Just got word that apparently some popular antivirus software reports my apk downloader as ransomware. Why? Good question! But that brings me to the topic of today’s rant: what antivirus software should you use? The short answer is: use your brain, not some shitty snakeoil pretending to be able to think for you.
Using AV software is a bit like using condoms. Every “expert” tells you to, and whoever follows that advice eventually learns that it doesn’t quite work as advertised. Yet, it is impossible to get the “this product keeps me safe” myth out of people’s heads. Food for thought:
- Have you seen the banner ads by which some AV companies promote their products? Those that are styled to look like system windows informing you that you got a critter and to “click here” to remove it? What does that tell you about the business ethics of the industry?
- Why exactly should you trust a company exploiting your fears to sell you a product?
- How do you know the products works as advertised to begin with?
Let’s start with the last point. In computer science we got this pesky thing called the “halting problem“. Which states that you cannot write a computer program that is able to determine if another program will terminate. More loosely put this means you cannot write a program telling you what another program does. So how does AV software work even if it actually cannot? Well, by cheating. There are two ways to get around the halting problem: pattern/signature based recognition and heuristics.
The signature based approach is the older method and simply works by scanning a program for a sequence of bytes known to belong to a virus. This is rather trivial to implement, but has numerous problems:
- New malware gets written everyday, so you constantly need to update the signature database. This is an uphill battle and used to be a money printing machine for AV companies.
- The user is only protected from a subset of all malware.
- A pattern based scanner is easy to fool. Simple encryption will do the trick.
- The whole thing doesn’t scale well.
Those problems were already known in the DOS era and let to the the development of “heuristic engines” (back then quite a controversial idea). Heuristic engines don’t (solely) rely on pattern recognition, but also simulate a program run, watching for suspicious behavior (e.g. attempts to access system files). Heuristics allow for detecting virus variants, but they are also notorious for producing false positives (reporting a program as malicious that isn’t). Ironically, those false positives have a strong psychological effect: occasionally flagging a harmless program as malicious comes at no cost to the AV company, but gives the user the impression that his money was well spent on the anti virus software, when in fact, it wasn’t.
