Top security suites fail exploit tests
12 suites get 'F'; Only Symantec's detects more than 3% of real attacks
Computerworld - Security software suites don't protect users from real-world exploits, a bug-tracking company charged today after launching 300 test attacks against a dozen programs, including popular software from McAfee Inc., Symantec Corp. and Trend Micro Inc.
"The Internet security suites are marketing themselves as the one solution users need to be safe online," said Thomas Kristensen, chief technology officer at Secunia Inc., which ran the tests. "In our opinion, that's just not true."
Secunia sicced hundreds of vulnerability exploits -- some proof-of-concept code that triggered a vulnerability, others that included payloads -- on 12 suites, including Symantec's Norton Internet Security 2009, Microsoft Corp.'s Windows Live OneCare, AVG Technologies' Internet Security 8.0 and McAfee's Internet Security Suite 2009. The attack code was delivered by files of various formats, including Office documents and malformed images, and by malicious Web sites that triggered browser and ActiveX bugs. The target was a Windows XP SP2 machine missing "certain patches and with a number of vulnerable programs," according to Secunia.
While Symantec's Norton Internet Security 2009 took top honors, it detected only 64 out of 300 exploits, or just 21% of the total. Even so, that beat most rivals by substantial margins. Trend Micro's Internet Security 2008, for example, detected only 2.3% of the exploits, while McAfee's Internet Security Suite 2009 identified 2% and Microsoft's OneCare spotted just 1.8% of the exploits.
The reason why current security suites had such trouble detecting the 300 exploits, Kristensen explained, is that antivirus software vendors are geared toward cranking out signatures for hacker payloads: the worms, Trojan horses and spyware that are identified in the wild, given names and then spotted by adding a new detection "fingerprint" to the software.
"They don't focus on detecting vulnerabilities, they focus on detecting the payload," Kristensen said. "But the problem with detecting the payload is that you're always behind [the hackers]. It's easy for the bad guys to create a new payload that's not detected by the scanning mechanisms and current signatures."
In order to craft a signature for a specific payload, security companies must first capture a sample, analyze the malware and write a detection fingerprint. Then they must push that new signature to users. The process, said Kristensen can take hours at best and then must be repeated as soon as a new piece of malware is bundled with an exploit.
But by looking for vulnerability exploits rather than for payloads, argued Kristensen, security software could stop multiple pieces of malware with just one signature -- a more efficient defense in the long run.
"If there's a vulnerability in [Microsoft] Office and someone is exploiting that in an Office document, you'll be able to block that attack with just one signature," he said, no matter how many different payloads hackers may try to load into a vulnerable PC. "It's a much better way, we think, even though it's somewhat more time-consuming to come up with a vulnerability signature."
Although Secunia sells its vulnerability research and proof-of-concept exploits to legitimate security vendors, Kristensen maintained that was not the reason why the company tested the 12 suites. Instead, he said, the take-away should be to patch, patch promptly and patch all software, not just the operating system.
"Security software alone isn't sufficient" to protect a PC, Kristensen said. "People need to patch all their programs. Patching is absolutely necessary, and not just the main programs, but third-party software as well."
Secunia has posted a paper that describes its suite-testing procedure and lists results on its site (download PDF).
Read more about Security in Computerworld's Security Topic Center.
- Best iPhone, iPad Business Apps for 2014
- 14 Tech Conventions You Should Attend in 2014
- 10 Desktop Apps to Power Your Windows PC
- How to Add New Job Skills Without Going Back to School
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- Cybersecurity Imperatives Reinvent Your Network Security With Palo Alto Networks The Rise of CyberSecurity
- 10 Things Your Next Firewall Must do Next-Generation Firewalls Defined
- Firewall Buyers Guide Operate as the core of your network security infrastructure
- Getting Started With a Zero Trust Approach to Network Security The Traditional Approach to Network Security is Failing. View Now>>
- Live Webcast On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy...
- Live Webcast Endpoint Backup & Restore: Protect Everyone, Everywhere Arek Sokol from the bleeding-edge IT team at Genentech/Roche explains how he leverages cross-platform enterprise endpoint backup in the public cloud as part...
- Streamline Software Asset Management, Compose a software Management Symphony Keeping track of your organization's software is easy with effective software management solutions from CDW. View the videos in our software solutions channel
- Druva inSync: Endpoint Data Protection & Governance CLICK HERE to watch this video about protecting corporate data on laptops and mobile devices, sponsored by Druva. All Security White Papers | Webcasts