Consumer group slammed for creating 'test' viruses
"Why would anyone ... want to add to the glut?"
August 16, 2006 12:00 PM ETTechWorld.com -
A consumer magazine has been condemned for possibly adding to the virus problem by creating a series of "test" viruses just to review antivirus scanners.
In an act that has long been considered technical taboo, U.S. consumer affairs organization, ConsumerReports.org, decided to generate 5,500 "test" viruses to run, under lab conditions, against 12 leading antivirus software products.
The organization's own website describes the methodology used: "To pit the software against novel threats not identified on signature lists, we created 5,500 new virus variants derived from six categories of known viruses, the kind you’d most likely encounter in real life." The organization said it had enlisted the help of Independent Security Evaluators (ISE), an external consultancy located in Baltimore, to help design the tests and ensure they matched real-world conditions.
The magazine itself reckons the world's total virus population to be around the 100,000 mark, which makes the new variants a sizable increase in one fell swoop.
While the viruses are not expected to pose any threat to companies or individuals, their creation of viruses is still controversial. "The AV community has always been very strongly opposed to the creation of new malware for any purpose," said John Hawes of Virus Bulletin in a blog on the issue. "There's just no need for it - plenty of new viruses are being written all the time, why would anyone in a responsible position want to add to the glut?"
Graham Cluley, of UK-based Sophos Plc., echoed his concern. "When I read about what ConsumerReports has done I want to bash my head against a brick wall. With over 185,000 viruses in existence was it really necessary for this magazine to create 5,000 more? It's a bit like Fire Monthly Magazine testing fire stations by lighting umpteen fires around the country and seeing who is the fastest at putting them out.
"It's irresponsible behavior, and will be frowned upon by the antivirus industry. Leave antivirus testing to the independent testing bodies with expertise in the field."
David Emm, senior technology consultant at Kaspersky Lab, based in Moscow, also questioned the methodology: "It's not actually clear that Consumer Reports has created new viruses. If this is what they did … with several other test bodies who are very experienced in conducting tests, why does Consumer Reports feel the need to conduct tests themselves, especially if they do not intend to make the results publicly available?
"If, on the other hand, they did actually create new viruses, we would not approve. After all there are many, many thousands of viruses in existence already and we're adding around 200 new signatures to our database every day, why the need for someone to create new ones?" Emm said.
ConsumerReports.org is the online wing of the well-known Consumer Reports brand set up in 1993 by the publisher Consumer’s Union. The organization has so far been unavailable for comment.
Reprinted with permission from
Consumerreports.org
Additional Resources



White Papers & Webcasts
Share our Strength
Download Now
Lower the Cost and Complexity of a Mobile Workforce through Automation
Download This Resource Now!
Top 10 Things to Know about Data Protection
Download Now
Managing Mobility: Improve Data Security, Compliance and Manageability
Download This Resource Now!
Managing Secure File Transfer to Save Time, Money and IT Resources
Learn how companies are using innovative technology to overcome these challenges and improve user productivity by offloading e-mail attachments and replacing FTP with...
Ponemon Study: The Business Risk of a Lost Laptop
Download Now
Security Convergence Equals Network Security Cost Savings
Listen to IBM Internet Security Systems' take on network security convergence.
Airport Insecurity: The Case of Lost Laptops
Download Now
Disaster Recovery 2008: Reduced Costs and Improved Performance
How long can your Enterprise afford to be without your data? With an accelerated disaster recovery program, you never have to answer this...
