But AV vulnerabilities sit on the top of the attack class pyramid. They often are remotely executable, run with kernel privileges and do not require user interaction.
You can't lump that together that with malware that requires tricking a user into downloading an installer, clicking through it and granting it elevated privileges.
Off the top of my head, users of Bitdefender.
You're right of course, my point is that without some evidence you're just making up numbers to prove your point and any jerk with a keyboard (like say, me) can do the same thing. Thanks for providing some background to those numbers.
If you're talking about something else, I've stated that antivirus detects around two-thirds of new malware on any given day. In case it wasn't already clear, two-thirds is terrible.
Your claim is far more extreme, though. You said "You're better off not using an antivirus". That's wrong. Antivirus won't keep you safe, but you're still safer with it than without it.
If you're saying cookies shouldn't be flagged by antivirus, that's wrong. Cookies can be associated with malware in any number of ways[1], although grayware (especially adware), which antivirus also flags depending on configuration, is a more likely culprit.
1. Check out PyExfil, for example: https://github.com/ytisf/PyExfil. Cookies for data exfiltration. DNS controls on firewalls are there for similar reasons.
> Experience has shown us that antivirus software does not do what it says on the tin.
Whose experience?
I built WildFire at Palo Alto Networks[1]. We analyzed a few tens of millions of new potential threats daily, including the VirusTotal firehose.
As part of our internal efficacy and competitive monitoring, we took the top 5 enterprise antivirus products and ran everything coming into WildFire through them.
The delta between ground truth and what the antivirus engines caught using only static scanning and emulation was about a third, i.e. better than the pessimistic estimate of half I threw out. (In the real world, antivirus actually does better because malware is easier to catch after it starts running.)
The danger of antivirus, on the other hand, is wildly overstated in this thread. A small fraction of attacks use vulnerabilities to begin with, and in the scheme of things, very few antivirus vulnerabilities have been found. 1% is just a nice, round number chosen for illustrative purposes; it's orders of magnitude greater than the real risk.
Now, this will surprise exactly no one who works in security, since most new malware is a minor variant of existing malware and exploits are relatively uncommon, but for the less experienced folks reading these comments, I implore you: Don't listen to people who say antivirus is useless or, worse, makes you less secure.
It isn't. It doesn't. They're wrong.
1. It's the biggest ATP product out there, took the crown from FireEye c. 2015. https://www.paloaltonetworks.com/products/secure-the-network...