What do you think of Mikko's statement Flame was a failure for the antivirus industry. We really should have been able to do better. But we didn’t. We were out of our league, in our own game.?

It might not have been possible for an antivirus to detect Flame, because the people behind Flame likely tested it against all antivirus software before deploying it. They were very, very careful. It's how they escaped detection for so many years.

Most malware writers test their malware components against AV software before deploying or selling it.

There are even websites dedicated to testing against multiple engines at once for you, automatically.

Of course, those are collection sites as well...

> HTML5 is really interesting. The example there would be somewhat limited- without exploit it can't escape it's little sandbox, meaning it would be great for things like DDoS but not for stealing private information.

May I suggest you take a look at http://www.beefproject.com/ and see what can be done without escaping it's little sandbox. Also if the goal is compromising a host, there will generally be an exploit as part of the toolkit, not necessarily an easily detectable one. At CanSecWest earlier this year there was an interesting Chrome-based pwn2own from the guys at MWR.

beefproject / msf is all about escaping the little sandbox, not doing things in it.

> When people mention signature based detection as a reason why antivirus or malware is dying I always get a bit confused. It's like saying that the transportation industry is going to die because horses are an inefficient way to transport goods. This is something everyone knows already, followed by a conclusion that to me skips the obvious answer everyone else has come to- use different types of detection.

This is true, but I've spent a fair bit of time digging into how various AV engines work internally (including yours, if I remember correctly!) and have found a very high percentage of them to use little more than a flat hash for most signatures. I think in one case there was a 95% majority. Yes, there are many other detection methods, but you need to spend the time to actually come up with proper and functional signatures. I just haven't seen it happen yet - not that I've looked much in the year since I wrote the article.

> The rise in APTs is interesting, and it talked about quite a bit. However, the rise in a new type of threat doesn't mean the decline of the old. The targeted threats need to be protected against, and security software needs to evolve to do that, but that does not be mean the millions of home computers out there aren't a pretty target too.

Again, true, but it doesn't stop it from being a "new type" of attack model that is largely impossible to protect from, especially by automated mechanisms like AV. IDS / IPS helps, if you actually bother to review the damn logs, but most people (in my experience) don't.

> HTML5 is really interesting. The example there would be somewhat limited- without exploit it can't escape it's little sandbox, meaning it would be great for things like DDoS but not for stealing private information.

Yup. Doesn't make the AVs any better at detecting it, though!

> Focusing on what's going on in memory is not the only way to do this. The network traffic tells all sorts of fun information, and it's possible to hook into programs like the browsers themselves to look for suspicious activity.

Unless it's HTTPS, or obfuscated. And since when can you tell the difference between a malicious obfuscated JavaScript payload, and a non-malicious one like minified jQuery?

> Comparing programming salaries is a joke at best. While it's certainly not easy to find and hire great antimalware people, it's not easy hiring great developers either. Malware authors simply do not use bottom of the barrel labor- building malware is just as skillful as detecting it as you need to know how to detect it to evade detection.

Yet we see piles upon piles of malware written in VB6 or Delphi 7, most of which are crappy trojans and keyloggers. Are they the number one super massive threat? No. Are they something to be worried about? Yes. A crappy keylogger can still steal user credentials. A crappy trojan can still steal files and alter data. Rejecting the salary comparison because high-end malware writers wouldn't use 3rd world outsourcing is like rejecting normal gearboxes because all Lamborghinis use those flappy-paddle ones.

Just because current detection schemes are outdated, and the monopolies are perhaps resting on their laurels, it does not mean the anti-virus age is over. I think it's a technological battle which will always be fought. There will always be attackers and defenders. There are already people experimenting with detection through artificial intelligence and the like. Imagine if that technology finally makes it (at this rate it is guaranteed), what would the next step? Wouldn't it be "nearly impossible" for attackers then? Yet nobody will write that the age of the Virus is over.

Off topic, but do you have any books, websites or other recommendations you would suggest for getting into antivirus/malware part of programming?