Disable Your Antivirus Software (Except Microsoft's)

[KIA]

To be fair it is possible. I shared this capture a while back of a 'test' of various ransomwares (in Win 7). Note that some are caught by UAC, but some are not. Maybe the ones that were caught didn't do as much damage though, I do not know.

Privilege elevation through the use of an exploit and asking the user to elevate are two separate things. I think he's talking about the former because he said "regardless of UAC".

 

[KingDazza]

It makes me laugh when I read that someone has not had an antivirus and has never had a virus, how would you know?

I think you need to make the distinction between real-time and on demand. I have not ran a real-time av for years. However periodically I do run an on demand scan from an av that isn't installed. So you can effectively run without an av but check that there is no malware.

 

[Mattus]

Digging into the tracker notes it required a specially crafted SVG animation, but would then run arbitrary code. The browser would then crash. This is pretty typical for a browser exploit - it requires a specific, crafted element on a site, i.e. a dodgy site.

Or a legit site which gets hacked and the specially crafted SVG animation inserted into the page.

Otherwise, the hassle with all the prompts, running stuff elevated, etc, is far greater, than restoring an image or cleaning a piece of malware in a few years if something gets through. I hate the fact that Microsoft is shoving all that security crap down our throats.

Screw updates, screw using crappy user accounts without rights, screw all those unnecessary prompts and extra user actions.

(1) Using something like UAC to prevent privilege elevation attacks is a bread and butter security measure. I don't really understand the issue... what are you doing that means you see UAC prompts often enough for them to become an inconvenience?

(2) Restoring an image won't help you if your personal info is compromised because you've been running a keylogger.

(3) "Screw updates"? Really?

 

[linktoinsanity]

I think you need to make the distinction between real-time and on demand. I have not ran a real-time av for years. However periodically I do run an on demand scan from an av that isn't installed. So you can effectively run without an av but check that there is no malware.

That is a little different, but it's still much safer to run real-time protection at all times.

 

[jpaul]

just installed Avast as a change from the (resource hungry) Avira scanner
was intrigued to see T&C's say

8. Privacy; Processing of Personal Information The Software collect s certain information, which may include personally identifiable information, from the compute r on which it is installed, including:
8.1 URLs of any websites you have visited ;

Avast has many, pathetically, documented components, I went for below selection which should hopefully give scanner, without any intrusion on the FF browser (already using ff+noscript), I am also using MS firewall.
I May also disable real-site which could be needlessly intercepting browser traffic

Does anyone have counter opinions on what is useful in Avast ?

 

[El Pew]

I absolutely loathe the whole rights things, and UAC, I always used the hidden administrator account in win7, the only reason I don't in 10, is because Metro apps (which I use to watch tv for example from my cable provider), don't allow running with UAC disabled or using the hidden admin account.

Otherwise, the hassle with all the prompts, running stuff elevated, etc, is far greater, than restoring an image or cleaning a piece of malware in a few years if something gets through. I hate the fact that Microsoft is shoving all that security crap down our throats.

Screw updates, screw using crappy user accounts without rights, screw all those unnecessary prompts and extra user actions.

Hilarious. You're just asking to be owned, regardless of how careful you think you're being.

The Australian Signals Directorate (their version of the NSA) has some great advice, what they call the Essential Eight:

1. Application Whitelisting
2. Patch Applications
3. Restrict Admin Privileges
4. Patch Operating Systems
5. Disable untrusted MS Office macros
6. User application hardening (i.e. block Flash, web ads and Java in the browser)
7. Multi-factor authentication
8. Daily backup

Of those, whitelisting is by far the most effective method for preventing malware attacks but there isn't really a good solution for that for home users that I know of.

AV is dangerous because it typically runs with elevated rights - if there's a vulnerability in your AV solution, an attacker can potentially leverage it to run code with the highest possible rights. There was an exploit with Symantec AV that a researcher found, when he emailed the sample code to Symantec to alert them it actually brought down their email servers because they were protected by their own AV: https://www.wired.com/2016/06/symantecs-woes-expose-antivirus-software-security-gaps/

 

[KIA]

The Security Impact of HTTPS Interception

As HTTPS deployment grows, [corporate] middlebox and antivirus products are increasingly intercepting TLS connections to retain visibility into network traffic. In this work, we present a comprehensive study on the prevalence and impact of HTTPS interception. First, we show that web servers can detect interception by identifying a mismatch between the HTTP User-Agent header and TLS client behavior. [In other words, current TLS interceptors are not bothering to mask their presence... though they certainly could.] We characterize the TLS handshakes of major browsers and popular interception products, which we use to build a set of heuristics to detect interception and identify the responsible product. We deploy these heuristics at three large network providers: (1) Mozilla Firefox update servers, (2) a set of popular e-commerce sites, and (3) the Cloudflare content distribution network. We find more than an order of magnitude more interception than previously estimated and with dramatic impact on connection security. To understand why security suffers, we investigate popular middleboxes and clientside security software, finding that nearly all reduce connection security and many introduce severe vulnerabilities. Drawing on our measurements, we conclude with a discussion on recent proposals to safely monitor HTTPS and recommendations for the security community.

https://jhalderm.com/pub/papers/interception-ndss17.pdf

 

[jpaul]

The Australian Signals Directorate (their version of the NSA) has some great advice, what they call the Essential Eight:

1. Application Whitelisting
2. Patch Applications
3. Restrict Admin Privileges
4. Patch Operating Systems
5. Disable untrusted MS Office macros
6. User application hardening (i.e. block Flash, web ads and Java in the browser)
7. Multi-factor authentication
8. Daily backup

Of those, whitelisting is by far the most effective method for preventing malware attacks but there isn't really a good solution for that for home users that I know of.
..

Do you have a reference for 'application whitelisting' - for home user do you mean only installing software for which you have checked provenance and validated checksum's ? (if you have satisfied 4/5/6 it should not be easy for undesired applications to be introduced in other manners)

 

[El Pew]

Do you have a reference for 'application whitelisting' - for home user do you mean only installing software for which you have checked provenance and validated checksum's ? (if you have satisfied 4/5/6 it should not be easy for undesired applications to be introduced in other manners)

What do you mean by 'reference'?

Application whitelisting typically requires a piece of software, an agent of some kind, that runs on the desktop. The idea is that it stops any piece of software running that hasn't been pre-approved - so you could whitelist Word, Excel, Chrome etc, or maybe whitelist any app signed by Microsoft or Google to give you a broader range of usable apps. So when "ACME Ransomware" tries to run, it's not on the whitelist, so the whitelisting agent blocks it.

It's more effective than AV because you don't need to know what the malware looks like in advance using signatures or whatever, you just stop anything running that isn't explicitly trusted.

 

[jpaul]

Thanks, the word 'reference' was vague - I meant the document that showed relative merits of application whitelisting,
and maybe addressed its relevance/practicality for home use.

I see here, for example, that MS has a Applocker product exclusively for servers.
In the 'chip' development business we are not using a whitelister afaik, rather app security relies on strict rules for having any apps validated by IT, plus records of what individuals are accessing/downloading.
I think such engineers are disciplined versus say a general commerical office. (albeit the stuxnet virus found its way into an engineering environment)

 

[El Pew]

Thanks, the word 'reference' was vague - I meant the document that showed relative merits of application whitelisting,
and maybe addressed its relevance/practicality for home use.

I see here, for example, that MS has a Applocker product exclusively for servers.

AppLocker is a good example in the server space. There are some good enterprise desktop solutions as well, but nothing really available for home users as of yet that I know of.

In the 'chip' development business we are not using a whitelister afaik, rather app security relies on strict rules for having any apps validated by IT, plus records of what individuals are accessing/downloading.
I think such engineers are disciplined versus say a general commerical office. (albeit the stuxnet virus found its way into an engineering environment)

I think you're giving your engineers too much credit! Also, sometimes it's not about how careful your users are, there are a number of attacks that can be executed without the user's knowledge - I think someone already mentioned the examples of malware embedded in advertisements on big-name sites like the NYT. You can also be subject to a cross-site scripting attack which again might affect a 'trusted' site. If you have a compliance requirement, telling the regulator that your users are more disciplined probably isn't going to wash.

 

[uncle_rufus]

Interesting discussion... I use Sophos AV because my work provide me it for free and it seems pretty good...

It has flagged things a few times - as discussed above I've navigated to what I'd have considered "trusted" pages such as news sites, or even on one occasion this very forum and had it flag that it had detected some sort of unexpected/illegal instruction being issued by the page. I think Sophos uses some sort of "on-access" method, which I was initially worried would be a performance hog but however it's doing it seems to have little to no impact (that I can tell anyway)

 

[smogsy]

I'm pretty confident in my surfing abilities tbh.

Rule 1. Don't download anything stupid.
Rule 2. If you are going to download something stupid read reviews and from a decent source.
Rule 3. Don't give access to other users to be able to install software.
Rule 4. Get a legit looking but suspicious email with a zip file. Delete it.

You have to be a moron to install a virus on your computer tbh, especially if your on a forum like this with more technically advanced users.

I don't even run a firewall on my home router, who would want to hack me and for what gain?

Same goes for virus software. I don't run any. Only had 1 virus in about 20 years and that was because I ordered a package and got an email about a package from parcelforce, it looked legit and it was only until I had downloaded the attachment and clicked on it I had realised parcelforce would never send an attachment unless it was a pdf and not use the dodgy one I had been sent. They would send you a link to their site where you input your tracking number to then deal with said parcel. it's common sense however I was in a rush and never thought about it. If I had it would have stared me in the face it was a bogus email. That was a long long time ago.

After that 1 mistake I formatted and learnt from it.

OK

• You visit a Site, it has a hijacked .Png file that contains a Keylogger (very easy to implement), andantech & many other reputatble sites have had infected files on.

Rule 1,2,3 are void , now what?

 

[Psycho Sonny]

OK

• You visit a Site, it has a hijacked .Png file that contains a Keylogger (very easy to implement), andantech & many other reputatble sites have had infected files on.

Rule 1,2,3 are void , now what?

Will an antivirus stop that from infecting your computer?

 

[KIA]

OK

• You visit a Site, it has a hijacked .Png file that contains a Keylogger (very easy to implement)

How does the "hijacked .Png" infect the machine?

 

[smogsy]

Will an antivirus stop that from infecting your computer?

yes, now days. Google blocks sites with virsuses injected into their pages, but they do not catch them all & can take days to alert. now days AV like Eset/Kaspersky have their reputation stats which are done by day/month/year & they all check Files/Images as they are downloading

How does the "hijacked .Png" infect the machine?

Its possible to inject Keyloggers/Trojans another malware into Jpgs/png files. Then once loaded or read they "can" execute the code. it was one of the ways people was infecting .PDF files with trojans it was Jpegs inside the .PDF. but it can exexcute inside a browser

this is why UAC is so important. it can block unauthorized access to areas trojan may want to hide itself

And to make things more crazy, This means any site you visit could infect you. EVEN OCUK through signatures. Have a nice day!

 

[uncle_rufus]

And to make things more crazy, This means any site you visit could infect you. EVEN OCUK through signatures. Have a nice day!

This is true - like I mentioned above I've had my A/V suddenly light up when loading certain threads on here before; I imagine it's more likely with sigs made via sig generators (like the steam ones some of us, myself included use) because you ultimately can't be totally sure that the site generating the sigs isn't compromised

 

[KIA]

And to make things more crazy, This means any site you visit could infect you. EVEN OCUK through signatures.

Browser 0days in the wild are incredibly rare, so this scenario is very unlikely to take place.

Attacks against browsers and plug-ins aren't as lucrative as they used to be because vulnerabilities can be patched in a matter of days. Java web plug-in & Silverlight are almost dead, with Flash not far behind.

In my opinion, the one to watch is ransomware.

 

[CaptainCrash]

AppLocker is a good example in the server space. There are some good enterprise desktop solutions as well, but nothing really available for home users as of yet that I know of.

If only Microsoft would come up with a basic easy-to-use system for home users that stops untrusted executable code from running with admin privileges until it's been explicitly authorised to do so...

 

[opethdisciple]

If only Microsoft would come up with a basic easy-to-use system for home users that stops untrusted executable code from running with admin privileges until it's been explicitly authorised to do so...

Is this sarcasm?

UAC.

Also technically we should not be using user profiles that have admin privileges. (Including me)

We should need to use like a 'sudo' to gain admin privileges.