Softpanorama (slightly skeptical) Open Source Software Educational Society

May the source be with you, but remember the KISS principle ;-)

False Positives and False Virus Epidemics

There are several types of false positives. One is regular programs detected as infected (proper false positive). Second are double use programs detected as infected or Trojan (see two references below); the third are virus hoaxes.

There is also the additional type of false positives that is present only in large corporate environment and can be called "pseudo-epidemics". In this case update of AV signature lead to detection of the files that previously were undetected and that often does not represents any danger being just a remnants of the virus/worm activity. This abrupt wave of pseudo-infections that can be in dozens of hundreds can be quite destructive due to misjudgment of personnel which assumes that this is a real threat and tries to take adequate (or non-adequate) defense measures. 

Security like a cleaning survives does not attract the brightest and most capable programmers and administrators. More often then not, the responsibility for AV defense in a large company is offloaded to a person with no specific knowledge or technical skills or even slightest interest in his area. But such a "placeholder" approach can backfire by overreaction to false epidemics as such staff is unable to distinguish them from real events. That just increases the damage from the virus adding to it the damage from incompetence.  

Old News ;-)

Antivirus scanning for potentially misused tools is a doomed security strategy.

There is a growing trend with AntiVirus scanners today. The scanners are scanning for more and more software that does not contain virus or trojan code. The new category of software the scanners are looking for is common software that has the *potential* to be misused by malicious persons. Usually this software is in the security auditing tool, network monitoring, or remote control category.

Corporate customers of AntiVirus software have requested that these potentially misuseable programs be flagged and, in some cases, "disinfected" by the scanning software. The AntiVirus vendors seem more than happy to comply. Even going so far as to label this new category of detected software as a "virus" or "trojan" when found, no matter how misleading to the user this label is.

Another controvertial twist in this new AntiVirus category is the fact that the AntiVirus vendors do not scan for their own tools that fall into the new "potentially misusable program" categories. Symantec's Norton AntiVirus will scan for the remote control programs, NetBus or BO2K, but not the company's own PC Anywhere. Network Associates' McAfee VirusScan will detect the NT password auditing tool, L0phtCrack, but will not detect the company's own vulnerability auditing tool, Cybercop scanner, or their network sniffers, Sniffer Basic or Sniffer Pro.

It is a fallacy that commercial tools are not misued by malicious individuals. They are usually available as free trial downloads or available on pirate software sites. However, the whole notion of protecting a network by scanning for potentially misuseable tools is a fallacy unto itself!

Using AntiVirus client scanning technology to find programs that can exploit the security problems on a network is a losing battle. AntiVirus software can be turned off. New tools or new versions of older tools will soon become available. Other machines without AntiVirus software can be attached to the network. Machines can be booted with alternative OSes.

You need to actually fix the network security problems! It is foolhardy to scan for tools that could exploit problems rather than just fixing the problems. This scanning scenario just gets OS and application vendors off the hook. Now they don't have to fix the problems. They will just rely on the AV vendors to scan for programs or code that can exploit the problems. Why fix, for example, Win 95/98 challenge-response network authentication? Each client on the network should be scanning for all known tools that can sniff the network or crack the passwords. Obviously this is not a good security model.

Reform the AV Industry -- another kind of false positives ? Dual function program listed as trojan.

Who remembers the case of Netbus? In February '99 Netbus released version 2.0 to the public as shareware. They removed many of the stealth features and changed it's functionality so it was no longer a trojan horse but an actual product from an actual company. It even achieved a 5 cow rating on Tucows when released.

Well, about a month later, the A/V industry started listing this new version of Netbus as a trojan, this action prompted Tucows to remove Netbus 2.0 even after it gave it's 5 cow approval. Ultraaccess.net, the makers of Netbus, tried to talk to the A/V vendors after it was listed, most would not even return their phone calls. Panda was the only one to respond in any fashion to ultraaccess.net. Data fellows and a few other vendors didn't list it until the big vendors and "customer response" prompted them to add it to their definitions. Ultraaccess.net is not a large company, they have however, hired a lawyer and are trying to get all their legal material together for their next version release sometime in spring next year, but it appears to be an up-hill battle. (Thanks go to Judd Spence at Ultraaccess for providing me with the history of Netbus.)

Another example of the A/V vendors logic is L0phtcrack. L0phtcrack was released in 1997 and the latest version in January 1999. It has since become one of the premier tools for NT password auditing. L0phtcrack was recently listed as a trojan by one company then others started adding similar descriptions. A/V vendors follow each other on their latest listings, when one company lists a new piece of code, all the others just copy it, as was mentioned by Weld Pond on NTBugtraq (http://www.ntbugtraq.com/default.asp? pid=36&sid=1&A2=ind9912&L=ntbugtraq&F=&S=&P=5026). So if one company doesn't like your product they can have it added to their definitions and all the other ducks fall into a row and list the same program blindly.

These situations sound like classic David vs. Goliath battles of the little developer being quashed by big business. With certain A/V producers also having remote administration products, does this not seem like a major conflict of interest? What is to keep them from listing the competition with muddy descriptions as virii and trojans to scare and annoy the customer into using their product? In talking to various security scanner companies I kept hearing the same situation with Netbus; clients had bought and paid for it, but their A/V package was constantly deleting it. What sane person is going to disable their virus protection so they can run a program? Not a very good plan. This usually has the effect of forcing the person to change remote administration tools to one of the big names or to change A/V packages, but since all the vendors share definitions your going to have the same problem. This can severely hurt small business with products like Netbus if their clients are getting frightened with virus warnings. Yet, equally featured products are never given a second glance.

If you feel your software was erroneously listed, there is very little recourse in trying to talk to the companies to have some action taken. The big vendors haven't returned Ultraaccess.net's phone calls and the smaller vendors follow the definitions of the big boys. So even if you successfully remove yourself from one package, one has to go to each vendor and plead your case all over again. The A/V industry seems almost like a monopoly that can do what it wants and list anything with impunity, always falling back on the excuse of "customer demand" (though this is how many programs get on the list in the first place, but it's hard to verify if it's a legitimate response or a conjured up one). It's gotten to the point where the industry can make or break products.

With big companies like Symantec and NAI that have interests in other products of their own, I can't believe that they aren't abusing the public trust to leverage their own products in the marketplace. Again, as Weld Pond pointed out in his Buffer Overflow article "Symantec's Norton AntiVirus will scan for the remote control programs, NetBus or BO2K, but not the company's own PC Anywhere. Network Associates' McAfee VirusScan will detect the NT password auditing tool, L0phtCrack, but will not detect the company's own vulnerability auditing tool, Cybercop scanner, or their network sniffers, Sniffer Basic or Sniffer Pro". If this is not using your product to force another, I don't know what is.

The A/V industry is very necessary, but has gotten too complex for it to continue in the current state. In the very near future, any product that can be misused to any tiny degree will be listed, and what recourse will companies have to protect themselves from the abuses by the industry?

I propose an agency, commission, organization, board, watchdog group or something that all A/V vendors are a part of and follow the decisions of, so you only have to appeal your case to one group to clear your products name. A sort of better business bureau for the industry. Many A/V vendors belong to various Internet Security Bodies but there is no body for Anti-Virus.

Last modified: February 28, 2008