2008-08-14 20:06                                                         ` Alan Cox
2008-08-14 22:35                                                           ` Pavel Machek
2008-08-11 21:53                                             ` David Wagner
2008-08-11 21:45                                               ` Alan Cox
2008-08-14 10:48                                               ` David Collier-Brown
2008-08-06 15:00                                 ` Theodore Tso
2008-08-06 15:17                             ` Greg KH
2008-08-06 15:22                               ` Eric Paris
2008-08-05 20:38                         ` Arjan van de Ven
2008-08-05 20:54                           ` Eric Paris
2008-08-05 21:05                           ` Al Viro
2008-08-05 18:38                     ` [malware-list] [RFC 0/5] [TALPA] Intro to a linux interfaceforon " Arjan van de Ven
2008-08-05 18:39                   ` Eric Paris
2008-08-06  0:30                     ` Rik van Riel
2008-08-06  1:55                       ` Eric Paris
2008-08-06 11:40                     ` Sidebar to [malware-list] [RFC 0/5] [TALPA] Intro to a linux interface for on " David Collier-Brown
2008-08-06  0:22                 ` [malware-list] [RFC 0/5] [TALPA] Intro to a linux interfaceforon " Rik van Riel
2008-08-06  0:53                   ` jmorris
2008-08-06  2:46       ` [malware-list] [RFC 0/5] [TALPA] Intro to a linux interface foron " Andi Kleen
2008-08-06  8:39     ` [malware-list] [RFC 0/5] [TALPA] Intro to a linux interface for on " tvrtko.ursulin
2008-08-05 11:21   ` Helge Hafting
2008-08-05 17:04     ` Greg KH
2008-08-05  2:49 ` Casey Schaufler
2008-08-05  3:01   ` Cliffe
2008-08-05  3:44     ` Casey Schaufler
2008-08-05  3:45       ` Cliffe
2008-08-05 20:56       ` Paul Moore
2008-08-06  3:00         ` Casey Schaufler
2008-08-06 14:18           ` Paul Moore
2008-08-07  0:49             ` Casey Schaufler
2008-08-05  3:46     ` Greg KH
2008-08-05  3:58       ` Cliffe
2008-08-05 12:05         ` Peter Dolding
2008-08-05 12:22       ` Alan Cox
2008-08-05 18:08 ` Nick Piggin
2008-08-06  9:44   ` [malware-list] " tvrtko.ursulin
2008-08-06 11:10     ` Nick Piggin
2008-08-06 11:29       ` tvrtko.ursulin
2008-08-06 16:57         ` Nick Piggin
2008-08-05 22:55 ` J. Bruce Fields
2008-08-06 10:09   ` [malware-list] " tvrtko.ursulin
2008-08-06 22:24     ` David Wagner [this message]
2008-08-07  0:04       ` James Morris
2008-08-07 10:30         ` Alan Cox
2008-08-07 11:19       ` tvrtko.ursulin
2008-08-06  2:35 ` Andi Kleen
2008-08-06  3:43   ` Eric Paris
2008-08-06  3:52     ` Andi Kleen
2008-08-06 22:04 ` David Wagner
2008-08-18 14:06 ` John Moser

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to='g7d8a1$81o$2@taverner.cs.berkeley.edu' \
    --to=daw@cs.berkeley.edu \
    --cc=daw-news@cs.berkeley.edu \
    --cc=linux-kernel@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).