Some further thoughts on the subject of antivirus software.
My windows box was recently colonized by a nastly little virus/trojan. I detailed the trials and tribulations of its detection and removal here. I won't reiterate the specifics here but the summary is that ten different Antivirus Vendors failed to locate it and the one who did locate it failed to remove it EVEN THOUGH THEY HAD THE VIRUS LISTED IN THEIR DATABASE!!
Here is what i found out about the antivirus industry. They use performance measuring tools that are just as rigged and self-referential as the rest of the world's industries. That is to say the tests are set up in such a way to allow as many of them as possible to claim 100 per cent detection.
What many of the providers use as a benchmark is the WildList. a list of viri found in the wild by list contributors. The contributors happen to be almost entirely Antiviral Software Vendors. The list contains only viri that the contributors have reported in the last month. It is not very hard to see where this leads. As your software fails to detect the virus it'll drop off the WildList just as surely as if it gets caught and eliminated.
As a virus producer what you could do is release your first version of the virus. let it out there and let it get on the list and drop off the list. then do your upgrades and add the really threatening features like slipping past the major vendor AVS and Firewalls. the vendors won't detect it as still happening and will do no further development against the virus. then you too can have a trojan that is completely unchecked and very potentially dangerous.
I say potentially because much like guns and explosives these thing are really only dangerous in the hands of a person. However unlike guns and explosives it is very difficult to imagine legitimate uses for this. However I have no difficulty imagining illegitimate uses for this.
for instance imagine you are a high school kid that is having trouble with one of your teachers. it could be real or imagined trouble. You're a teenager, who can tell the difference. you decide to get even. and then some. You do a little deft social engineering to get his email address. fake up some email address(isn't hotmail wonderful?)and send an email with an attachment some inoccuous looking thing. His Antivirus software proclaims it safe so he goes ahead and looks at it. Blammo, you're in now.
his machine icq's you everytime he's got it turned on and online, and each such opportunity you pack his hard drive full of kiddie porn. you uninstall the software. Then you go to the police in your small town. you tell them about how he made you stay after class and tried to get you to come to his house and see some "very special" pictures he had on his computer. Tell then that he tried to touch you. That should be enough to get a warrant. once they have possesion of the computer it's pretty much all over for him. he will spend an incredibly unpleasant time behind bars. you walk away scot free.
Now in this instance the virus is not actually the danger, the person is. but it illustrates that the danger of a trojan is not low as the Antivirus software people would have you think is is. they are actually the highest security risk of all the types out there. they are especially high as many of them are designed specifically to foil the security software that the majority of people(who use anything) use to protect themselves. It is my contention that these software providers are selling a false sense of security. They protect themselves with various sorts of disclaimers, but in the end they just don't seem to protect against even known viruses/trojans/etc. that well and not at all against new stuff.
A few weeks ago there was some concern about whether the major vendors would act in collusion with the FBI and not detect their magic lantern trojan. As it turns out I don't think they need to bother developing such things there are already plenty out there that slide right by now, with no collusion needed.
