“I’ve been circumventing antivirus systems today.” His eyes glistened when my colleague Mattias told me this during the latest after-work get-together. It’s not as strange as it sounds. All our clients have antivirus systems, and they are a natural part of penetration tests.
Traditional antivirus systems collect large numbers of so-called signatures of malicious code, which they then compare with the files on your computers. This approach is called blacklisting. It worked reasonably well in the past, but is becoming increasingly difficult for several reasons.
Firstly, the number of known viruses is increasing exponentially. As soon as they are modified just slightly a new signature is needed. Secondly, there are more and more black hats hacking for a living. When they discover new security holes or develop their own code, they use the information in targeted attacks. In the old days they manufactured viruses that were dispersed on a large scale and could be captured and analysed. Now they keep the knowledge to themselves. This means there is more and more malware circulating on the black market.
Most antivirus systems nowadays look not only for signatures but also for suspicious patterns and behaviours. The result is better, but the fact remains that they are still looking for things they know about.
In summary, traditional antivirus systems can only ward off script kiddies and viruses that make use of known methods. They are important for hygiene, but cannot prevent advanced hacker attacks. Moreover, different antivirus systems are good at different things but do not always work if installed together on the same machine.
More recently, a method called whitelisting has come into focus. Instead of trying to find every malicious program, only a certain number of programs that do the right things are accepted. The downside of this technology is that it requires a finely tuned database that suits precisely your system without interfering with business operations. The advantage is the much lower chance of targeted attacks being successful.
Unfortunately there is no single antivirus program that solves the problem of malware. First you have to decide what information is worth protecting. Then, you need a well thought out strategy that includes several different types of protection: antivirus programs, firewalls, intrusion detection systems and possibly whitelisting of applications. Nor is it wrong to have several types of anti-virus software installed on different computers. Since a large proportion of corporate information is held on mobile devices, extra thought must be given to these.
But above all, we must remember that security is so much more than just antivirus software. An individual security mechanism can always be circumvented. It is the whole picture that really matters.
Share/Bookmark
