I am extremely bias, as I work for Malwarebytes, but it always amazes me how many smart people, who know a lot about computers, think that it's unnecessary to run some sort of protection software. Zero day exploits in browsers and their plugins (flash, java, even pdf readers) happen all the time, and malware authors love taking advantage of them. In a world where just browsing to a website can get you infected it's probably a good idea to have something to stop that. There is no set of "safe habits" that makes you immune to this- even going to reddit has gotten people infected when their ad network was compromised, and stuff like that happens constantly.
My other favorite thing is all the people who say they've never run antivirus/antimalware, but then also claim to never have been infected. How would they even know? Modern malware tries to go undetected, it doesn't want to get detected and removed so it tried to remain as unobtrusive as possible.
Those of you running linux or osx are exempt from this minirant ;-)
Yes, you are extremely biased, and not in any of the good ways.
1. There's plenty of malware out there for Linux. The only difference is the delivery method - i.e., attacks against service endpoints (web apps, mail transfer agents, DNS servers, and so on) instead of user agents (web browsers, mail user agents, file managers, and so on).
2. Detecting novel malware isn't some dark magic only practiced by antivirus vendors such as yourself. People are capable of detecting when their computers behave oddly. These detections do not require antivirus or even particularly clueful users.
3. Antivirus can't see into the future. Novel malware can sneak past Malwarebytes, VirusScan, etc. because detections get created only _after_ someone notices something hinky (point #2 above). Put another way, it always amazes me how many smart people, who know a lot about computers, think that antivirus will make you immune to malicious code injection attacks delivered through user agents such as a web browser. Novel malware gets written /constantly/.
4. As with antivirus, "safe habits" (privilege separation, data execution prevention, content filtering, etc.) greatly reduce the risk of a successful attack. In fact, I'd argue that safe habits alone will have a lower risk of successful attack than antivirus alone, given some set of threats and vulnerabilities. I'd go a step further and aver that solely making it difficult to be socially engineered will approach the effectiveness of antivirus alone (but here my own biases are showing: I admit to lacking the data and analysis to back up that claim).
Those of you running Linux or Mac OS X are most certainly _not_ exempt from this minirant.
You should qualify your last sentence by adding that the only real reasons that that is the case is that 1. Most Linux installations are headless, removing a humongous attack surface, and 2. Both have either not had a lot of market share historically, or they haven't had a lot of users that were easy to fool. Despite popular belief, neither platform is in some way inherently more secure than recent versions of Windows.
The market share situation is changing now, and there's no reason to think that if Windows went away tomorrow the world would be malware-free.
Those are common beliefs and do have some truth to them, but I don't believe they tell the whole story.
Market share is only one part of the equation, the other is effort. Even if linux jumped in desktop adoption that wouldn't make it easier to write malware for, not just because of the security but because of the segmentation. Different distros will have different kernels, patches, libraries and settings that make writing malware that affects the entire ecosystem far more difficult.
With OSX the introduction of malware has never followed market share, although the reasons are more varied for why. One of the biggest reasons, funny enough, is Preview. By not shipping Adobe PDF engines, but writing their own, they've managed to avoid a number of exploits that took advantage of PDF exploits.
This isn't meant to be a conclusive list of differences, but just a couple of examples to show that although market share is a factor it's not even close to the only one there.
I'm not saying it's the only one, just that it's by far the biggest one. If you have a choice between writing malware that could affect 70% of computers or 10%, you pick the 70% demographic. If Mac suddenly had the biggest demographic of users, we'd be seeing a lot more malware for it.
The malware might not exploit X application, and sure, Windows has been plagued by Adobe, but there's nothing that makes OS X fundamentally more secure. Especially considering that a lot of malware today actually relies on social engineering rather than 0days.
Most malware goes after exploits, not social engineering. You see more social engineering and less exploitation on OSX because there is far less to exploit on OSX.
A lot of malware uses social engineering to become deployed, including on Windows, with or without exploits. If you don't think so, I seriously doubt that you work at Malware-Bytes in an R&D capacity, given that Malware-Bytes is the most popular tool for removing stuff that relies entirely on social engineering, e.g. Fake AV malware.
You see more social engineering and less exploitation on OSX because there is far less to exploit on OSX.
That statement might be true for applications that users typically install on these systems, but it's not true for the operating systems themselves.
In absolutely nothing I said did I make the claim that social engineering wasn't used by malware.
You made the claim that there was a level playing field with regards to security between Windows and OSX, "especially considering that a lot of malware today actually relies on social engineering rather than 0days". My response was simply that this isn't 100%, that many malware variants still use exploits to get onto systems, and that your statements based around that are also incorrect.
"especially considering that a lot of malware today actually relies on social engineering rather than 0days"
That doesn't mean "most".
My response was simply that this isn't 100%, that many malware variants still use exploits to get onto systems, and that your statements based around that are also incorrect.
I'm saying that if Windows disappeared tomorrow, malware--the pieces that exploit software or social-engineer users--wouldn't go away by any stretch of the imagination. Malware distribution would immediately and significantly increase on the now most attractive platforms.
There is nothing about the architecture of the other operating systems that make them any more resistant to malware than Windows--in fact, Windows' UAC is superior to the equivalents on both OS X and Linux.
Take something like the Chromebook or iPhone, and we'll talk.
The problem is that if you actually look at how this AV software works (and at how many AV companies behave), there are clear reasons not to trust them.
That doesn't mean you can't use AV that's not shitty, or Bit9 (application whitelisting, which a lot of AV products have built in now) like Tavis goes on to suggest at the end of the paper.
Whitelisting is clearly superior to blacklisting if you have the patience and knowledge to whitelist the right applications.
Comments
I am extremely bias, as I work for Malwarebytes, but it always amazes me how many smart people, who know a lot about computers, think that it's unnecessary to run some sort of protection software. Zero day exploits in browsers and their plugins (flash, java, even pdf readers) happen all the time, and malware authors love taking advantage of them. In a world where just browsing to a website can get you infected it's probably a good idea to have something to stop that. There is no set of "safe habits" that makes you immune to this- even going to reddit has gotten people infected when their ad network was compromised, and stuff like that happens constantly.
My other favorite thing is all the people who say they've never run antivirus/antimalware, but then also claim to never have been infected. How would they even know? Modern malware tries to go undetected, it doesn't want to get detected and removed so it tried to remain as unobtrusive as possible.
Those of you running linux or osx are exempt from this minirant ;-)
Yes, you are extremely biased, and not in any of the good ways.
1. There's plenty of malware out there for Linux. The only difference is the delivery method - i.e., attacks against service endpoints (web apps, mail transfer agents, DNS servers, and so on) instead of user agents (web browsers, mail user agents, file managers, and so on).
2. Detecting novel malware isn't some dark magic only practiced by antivirus vendors such as yourself. People are capable of detecting when their computers behave oddly. These detections do not require antivirus or even particularly clueful users.
3. Antivirus can't see into the future. Novel malware can sneak past Malwarebytes, VirusScan, etc. because detections get created only _after_ someone notices something hinky (point #2 above). Put another way, it always amazes me how many smart people, who know a lot about computers, think that antivirus will make you immune to malicious code injection attacks delivered through user agents such as a web browser. Novel malware gets written /constantly/.
4. As with antivirus, "safe habits" (privilege separation, data execution prevention, content filtering, etc.) greatly reduce the risk of a successful attack. In fact, I'd argue that safe habits alone will have a lower risk of successful attack than antivirus alone, given some set of threats and vulnerabilities. I'd go a step further and aver that solely making it difficult to be socially engineered will approach the effectiveness of antivirus alone (but here my own biases are showing: I admit to lacking the data and analysis to back up that claim).
Those of you running Linux or Mac OS X are most certainly _not_ exempt from this minirant.
You should qualify your last sentence by adding that the only real reasons that that is the case is that 1. Most Linux installations are headless, removing a humongous attack surface, and 2. Both have either not had a lot of market share historically, or they haven't had a lot of users that were easy to fool. Despite popular belief, neither platform is in some way inherently more secure than recent versions of Windows.
The market share situation is changing now, and there's no reason to think that if Windows went away tomorrow the world would be malware-free.
Those are common beliefs and do have some truth to them, but I don't believe they tell the whole story.
Market share is only one part of the equation, the other is effort. Even if linux jumped in desktop adoption that wouldn't make it easier to write malware for, not just because of the security but because of the segmentation. Different distros will have different kernels, patches, libraries and settings that make writing malware that affects the entire ecosystem far more difficult.
With OSX the introduction of malware has never followed market share, although the reasons are more varied for why. One of the biggest reasons, funny enough, is Preview. By not shipping Adobe PDF engines, but writing their own, they've managed to avoid a number of exploits that took advantage of PDF exploits.
This isn't meant to be a conclusive list of differences, but just a couple of examples to show that although market share is a factor it's not even close to the only one there.
I'm not saying it's the only one, just that it's by far the biggest one. If you have a choice between writing malware that could affect 70% of computers or 10%, you pick the 70% demographic. If Mac suddenly had the biggest demographic of users, we'd be seeing a lot more malware for it.
The malware might not exploit X application, and sure, Windows has been plagued by Adobe, but there's nothing that makes OS X fundamentally more secure. Especially considering that a lot of malware today actually relies on social engineering rather than 0days.
Most malware goes after exploits, not social engineering. You see more social engineering and less exploitation on OSX because there is far less to exploit on OSX.
A lot of malware uses social engineering to become deployed, including on Windows, with or without exploits. If you don't think so, I seriously doubt that you work at Malware-Bytes in an R&D capacity, given that Malware-Bytes is the most popular tool for removing stuff that relies entirely on social engineering, e.g. Fake AV malware.
That statement might be true for applications that users typically install on these systems, but it's not true for the operating systems themselves.
In absolutely nothing I said did I make the claim that social engineering wasn't used by malware.
You made the claim that there was a level playing field with regards to security between Windows and OSX, "especially considering that a lot of malware today actually relies on social engineering rather than 0days". My response was simply that this isn't 100%, that many malware variants still use exploits to get onto systems, and that your statements based around that are also incorrect.
That doesn't mean "most".
I'm saying that if Windows disappeared tomorrow, malware--the pieces that exploit software or social-engineer users--wouldn't go away by any stretch of the imagination. Malware distribution would immediately and significantly increase on the now most attractive platforms.
There is nothing about the architecture of the other operating systems that make them any more resistant to malware than Windows--in fact, Windows' UAC is superior to the equivalents on both OS X and Linux.
Take something like the Chromebook or iPhone, and we'll talk.
The problem is that if you actually look at how this AV software works (and at how many AV companies behave), there are clear reasons not to trust them.
For example: https://lock.cmpxchg8b.com/sophailv2.pdf
The problem of malware is systemic, and can't be solved by adding complex, poorly-constructed add-on software.
That doesn't mean you can't use AV that's not shitty, or Bit9 (application whitelisting, which a lot of AV products have built in now) like Tavis goes on to suggest at the end of the paper.
Whitelisting is clearly superior to blacklisting if you have the patience and knowledge to whitelist the right applications.