summaryrefslogtreecommitdiff
path: root/posts/2020-12-29-antivirus-software-is-a-hack.php
blob: cc5f0d01f3d60f30299106321cfb55ed510e19ed (plain) (blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
<?php
$title = "Antivirus Software is a Hack";
if (isset($early) && $early) {
	return;
}
include($_SERVER['DOCUMENT_ROOT'] . '/includes/head.php');
?>

<p>
	<img src="https://nextcloud.53hor.net/index.php/s/jJoFoA7Ppjb7rey/preview" />
</p>

<p class="description">
	I read a really terrific article today about computer security and
	really dumb ideas or trends that have developed in this field. It's
	<a href="https://www.ranum.com/security/computer_security/editorials/dumb/">M. Ranum's <em>The Six Dumbest Ideas in Computer Security</em></a>, and I highly recommend reading through the whole thing. It's got
	great anecdotes and really simple language for what I consider to be
	some of the obvious issues with the way programmers and sysadmins think
	about security (myself included). One portion of it (idea #2), however,
	finally put something into words that I've felt for a really long time.
	It enables me to explain why I think all antivirus software is a total
	hack and is virtually useless.
</p>

<blockquote>
	hack<br />
	1. n. Originally, a quick job that produces what is needed, but not
	well.
	<br />
	<cite>-- The Jargon File (version 4.4.7, 29 Dec 2003) [jargon]</cite>
</blockquote>

<p>
	This is the Jargon File's definition of a hack. And to me, this is what
	antivirus software is. Antivirus software, as I understand it, emerged
	in the mid to late 1980s and became prolific in the 1990s. In the 2000s
	it was considered an essential piece of software and people were paying
	for yearly subscriptions for antivirus suites from Norton, Avast, and
	McAfee.
</p>

<p>
	The most basic functionality of an antivirus program is to determine
	whether malware exists on a host operating system. The typical method of
	doing this is to use a collection of virus definitions and compare each
	and every potentially-infected file with each and every definition to
	determine whether the file is malware or has been infected by some. An
	over-simplified way of implementing this is to store a collection of
	hashes, each taken from a known potentially unwanted program or
	infectious executable. You can then hash entire files or portions of
	files and compare the checksums to see whether a file contains or is
	equivalent to the definition, and is therefore infected and shouldn't be
	executed. Some security suites go beyond this with heuristic matching,
	but if you run an antivirus that has to "update definitions" on a
	routine basis, it probably works something like this*. With any luck, it
	does it without being a total detriment to system performance. Ideally
	it also doesn't act like a piece of malware itself by making itself near
	impossible to remove (looking at you, McAfee).
</p>

<p>
	To me, a virus definition database is "enumerating badness" (Ranum's
	Dumb Idea #2). The premise is that it is not only logical but even
	possible to compile a list of <em>all</em> potentially unwanted
	programs, viruses, ransomware, and worms. An environment of trust should
	be built around the programs that you want to run (read:
	<em>allow to run</em>), not the other way around. Picture an operating
	system where no binary file can be executed unless it is specifically
	flagged as being allowed to. Oh and picture also being able to restrict
	this execution to just the file's owner, or other groups of users.
	Wouldn't it be easier to store the list of 30 odd programs that you and
	other system users trust to be run than the thousands (millions?) of
	programs that are infectious, forbidden, or unwanted? What about when
	those trusted applications become compromised? Would it not also be
	easier to maintain a list of checksums for those binaries and compare
	those checksums before they're executed to make sure they haven't been
	infected or replaced?
</p>

<p>
	The answer is yes, it would be easier. And yes, it is easier. Of course,
	your system has to work that way. Antivirus software is a hack because
	it's a hack-y solution to a problem that has a better, simpler solution.
	It also has the potential for making a ton of money but I won't go into
	that. It's easier to enumerate goodness, to specifically open up to a
	select few trustworthy applications. Good lists are usually shorter than
	bad lists. This builds on top of Ranum's Dumb Idea #1: Default Permit.
	You wouldn't configure a firewall to just block some known bad ports and
	traffic. You configure it to block all of it, and then whitelist the
	ones you know you can trust. You wouldn't configure a browser ad-blocker
	to permit all ads, and select the ones you don't want to see. You block
	all of them! Then, if there are sites or ads you're okay with seeing,
	you whitelist them. You shouldn't default permit all programs to be
	given control over your computer, and then meticulously list the ones
	that don't have that permission.
</p>

<p>
	Oh and of course, as always, there's free software that lets you do
	this. You don't have to pay for an antivirus suite, or even use an
	unpaid one that slows down your computer or barrages you with ads. On
	the BSDs and virtually all Linux distributions, there are built-in tools
	to control access and execution of binaries. There are additional tools
	that you can install that check whether binaries (in locations like
	<code>/bin</code> or <code>/usr/local/bin</code> have been modified
	since you last used them. On Windows, the story is a little different.
	Most home Windows 10 users are automatically allowed to install and run
	any software they want to by default. Windows Server does have Software
	Restriction Policies that allow you to create a "default deny" policy
	and whitelist only the software that's allowed to run. If you're using a
	home edition you probably have to look for software that lets you do
	this. I haven't tried any of them so I'm not going to endorse or even
	name them here.
</p>

<p>
	Preventing malware from running on your system is a problem. Solving
	this problem is the right thing to do. But please, try to solve it the
	right way. I stopped using an antivirus after I moved out and got to
	control my own computer. I don't think it ever did me any good besides
	flag false positives (a lot of the time with programs or applications
	that I wrote, which weren't malicious in any way!) and grind my spinning
	disk to a halt. Evaluate what software you use. Is most of it online?
	Are there one or two applications that you know you need to use? How
	often do you install and use unknown or untrusted software? Odds are you
	can come up with a list of very few programs that you want or need to
	use. If it's less than 100,000, you're probably better off with a
	default deny policy than an antivirus suite.
</p>

<p>
	* What I didn't mention here is that as soon as a new piece of malware
	is constructed, if it's different enough from its predecessors, it's
	impervious to all antivirus suites on the planet that don't have it in
	their definitions. So until that malware is used, detected, and added to
	the list, it has free reign.
</p>