Onderwerp: Re: getting rid of outbreaks and spam

0.02 kroner coming up

> From: Gadi Evron
>
> 2. In a broader view, notifications ARE currently the
> problem rather than a solution.

I think we all recognize the fundamental truth that AV notifications are
pure marketing. They contain no instructions on removing the virus and only
serve to spread FUD. Somewhere sometime, a marketer at an AV company thought
"hey, let's get new customers by notifying people that send the virus!",
implemented it and everybody followed suit since "everybody is doing it, we
might as well also".

AV notifications have degenerated from a misguided assistance to become an
even worse problem than the viruses they are supposed to stop.


> 3. I think we look at the whole problem in the wrong way,
> allow me to elaborate:
> The AV industry is built on reaction rather than prevention.
> Adding new signatures is still the #1 tool in the fight against malware.

I couldn't agree more. We should stop wasting time on detailing the subject
lines of a new virus, what P2P folder the latest worm copies itself to or
how the latest Blaster variant changes spread algorithms on the second
Thursday of the month (provided it's raining in spain). All of this does
nothing to prevent any future reoccurences of the same threats and is mainly
of academic interest - if you're writing a paper on worm propagation
techniques or a book about "The 1001 funniest virus subject lines". We're
all curious beings, but having my mom know the subject lines of the 5 latest
viruses does nothing to prevent her from opening attachments or being
infected by Blaster.

We need to change our mindsets fundamentally and approach these threats from
a different angle. Instead of playing archeologists that are uncovering
dinosaur bones and detailing their ridges we need to become bio engineers
who analyze DNA mutation patterns and create strains of tomato plants that
can endure cold winternights. It is essential that we invest serious time
and money into analyzing and matrixing the common attack, spread and
infection vectors of the threats that our corporate networks and public
infrastructure encounter, and that we use that knowledge to create targetted
counteractions and proactive theat mitigations that can hinder the spread or
impact of generic types of threats - in advance.

This is not just a philosophy but a viable approach to applicable crafting.
We at PivX Solutions have been preaching Proactive Threat Mitigation for
quite some time now. I have been speaking about it at conferences (blame
canada), the panel members understood it when we explained it at the first
National Cyber Security Summit and we integrated our initial efforts into
Qwik-Fix which prevented dozens of threats in Q4 2003 (MiMail,lots of IE
exploits,etc).

I think we can all get lost in specifics from time to time, which is why it
is important to remember that real security is all about risk management -
how much time and money do we want to invest in lowering the inherent risk
to an acceptable level? It is only when we start diverting those resources
away from reactive solutions, such as antivirus that have not hindered any
major virus outbreak but even created the far worse problem of AV
notifications, and towards proactive appliances and proper risk management
that we can minimize our risk and shorten our window of exposure to threats.


> With spam and mass mailers clogging the tubes, causing us all to
> waste money on bigger tubes, as well as our time dealing with the
> annoyance (more money), shouldn't the problem be solved there
> (at the main tubes themselves) rather than at the end user's desktop?
>
> They are right, it isn't currently demanded of them.

ISPs and peering points should seriously consider the development and
implementation of technologies that can unintrusively and anonymously detect
threats and filter packets that meet certain risk criterias, before
governmental agencies wake up and start addressing the issue by regulations
and law that will inevitably limit their control of private property.



Regards

Thor Larholm
Senior Security Researcher
PivX Solutions
24 Corporate Plaza #180
Newport Beach, CA 92660
http://www.pivx.com
thor@pivx.com
Phone: +1 (949) 231-8496
PGP: 0x5A276569
6BB1 B77F CB62 0D3D 5A82 C65D E1A4 157C 5A27 6569

PivX defines "Proactive Threat Mitigation". Get a FREE Beta Version of
Qwik-Fix
<http://www.qwik-fix.net>

Thor Larholm wrote:
>> 2. In a broader view, notifications ARE currently the
>> problem rather than a solution.
>
> I think we all recognize the fundamental truth that AV notifications
> are pure marketing. They contain no instructions on removing the
> virus and only serve to spread FUD. Somewhere sometime, a marketer at
> an AV company thought "hey, let's get new customers by notifying
> people that send the virus!", implemented it and everybody followed
> suit since "everybody is doing it, we might as well also".

Think back to the beginning. Before viruses emailed themselves out, back
when viruses attached themselves to otherwise legitimate EXEs, DOCs(macro
viruses), etc. In those days when I implemented a virus scanner, I didn't
notify people initially (long story, it was a hacked together solution), I
started getting complaints that email with attachments wasn't making it
through.

In this context, virus notifications were a positive thing.

Next in the evolution we had viruses that emailed themselves out, wasn't
Melissa one of the first?

At any rate, in the beginning, viruses emailed out with a legitimate "MAIL
FROM" address, so even then, notifications typically went to the correct
sender, although in this case notifying the recipient wasn't very effective.

--
Dave Warren,
Email Address: dave.warren@devilsplayground.net
Cell: (403) 371-3470 Fax: (403) 371-3471
Toll free: (888) 371-3470 Vonage: (817) 886-0860
ICQ: 17848192 AIM: devilspgd Yahoo!: devilspgd
MSN/PASSPORT: dave.warren@devilsplayground.net

>>From Thor:=20
>>
>>...It is only when we start diverting those resources away from =
reactive solutions,
such as antivirus that have not hindered any major virus outbreak but =
even created the
far worse problem of AV notifications, and towards proactive appliances =
and proper risk
management that we can minimize our risk and shorten our window of =
exposure to threats.

I agree that MyDoom demonstrates all too clearly the inherent =
limitations of
conventional antivirus technology, but you're still unfair to it. First, =
the vast
majority of attacks don't spread as far and as fast as MyDoom, and by =
the time one is
likely to encounter it the AV companies have protection available, so =
conscientious
users can protect themselves. Surely this is beneficial when it works, =
which is very
often. Second, do you actually know that AV technology has never =
prevented a major
outbreak? That would likely be an outbreak we didn't hear about. =
Finally, AV companies
didn't cause the infrastructure problems, like unauthenticated SMTP, =
that facilitate our
worst attacks.

>>ISPs and peering points should seriously consider the development and =
implementation
of technologies that can unintrusively and anonymously detect threats =
and filter packets
that meet certain risk criterias, before governmental agencies wake up =
and start
addressing the issue by regulations and law that will inevitably limit =
their control of
private property.

Too bad that mass-market ISPs could never afford to do this given =
current pricing
expectations. This kind of protection would require making Internet =
access much more
expensive as a general rule. The political outcry would be far worse =
than any reaction
to an attack such as we have just experienced.

Larry Seltzer
eWEEK.com Security Center Editor
http://security.eweek.com/
larryseltzer@ziffdavis.com=20

Larry Seltzer opined:

> I agree that MyDoom demonstrates all too clearly the inherent
> limitations of conventional antivirus technology, but you're
> still unfair to it. First, the vast majority of attacks don't
> spread as far and as fast as MyDoom, and by the time one is
> likely to encounter it the AV companies have protection
> available, so conscientious users can protect themselves.

Correction 1: In the past the vast majority of attacks didn't
spread as far and as fast as MyDoom. That's no cause for complacency.
I think we can expect a lot more rapid-spreading viruses in the future.

Correction 2: Antivirus vendors weren't that fast in getting updates out
for MyDoom.A. Times below are in GMT, based on information posted on the
ClamAV Users mailing list by Diego d'Ambra, which cited PC-Welt as the
source.

ClamAV- 26.01 20:23 - Worm.SCO.A
McAfee (BETA) - 26.01. 21:20 - W32/Mydoom@MM (you'd have to have manually
downloaded this one for it to have been any use)
Symantec (BETA) - 26.01. 22:00 - W32.Novarg.A@mm
F-Prot - 26.01. 22:30 - W32/Mydoom.A@mm
Trend Micro - 26.01. 22:35 - WORM_MIMAIL.R
Trend (BETA) - 26.01. 22:35 - WORM_MIMAIL.R
RAV - 26.01. 23:00 - Win32/Novarg.A@mm
Norman - 26.01. 23:05 - MyDoom.A@mm
F-Secure - 26.01. 23:05 - W32/Mydoom.A@mm
Virusbuster - 26.01. 23:05 - I-Worm.Mydoom.A
AVG - 26.01. 23:15 - I-Worm/Mydoom
Avast - 26.01. 23:15 - Win32:Mydoom [Unp]
Kaspersky - 26.01. 23:30 - I-Worm.Novarg
AntiVir - 26.01. 23:30 - Worm/MyDoom.A2
Symantec - 27.01. 00:05 - W32.Novarg.A@mm
InoculateIT-CA - 27.01. 00:20 - Win32/Shimg.Worm
Command - 27.01. 00:20 - W32/Mydoom.A@mm
A2 - 27.01. 00:30 - Worm.Win32.Mydoom
Sophos - 27.01. 00:40 - W32/MyDoom-A
InoculateIT-VET - 27.01. 01:30 - Win32.Mydoom.A
Esafe - 27.01. 01:50 - Win32.Mydoom.a
Dr. Web - 27.01. 02:40 - Win32.HLLM.Foo.32768
Panda (BETA) - 27.01. 03:10 - W32/Mydoom.A.worm
McAfee - 27.01. 04:00 - W32/Mydoom@MM
Quickheal - 27.01. 04:00 - W32.Novarg
Bitdefender - 27.01. 04:00 - Win32.Novarg.A@mm
Panda - 27.01. 04:10 - W32/Mydoom.A.worm
Ikarus - 27.01. 08:35 - I-Worm.Mydoom

ClamAv detected our first incoming MyDoom.A at 00:20 GMT on January 27th,
well before some the main Antivirus vendors had patterns available for
autoupdate. Consider also that some vendors still work on a weekly update
cycle (e.g. McAfee) with updates more frequently only when a virus is
detected in some numbers in the wild. Bolting stable doors...

Cheers,

Phil


---------------------------------------------
Phil Randal
Network Engineer
Herefordshire Council
Hereford, UK