RSSCommercial antivirus software rendered useless in hours
By Tim Conneally | Published August 11, 2008, 6:02 PM
At the Race To Zero contest at DEFCON 16 in Las Vegas last weekend, seven sample viruses and three sample exploits were reverse engineered to the point where they could bypass anti-virus software. The task took one team just over two hours.
Race to Zero is a contest where a series of malicious code samples are given that must be modified to be able to circumvent five anti-virus engines, each sample more difficult than the last.
The contest began with the 20-year-old DOS virus Stoned, then followed with Netsky, Bagel, Sasser, Zlob, Welchia, and Virut.
Exploits included three Microsoft vulnerabilities: one for Word, the Vista animated cursor vulnerability, and the SQL database 2000 engine flaw or "Slammer" Worm. The Word exploit was later discarded from play because few contestants actually had a vulnerable version of Windows 2000 to test upon.
A major motivation for holding the contest was to show just how weak signature-based anti-virus software is and how quickly it can be bypassed. Signature-based anti-virus is the original technique that blocks programs that match known malicious signatures, based on pattern matching. While non CPU-intensive, it has reached the point where many consider it obsolete.
In the security community, however, this is a well-covered point, and some -companies already have moved toward more behavior- and rule-based programs.
As I always say. If man made it man can take it apart.
Score: 0
Heuristic scanning ftw. :)
Score: 0
And sadly all the false positives that come from it. I'm sure that will get better as time goes on, but still damn annoying.
Score: 0
Doubtful. As programs become more complex, they may very likely increase.
Score: 0
Whitelisting ftw?
Or perhaps, common-sense ftw? :p
Score: 0
While non CPU-intensive, it has reached the point where many consider it obsolete.
The point was reached years ago. I consider most Antivirus useless.
And they even ask money for them. -_-;
Score: 0
I agree, traditional virus scanning trough signatures is protecting after the virosic code already hit the wild.
Educating the users should be the way, but that is harder than paying for the "illusion of security", right?
Score: 0