Anti-Virus Is Dead, D-E-A-D, Dead!
Outgoing Gartner analyst Amrit Williams is leaving with a bang, boldly declaring that stand-alone, signature-based anti-virus is dead. |
Williams, who is giving up his analyst hat and joining BigFix as chief technical officer (that's triggered a whole different debate), also argues that the stand-alone anti-spyware market is kaput too, "If it even existed!"
In a blog entry that will surely raise hackles in some quarters, Williams argues that signature-based AV isn't protecting anyone anymore and certainly wasn't providing any protection against spyware, rootkits and the other nastier threats that have popped up recently.
"It didn't stop Blaster, or Sasser, or Slammer, it did nothing to help Choicepoint, or the VA or the orgy of disclosure we have all become numb too. It was running happily along, updated and content on my mom's machine when it turns out her Windows XP box was infected with some pretty nasty bits," Williams wrote.
This is the security industry's worst-kept secret, of course. For me, the Sony BMG rootkit drama was the final nail in the AV coffin. That episode wasn't so much about copy protection or Sony's greed. It was about the rank incompetence of the anti-virus sector.
The spyware guys are having a field day playing -- and winning -- cat-and-mouse with AV vendors. Quick spam run with a new Trojan; sit back and watch the AV guys scramble to ship signatures; tweak the code, send another spam run, watch and giggle as another round of .DAT files get built; repeat, rinse, dry.
By the time the AV vendors send out their gushy press releases hailing another blocked virus, the botnets are replenished and the cycle repeats itself next month.
This is why I'm happy to see Williams boldly bring the discussion out in the open, exposing the limited to nonexistent way in which stand-alone anti-spyware deals with bots and rootkits.
So what happens next? Williams predicts:
"Well AV becomes part of a converged security client, offering multiple capabilities including anti-spyware, personal firewall, and intrusion prevention as the foundation. Of course this has already begun and the AV guys are shoving more and more technologies onto the desktop, including data leak prevention, end-point policy enforcement, patch and configuration management. They bundle it under some uber-agent, while the individual executables are fighting to claim your system resources. They offer some half-baked management console, slap a new coat of paint on some recent acquisitions, and complain anytime Microsoft attempts to improve their security if it in anyway affects their sacred AV cash cow."
He's absolutely right when he says that enterprises invest and deploy AV "more out of a sense of fear than because they believe it is offering value." In many ways, you could make the argument that it borders on extortion, the way we feel we need to buy protection that doesn't -- and won't exist -- in anti-virus software.
"By the end of 2007 stand-alone AV will be dead, d-e-a-d, dead! Organizations need to evolve their client security programs or expect to see increased costs as the number of agents continues to rise," Williams declared.
Amen to that.
Comments (15)
>>It didn't stop Blaster, or Sasser, or Slammer...
Duh. It stopped the thousand other attacks that you didn't hear of because they got stopped.
Posted by Larry Seltzer | December 1, 2006 3:57 PM
>>It stopped the thousand other attacks that you didn't hear of because they got stopped.
But it still didn't stop Blaster, or Sasser or Slammer.
Posted by Laromat | December 1, 2006 4:32 PM
You should have used CounterSpy along with the anti-virus, and run XoftSpy occasionally as well just to catch those quirky ones. I also rotate the active anti-virus on the machine every few months just in case something has installed itself and overwritten my anti-virus software at the same time.
Posted by Kokuryu Tenchi | December 1, 2006 4:44 PM
Sure, let's all run a dozen anti-virus/spyware/etc. apps on our machines. Then they might be clean, but wait, there won't be any use the machine for.
This is the most striking quote for me: "executables are fighting to claim your system resources".
We need to keep pushing the OS vendors to plug these holes themselves so we don't need to have a dozen little services checking every file being opened/written to/downloaded.
If that means being more restrictive in what apps can do, particularly, where they are allowed to install files and where they are allowed to read from and write to, I'm all for that. A Windows installer is free to do anything it wants, literally, including with the right code write hidden bits to the HDD or whatever (ie: DRM and even 30 day trial type software that hides things on your HDD). The OS needs to actively restrict these behaviors. This would get us a lot of the way there, and I believe Vista is taking the correct first steps. Unfortunately, MS still feels the need to be backward compatible with older apps (totally understandable of course) but as long as they allow for that there will always be big holes left open. They're also under pressure from certain companies (antivirus) to allow full low level access to hardware. Screw them. As for hard drive cleanup/compression/defrag companies. The OS should provide competent versions of these tools as well and put these out of business too. All software should have to access the hardware through the kernel through Windows API calls. All hardware vendors should be forced to certify their hardware drivers for use with a particular OS otherwise the OS should not allow installation as well.
Posted by Derek Read | December 1, 2006 6:19 PM
What's all this fuss about anti-spyware, anti-adware, and crappy AVware? I don't ever install any of that stuff and my machines NEVER get infected - ever!
Oh, I forgot, my BSD-Unix-based Apple Macintosh is immune to all that malicious crap.
As more businesses wise up and switch to running Open Office on Macs or Linux, they'll see these headaches simply disappear. Because after all, it's Windows, with all it's ActiveX and IE glory that's the vector - indeed, it's the Typhoid Mary of operating systems. Always has been, always will be.
Posted by Fred Farkle | December 1, 2006 10:24 PM
Yep - right..... after all successful virus activity is simply a failure of operating system integrity. Roger Schell (GEMSOS) and others knew all about this 30 years ago but the industry and regulators did absolutely NOTHING!
The result - well, isn't it supposed to be "Vista" which - quote - even a "seven-year son" can use without anti-virus software! STOP - NSA's Jim Loscocco and colleagues called it correctly in 1998... no commodity, commercial operating system is secure and - really - was never intended to be! Enter "Secure LINUX" or SELinux.. a great start - but does anyone care? (Try Fedora Core 6 for starters or Redhat's Enterprise Linux Version 5 - soon).
Anyone remember Microsoft's XENIX (yes - Microsoft's - not the later IBM version - Warp etc) and its secure version from TIS (Secure XENIX) which achieved a B2 rating for security many years ago?
Mandatory Access Control (MAC) based systems should have been with us by the late 1990s in commercial versions adapted to business and commercial needs. Putting malware into these types of systems is simply one, two or three orders of magnitude harder than with obsolete DAC (Discretionary Access Control) systems of the commodity type. Even the Intel x86 security architecture (rings, capability memory, enforced memory segment registers, etc.) aimed at assisting this security was ignored in the 1980s.
The operating system IS the base!
And what scares me is that we are now building huge "castles" of software, such as Web Services systems, and even pseudo-security structures such as WS-Trust, SAML, "CardSpace", etc, on the totally fragile "quicksand" of the OS and even - good heavens - the critical cryptographic sub-systems in those exposed OSes.
Without a secure OS/hardware base all forms of application software and control mechanisms (such as antivirus, antispyware, antirootkit schemes) just cannot really cope. Useful - but no guarantees!
Is it any wonder that the ordinary user is honestly now wondering if the Internet - well, really the computers connected to it - is a suitable place for critical e-commerce and government transactions?
Perhaps the only way forward will come when industry and government see consumers simply "switching off" the Internet for these services and relegating it to an entertainment, educationald and like low-risk service environment.
The "writing is on the wall".
Bill Caelli
Posted by Bill Caelli | December 1, 2006 11:58 PM
I take a look at some of these comments and laugh when I hear of stopping slammer, blaster or the comments based upon using linux and open source software. How are they immune to running code on your box? Just because the virus doesn't exist yet, does NOT mean it can't happen. I even got a chuckle about letting MS control everything, still...not the way to go. I do believe the OS vendor should lock stuff down and provide technology and solutions to prevent this from happening, but lets not go overboard here.
-Michael
Posted by Michael Sainz | December 3, 2006 12:26 AM
I always tell everyone in the Windows world not to run with local admin privileges. I set my parents computer up that way as well.
And despite that, and despite them having AV software (Norton), and despite being setup to auto install Windows Updates they still got infected with a bunch of nasty stuff.
I mean, what else can you possibly do?
Well, the answer for me is that their next computer will be a Mac.
Posted by James | December 3, 2006 12:52 PM
Geez, I thought this lunacy died out with MacOS9. The zealots have apparently migrated here. Yeah, buy your parent's a Mac, that'll protect them, at least it gives them better odds, since fewer people bother building viruses for them. Of course you've given them a completely proprietary system, but what the hey, they can be cool like the guy on the Mac TV ads. At least in their dreams, they'll be "independent thinkers". Right.
Since you guys are here, maybe you can answer...how come MacOS was the most wonderful thing in the world, stable, intuitive, perfect, for all those years through 7, 8, 9, but when OSX came along all of a sudden those "old" OS's were junk? Lessee, how many upgrades to OSX have you had to pay for now?
Just moo, listen to your Ipod, the AOL of music players, and follow Steve J's lead, he'll "take care" of you, and those bad guys won't get you...you're protected, you've got a Mac, you're immune, the moon is green cheese too. Keep your wallet handy, you'll be needing it often for more OSX upgrades.
Posted by Gary | December 5, 2006 10:30 PM
I maintain my small home and business networks myself, so I am happy to see you admit the emperor has no clothes. I could not figure out why McAfee didn't cut it with spyware, so thank you all for the explanations, even if you don't agree.
Personally I found Spyware Doctor to be the only program that could protect our PCs from the Web antics of my two teenagers. My daughter's PC had become so infected with adware it was unuseable, but McAfee would run happily in Safe Mode for an hour and then congratulate me on my clean machine, which of course was still unuseable in normal mode. Yikes!
Spyware Doctor nailed hundreds of items McAfee ignored the first time it ran and has protected us successfully for the last year. My son's computer set our household record of 1,057 items found by Spyware Doctor the first time it ran, BTW. So far no known identity theft anyway ...
Now McAfee has something new. I don't know if it works now or not but I won't trust them. I don't know how normal people manage. Count me among the people afraid to uninstall McAfee however. I just use both and it seems to work.
Microsoft's security enhancements seem to be most effective at preventing innocuous Java-based utilities and Web sites from working, forcing me to put just about everything my daughter uses into the trusted category.
Posted by Mike Smith | December 8, 2006 3:21 PM
Don't you love it when people point out problems, but don't have solutions? Its very easy for someone to write about the deficiencies of something, and not come up with a solution of their own. Now if the articles author at least provided some insight into what they might do then I would give the article a little more credibility.
Posted by Mark Wade | December 28, 2006 4:46 PM
Yankee Group has just quietly released a report that could really get the security industry talking -- if anyone knew about it. Why Yankee chose to release this a few weeks before the RSA 07 conference, rather than *at* the conference is anyone's guess. But report, "Anti-Virus Is Dead; Long Live Anti-Malware" seems to indicate that the researcher is finally willing to talk about the security industry's dirty little secret, "…Today's anti-virus products are overwhelmed by the sheer quantity of malware variants. By 2009, anti-virus as we know it will be dead."
Posted by Tom Smith | January 18, 2007 5:30 PM
The admission doesn't surprise me at all. That's why I run Power Shadow, a virtualization software (free for now) similar to Shadowsurfer/user only better. It stops everything. Antivirus and antispyware programs react to a new virus, trojan, worm, etc, and put out a fix after they learn about it. By then, how many computers has it infected? Using virtualization software is part of the solution, for protecting your OS or drive from damage. It doesn't stop that drive from being read by spyware etc, but as soon as you reboot or shut down, they're all gone.
Posted by Chuck | February 10, 2007 10:44 AM
Buy a MAC?
I realize once MACs gain in market share we'll have to deal with the same, but for now, I'm happily computing away with no AV installed.
Posted by paul | June 11, 2007 6:53 AM
I know that anti-virus andspam filters don't work much of the time, especially when the hackers come up with new programs every day. I'm using "Hide My I.P." and "Evidence Eliminator" and they appear to work very well against outside intrusion. Is anyone familure with these programs? What is your opinion?
I do know that "Evidence Eliminator" after running the program for the first time really increased the speed of my computer as it cleans areas that defrag won't get and it secures the hard drive three levels deep that even the government can't retrieve any information.
I think everyone should protect themselves against intrusion into their computer by who ever wants to for what ever reason.
It is my computer and I don't give anyone permission to access it
Posted by sarlininn | June 19, 2007 9:39 AM