LinuxSecurity.com
Share your story
The central voice for Linux and Open Source security news
Home News Topics Advisories HOWTOs Features Newsletters About Register

Welcome!
Sign up!
EnGarde Community
Login
Polls
How strictly do your users obey your security policies?
 
Advisories
Community
Linux Events
Linux User Groups
Link to Us
Security Center
Book Reviews
Security Dictionary
Security Tips
SELinux
White Papers
Featured Blogs
Emily Ratliff: OS Security
DanWalsh LiveJournal
Security Bloggers Network
Latest Newsletters
Linux Security Week: December 1st, 2008
Linux Advisory Watch: November 28th, 2008
Subscribe
LinuxSecurity Newsletters
E-mail:
Choose Lists:
About our Newsletters
RSS Feeds
Get the LinuxSecurity news you want faster with RSS
Powered By

  
Next-generation Computer Antivirus System Developed Print E-mail
User Rating:      How can I rate this item?
Source: sciencedaily - Posted by Bill Keys   
Network Security Traditional antivirus software is installed on millions of individual computers around the world but according to researchers, antivirus software from popular vendors is increasingly ineffective. The researchers observed malware --malicious software--detection rates as low as 35 percent against the most recent threats and an average window of vulnerability exceeding 48 days. That means new threats went undetected for an average of seven weeks. The computer scientists also found severe vulnerabilities in the antivirus engines themselves. The researchers' new approach, called CloudAV, moves antivirus functionality into the "network cloud" and off personal computers. CloudAV analyzes suspicious files using multiple antivirus and behavioral detection programs simultaneously. This is an interesting article about the research and development of improvements to virus scanner software. Do you think this new approach will help to catch more viruses on user's machines?

Read this full article at sciencedaily

Comments
WorthlessWritten by evilghost on 2008-08-27 10:39:04
Blacklist based definition software is proven to be worthless and nothing more than a false sense of security as new variants are released. Speaking from the Win32 environment PE and UPX packed executables continue to evade detection. Until a whitelist approach to executable runtime is taken there will be no real benefit to running AV -- unless you like being protected from month-old malware. 
 
I've submitted malware to Virustotal for scanning (even the XP Antivirus 2008 malware and RBN malware de jour) and have found many new variants fail to be detected by ALL engines running current definitions. The AV industry is laughable at best and continue to peddle their snakeoil.
retrospective detectionWritten by keven marlow on 2008-08-28 11:19:32
if you actually read the article, you'd see theirs more advntages than just higher detection. 
 
their retrospective detection technique: Retrospective detection of previously infected hosts: When signature updates are received, previously analyzed files can be re-scanned, allowing the detection of malicious software and identification of hosts that have been infected by them.  
 
so if your malware sample isnt detected by ANY engines, it will be archived and thjen later rescanned when sigs are developed to detect it, then you know exactly what machines on your network had been previously infected!
RE: retrospective detectionWritten by evilghost on 2008-08-28 16:14:42
Except that you don't. Once a machine has been infected it's generally 'owned'; there's a reason for this word choice. The machine is usually rooted and is leaking information back to the bot C&C, some even distributed in ARIN address space allocations. Local libraries have been compromised and any scan results are untrustworthy. 
 
They can call it retroactive all they want but the reality is that an infected asset has been compromised and needs to be rebuilt. Nuke it from orbit, it's the only way to be safe. 

Write Comment
  • Please keep the topic of messages relevant to the subject of the article.
  • Personal verbal attacks will be deleted.
  • Please don't use comments to plug your web site.. Such material will be removed.
Name:
Title:
Comment:

Code:* Code

Powered by AkoComment!

 
< Prev   Next >
    
Partner:

 

Latest Features
A Secure Nagios Server
Never Installed a Firewall on Ubuntu? Try Firestarter
Review: Hacking Exposed Linux, Third Edition
Security Features of Firefox 3.0
Review: The Book of Wireless
April 2008 Open Source Tool of the Month: sudo
Open Source Tool of March: ZoneMinder
Yesterday's Edition
Linux Role in Botnets Studied
10 Mistakes New Linux Administrators Make

QuickLinks: Comunity , HOWTOs , Blogs , Features , Book Reviews , Networking ,
  Security Projects ,   Latest News ,  Newsletters ,  SELinux ,  Privacy ,  Home,
 Hardening ,   About Us,   Advertise,   Legal Notice,   RSS,   Guardian Digital

(c)Copyright 2008 Guardian Digital, Inc. All rights reserved.