Avast: a Chromium fork with critical security checks removed

Re:Avast: a Chromium fork with critical security checks removed by busterarm on Monday February 08, 2016 @12:12PM (#11059348)

I used to work for an antivirus vendor and I would not recommend this.

The antivirus engine is the same and the only differences are how it's packaged. They're still shoveling obtrusive, crap software onto your system, just being less obvious about it.

The only reason to have Symantec Corporate Edition Antivirus installed on your system is because your company signed a deal to use Cisco VPN & Endpoint Protection and you're literally forced to use it.

What mostly everyone fails to understand is that antivirus software is not effective as a _preventative_ measure. What they are good at is detecting that you're already infected, but they all have terrible rates of false-positives. Nothing out there is much effective at protecting you from 0-day, despite industry claims to the contrary.

User training/habit modification is the only effective measure at preventing infection (besides being behind a default-deny firewall, but that's not something consumers will do). 99.9999% of infections require user interaction (and the ones that don't require it become instant international news). Adblockers get you most of the way there and do a better job at prevention than antivirus software.

Flaws in AV software have been exploited by rootkits before. AV software is just another point of failure.

[ Parent | on HN ]

Re:Avast: a Chromium fork with critical security checks removed by chris_wot on Monday February 08, 2016 @03:03PM (#11060514)

No, they aren't good at finding malware installed. I installed Norton on my mother's friend's computer and it found 4 bits of malware. I later installed Malwarebytes and it picked up something like 45 different malware programs! I was surprised so I verified about 12 of them before I realise they were pretty accurate and let it remove them from her system.

That's a very poor detection rate. I mean, I can confirm that at least 12 nasty malware programs weren't detected by a very widely used AV suite!

[ Parent | on HN ]

Re:Avast: a Chromium fork with critical security checks removed by busterarm on Monday February 08, 2016 @05:10PM (#11061239)

Many programs, especially "antimalware"-class programs and __especially__ MBAM serve up false positives as valid hits. MBAM serves up common (and innocuous) tracking cookies as malware hits. Nearly everything that MBAM labels as a 'PUP', Potentially Unwanted Program, is bogus. Also, it will serve up data files (metadata, saved data) files from an infection as the infection itself.

Its user interface deliberately does not give its users the proper context to evaluate the severity of a problem. The change came after they made a concerted effort to monetize the app.

MBAM is good at a lot of things (it has traditionally been on top of modern registry hooks and ransomware loaders where other vendors consistently drop the ball) but just because you saw 45 things flagged red doesn't mean you had 45 bits of hostile executable code on your system.

Malware infections aren't a singular entity anymore, they are a stew of items working together to maintain control of your system (exploit, loader, payload [usually a rootkit], defense, c&c). It's often a matter of breaking the chain of processes to 'open up the onion' and regain control of your system.

[ Parent | on HN ]

Re:Avast: a Chromium fork with critical security checks removed by chris_wot on Tuesday February 09, 2016 @06:25AM (#11064597)

Yeah, I know. But I definitely counted at least 12 seperate and rather nasty Browser Object based malware programs. Which is a lot better than Norton and Trend Micro, who didn't pick them up at all!

[ Parent | on HN ]