The death of Antivirus signature protection?

[RoboMan]

I shall agree with most of the comments here. Sig-based security software is no longer a decent protection layer. Still, until next-gen antivirus and so software are available for all users, sig-based antivirus are a must. But how to use at kind-of-useless software? I've always recommended to use Internet Security Suites or Free Antiviruses along with other type of software that could guarantee maximum achievable protection for 2017. I regularly use Avast Premier with its Firewall with VoodooShield for executables protection, and some pishing & xploits protection. Lacking of next-gen antivirus, combinations like these are thr best way to be ready for attacks.

 

[uncle bill]

signature will never die because file hash is used to detect false positive and well know true positive.

 

[RejZoR]

I shall agree with most of the comments here. Sig-based security software is no longer a decent protection layer. Still, until next-gen antivirus and so software are available for all users, sig-based antivirus are a must. But how to use at kind-of-useless software? I've always recommended to use Internet Security Suites or Free Antiviruses along with other type of software that could guarantee maximum achievable protection for 2017. I regularly use Avast Premier with its Firewall with VoodooShield for executables protection, and some pishing & xploits protection. Lacking of next-gen antivirus, combinations like these are thr best way to be ready for attacks.

Remember how often we see "New tech that will make antiviruses obsolete". And in the end antiviruses are still here and those aren't anymore.

The reason why signatures are still around is because they are cheap to use. Why waste tons of resources on PE emulator or behavior blocker doing the analysis if you can simply match a fast signature for known threats? And even algorithm based signatures are cheaper than other methods. That's Evo-Gen with avast! for example. It's not signature and it's not heuristic detection. It's somewhere in between, it's 100% machine generated detection and it's very fast method of detection. It's why these things never disappeared. A lot of things evolved around them dramatically, but signatures remained because they are still functional and usable even today.

 

[Windows_Security]

Anti-Virus solutions are called anti-virus solution for a reason: they protect the internet community as a whole.

1. First victim executes the malware.
   
   
2. AntiVirus does not find it in the blacklist, but its reputation services notices that this executable has never been seen before, so it is analysed further. When malware is not detected by pre-execution EVO-GEN or CyberCapture simulated sandbox run it is send to the cloud for further automated analysis (Machine Learning).
   
   
3. First victim is infected, but further (cloud and offline) analysis is tearing malware apart and an automated fingerprint is generated in minutes.
   
   
4. New found sample is placed on VT, other AV's copy fingerprint in blacklist.
   
   
5. Zero day infection window is closed within 15 minutes for 99.99% percent of the samples.

30.000 or 300.000 new malwares every day may also sound impressive, but most are variants on a existing malware family and most of these new variants will be found by automated analysis. When you look at the real world tests of AV-comparatives, AV-test, etc, you will notice that they find on average 150 to 200 new samples every month. And even with these 'new' samples AV-detection rates are above 95%.

 

[Wave]

signature will never die because file hash is used to detect false positive and well know true positive.

Signatures are already obsolete and dead, it's been this way for well over a year now - malware authors can get their hands on packing/obfuscation tools at ease within seconds from free options out there which will do just fine in most scenarios.

It's all about dynamic mechanisms now; this includes a good dynamic memory scanner, dynamic heuristics, behavior blocker/host intrusion prevention system, sandbox mechanisms. A very powerful technique that some AV software can do is emulate the code of the Portable Executable, and/or run it within a virtual environment through the usage of the Hyper-Visor (also allowing them to forget about PatchGuard/Kernel Patch Protection, thus allowing them to set MSR hooks and the such to monitor the program being ran in the virtual environment).

Some AV products may include an unpacking engine which may occasionally work however it won't work with all packers, there's so many out there with differences. For example, they may wait until they have identified the program is decrypted in memory and then dump it to disk -> re-scan with the normal signatures.

Regarding false positive detection's, AV software tend to rely more on Trusted Publishers for this these days through the white-listing of code signing authentication (digital signatures). Of course, not all genuine software is digitally signed, however more and more vendors are moving to the usage of digital signature due to it's benefits for both trust and security purposes. Hash checksum's are of course still utilized for both detection and white-listing regardless of it being "obsolete" to a high extent for malware detection, but it doesn't affect white-listing usage since that's not malware detection.

It's still useful for affirmative detection of known malware like you said, but it can be bypassed too easily and therefore it's become obsolete and not sufficient enough.

 

[Wave]

Why waste tons of resources on PE emulator or behavior blocker doing the analysis if you can simply match a fast signature for known threats?

Simply because you can change the hash checksum through basic byte manipulation of the PE, it's very quick to do, and if that was all AV products had to offer then the rate of successful infection would be much higher.

Most products on the market which are actually successful do a lot more than checksum hash detection anyway, examples being: Avast, Kaspersky, ESET, Emsisoft, AVG, Norton. Of course there are more vendors.

Any vendor that solely relies on hash checksum detection will likely not make much profit because people will just go elsewhere and they'd also be wasting their time on development, and if the user needs minimal protection then even Windows Defender would be a better suited and sufficient choice.

 

[Deleted member 178]

Lot of stuff (some wrong , some right) are being said in general terms about "AV being Dead" , but lucky you, the great Umbra is willing to share his unfathomable knowledge on the matter.

1- AV are "technically" dead, by technically , i mean the technology is obsolete since ages (for older members, they know me for my disdain of AVs) , look at those AI fancy stuff, AV vendors realized since a while that the classsic signature/heuristic is useless at its current state , so they look now for advanced algorithm analysis methods (aka the AI, because Ai sounds cool).
The signature model died the day BB/HIPS were introduced, because if your AV engine was efficient, why would you need a BB to backup it? because zero-day malwares make signatures obsolete.
Why obsolete? because malware writers have access to a variety of tools to obfuscate efficiently their newly created malware, they even use an "hacker" version of Virus Total , that test the malware against all known AV engines, without any submission; those tools exist since ages and improve permanently.

2- AV are not dead ! you would think now "umbra is a madman ! he just said on the paragraph above it is dead !"
they are very alive in market terms because:
- AV scanners are the most simple security tool a beginner can protect himself with. AVs does everything for you, it just warns you that it detected a malicious file. no need skills or deep knowledge of the OS to decrypt the mystical popup of HIPS/BBs.
- AV are good and easy money , put a yearly subscription, if you are a bit nasty , release you own malware that only you have a signature,
- Cheap cost , take engine v8 , add 3 new signatures, make it v9 via photoshop; job done.
- Give some cash to some security magazines reviewers and test labs to get good advertisement; then wait the cash to flow in.

Remember when Windows introduced built-in Windows Defender? all the crybaby security vendors and their campaign to discredit it ? yep, they didn't like the idea...and then all those so called "independent" tests labs suddenly rating WD as poor protection ? sure it is ok for them to compare a full-fledge AV with tons of prevention features while WD is tested just as a scanner by disabling Smartscreen and UAC ! come on test labs ! gimme a break...

Now M$ already introduced Appcontainer (aka "sandbox that doesn't break anything) on the Universal Windows Apps; and they will add full virtualization on Edge and a simple BB on WinDef (for enterprises) .

Beginners need AVs ? yes they still do but less than before thanks to M$. in 2020, Win7 will be unsupported, all computers will be shipped with Win10, in the meantime MS will surely introduce more capabilities to its native security. 3rd party AVs will be" optional" and no more "required"...

Then i will, as Agent Smith said to Neo, "You hear that Mr. Anderson?... That is the sound of inevitability... It is the sound of your death... I'm going to enjoy watching you die, Mr. Anderson. "

 

[Wave]

I don't think AV is dead completely although I do dislike signature-based detection since it's obsolete in my eyes, my opinion is sort of biased but I perfectly understand where @Umbra is coming from and I do agree with some of the stuff in the above post too.

At the end of the day, I think that people should just make better decisions and study on keeping themselves safe... Windows 10 alone contains so many built-in protection mechanisms that is more than enough if you use them properly: WD, UAC, SmartScreen, Group Policies, ... Like @Umbra said about AppContainer, etc.

But I guess there are many who don't want to learn or don't understand that the AV is not a replacement for their brain so they download Avast Free or buy security and then get infected anyway.

I personally like Emsisoft, Kaspersky, ESET and Avast. I don't really like the other ones as much or at all. But with any security product you still need to make good decisions, it's more of a backup buddy if anything at all.

 

[Deleted member 178]

But I guess there are many who don't want to learn or don't understand that the AV is not a replacement for their brain so they download Avast Free or buy security and then get infected anyway.

That is an accurate description of most of Average Joes.

 

[shmu26]

This is good and all until you get a keylogger and you have no idea it's there. Then in a day or 2 they have all your passwords and restoring from backup will not change that.

another way to protect against this is the free program called startup sentinel. It alerts you when a program tries to add itself to autostart. Most malware will try to do that, at some point. So at least you will know you got infected if you run startup sentinel.

 

[Deleted member 178]

another way to protect against this is the free program called startup sentinel. It alerts you when a program tries to add itself to autostart. Most malware will try to do that, at some point. So at least you will know you got infected if you run startup sentinel.

indeed this app work well, also you can use SUA because registry writes are virtualized.

 

[shmu26]

indeed this app work well, also you can use SUA because registry writes are virtualized.

so if you use a standard user account, then startup sentinel is superfluous?

 

[Deleted member 178]

i won't say superfluous, some areas aren't virtualized.

Protecting System Files with UAC Virtualization

old articles, so i don't know if MS improved it, but from experience, any registry modifications i made had to be done only on admin account.

 

[shmu26]

i won't say superfluous, some areas aren't virtualized.

Protecting System Files with UAC Virtualization

old articles, so i don't know if MS improved it, but from experience, any registry modifications i made have to be done only on admin account.

thanks Umbra, I don't know how I missed that interesting post of yours.

 

[Handsome Recluse]

@shmu26 There was an article by @Windows_Security detailing the hole that Startup Sentinel can patch when under SRP+UAC

 

[shmu26]

@shmu26 There was an article by @Windows_Security detailing the hole that Startup Sentinel can patch when under SRP+UAC

thanks
I think you were referring to this post
Software restriction Policies to Windows Home

 

[Tony Cole]

I do agree, but unless they stop their stupid behavior(s) with stupid claims that never happen, the forum is full of ideas that never happened. Get rid of the lot, focus on a few, giving software away for free will result in under funding, until that's all sorted it will forever be a crap product with serious bugs, you need money, plans, a good team and a vision to go forward, Comodo has none.