magazine

TECH INSIGHT
Fiction: Antivirus software is dead
Fact: The way security software
detects malware has changed
By security expert Graham Cluley
Antivirus is dead! We’ve seen this
announced so many times we’ve
taken to carrying black ties. Actually,
anti-malware technology moved on
long ago, but customer and media
perception has lagged way behind.
Much malware – spear-phishing, APT – is
now highly targeted, meaning that no
I.T. security company will claim 100%
malware detection.But this just means
it’s changed.Current malware detection
comes in three main forms:
Proactive detection and blocking
The holy grail of security: proactive
blocking through reputational and
generic countermeasures.
Detection of known malware
A high proportion of threats continue to
be detected either specifically or using
more generic detections.
Remediation
These days, anti-malware and protection
is achieved through reputation and
behavior analysis, and with the aid of
advanced heuristics, while signatures
are primarily used for remediation where
proactive methods have failed. Don’t
be too optimistic about finding a single
solution. The best advice is to look for a
combined solution that you can afford.
Fiction: BlackBerry is dead
Fact: If you worry about security,
BB10 is very much alive
By Cameron Camp,
Malware Researcher, ESET
Following the ground-up overhaul
of the BlackBerry operating system,
we wondered how it really stacks
up – security-wise – against other
smartphone operating systems?
An overhaul like this is not for the
faint at heart. The people at BlackBerry
re-envisioned the new BlackBerry 10
operating system from experience
gained from the older versions and
the acquisition of QNX, a real-time
microkernel based Unix-like construct.
Starting with a microkernel is a
nice way to isolate processes into tidy
containers that can become pseudosuspicious
of each other, and therefore
form the foundation for a stack of
compartmentalized processes that
follow the same model.
And QNX is no slouch here – a longtested,
real-time OS platform that has
performed well for longer than some of
BlackBerry’s engineers have probably
been alive. How well did they do
combining all this tech with a handset
design that appealed to the average
mobile user? The verdict is still out.
While there are a myriad of external
(and internal factors) that may control
the success of the BB, it’s good to know
a company like this had the foresight to
revamp the whole stack in a thoughtful,
security-focused way – and the guts to
go for it.
Fiction: Antivirus failed to stop
the Target breach
Fact: It was detected daily –
staff failed to notice
By Lysa Myers, ESETResearcher
Let’s examine some of the myths
about the Target breach.
(1) The person who created the
malware perpetrated the breach.
Knowing who created the malware
doesn’t tell us who carried out the
attack – it is only one tool that the
attacker or attackers used.
(2) The code was not detected in
VirusTotal, so antivirus failed. The
idea that VirusTotal can be used as
an accurate test of whether up-todate
antivirus software would detect
malware has been debunked.
(3) The attackers must be geniuses.
Malware authors are not geniuses – they
are simply resourceful about combining
information that’s widely available.
(4) There’s no way to stop such
attacks. The usual security advice
should have been followed. It wasn’t.
(5) Attackers only hit big
businesses. Attacking a big business
is certainly a huge payday – but lots
of little attacks can quickly match it.
High-profile breaches like this should
remind businesses that it’s worth the
expense to improve their security.
welivesecurity.com 33