Reform the A/V Industry!

Renderman, 01/13/00
www.antiav.com
RenderMan@antiav.com

The year was 1988 and a young graduate student named Robert Morris Jr. released a self replicating program onto the internet to show off various holes in system security. Unfortunately when playing with fire, you can get burned. The Program was supposed to only copy itself to a system once, but due to some errors in calculating the probable infection rate, the program replicated itself multiple times on each host on the network causing ever increasing system loads and eventual system crashes. This was the first internet panic over a "worm", but would not be the last. In future years, the Michaelangelo virus, Win95.CIH, and Melissa to name a few, spread fear rapidly across the net. Anti-Virus company media men following in hot pursuit of each.

It used to be easy for the Anti-Virus vendors. Anything that was self replicating and/or caused damage was a virus and must be hunted down and destroyed. It was easy, the enemy all wore the same uniform. Though some were snipers waiting for a specific target and a specific time. Other Viruses were experts at camouflage that could stay undetected for months in the wild before being flushed out, but they were all of the same army. Now it's not so easy.

If you look at the anti-virus industry today, they seem to be taking on the jobs of security cure all. As Weld Pond mentioned in his Buffer Overflow article on 12/20/99, "The scanners are scanning for more and more software that does not contain virus or trojan code". This is becoming more epidemic.

Who remembers the case of Netbus? In February '99 Netbus released version 2.0 to the public as shareware. They removed many of the stealth features and changed it's functionality so it was no longer a trojan horse but an actual product from an actual company. It even achieved a 5 cow rating on Tucows when released.

Well, about a month later, the A/V industry started listing this new version of Netbus as a trojan, this action prompted Tucows to remove Netbus 2.0 even after it gave it's 5 cow approval. Ultraaccess.net, the makers of Netbus, tried to talk to the A/V vendors after it was listed, most would not even return their phone calls. Panda was the only one to respond in any fashion to ultraaccess.net. Data fellows and a few other vendors didn't list it until the big vendors and "customer response" prompted them to add it to their definitions. Ultraaccess.net is not a large company, they have however, hired a lawyer and are trying to get all their legal material together for their next version release sometime in spring next year, but it appears to be an up-hill battle. (Thanks go to Judd Spence at Ultraaccess for providing me with the history of Netbus.)

Another example of the A/V vendors logic is L0phtcrack. L0phtcrack was released in 1997 and the latest version in January 1999. It has since become one of the premier tools for NT password auditing. L0phtcrack was recently listed as a trojan by one company then others started adding similar descriptions. A/V vendors follow each other on their latest listings, when one company lists a new piece of code, all the others just copy it, as was mentioned by Weld Pond on NTBugtraq (http://www.ntbugtraq.com/default.asp?pid=36&sid=1&A2=ind9912&L=ntbugtraq&F=&S=&P=5026). So if one company doesn't like your product they can have it added to their definitions and all the other ducks fall into a row and list the same program blindly.

These situations sound like classic David vs. Goliath battles of the little developer being quashed by big business. With certain A/V producers also having remote administration products, does this not seem like a major conflict of interest? What is to keep them from listing the competition with muddy descriptions as virii and trojans to scare and annoy the customer into using their product? In talking to various security scanner companies I kept hearing the same situation with Netbus; clients had bought and paid for it, but their A/V package was constantly deleting it. What sane person is going to disable their virus protection so they can run a program? Not a very good plan. This usually has the effect of forcing the person to change remote administration tools to one of the big names or to change A/V packages, but since all the vendors share definitions your going to have the same problem. This can severely hurt small business with products like Netbus if their clients are getting frightened with virus warnings. Yet, equally featured products are never given a second glance.

If you feel your software was erroneously listed, there is very little recourse in trying to talk to the companies to have some action taken. The big vendors haven't returned Ultraaccess.net's phone calls and the smaller vendors follow the definitions of the big boys. So even if you successfully remove yourself from one package, one has to go to each vendor and plead your case all over again. The A/V industry seems almost like a monopoly that can do what it wants and list anything with impunity, always falling back on the excuse of "customer demand" (though this is how many programs get on the list in the first place, but it's hard to verify if it's a legitimate response or a conjured up one). It's gotten to the point where the industry can make or break products.

With big companies like Symantec and NAI that have interests in other products of their own, I can't believe that they aren't abusing the public trust to leverage their own products in the marketplace. Again, as Weld Pond pointed out in his Buffer Overflow article "Symantec's Norton AntiVirus will scan for the remote control programs, NetBus or BO2K, but not the company's own PC Anywhere. Network Associates' McAfee VirusScan will detect the NT password auditing tool, L0phtCrack, but will not detect the company's own vulnerability auditing tool, Cybercop scanner, or their network sniffers, Sniffer Basic or Sniffer Pro". If this is not using your product to force another, I don't know what is.

The A/V industry is very necessary, but has gotten too complex for it to continue in the current state. In the very near future, any product that can be misused to any tiny degree will be listed, and what recourse will companies have to protect themselves from the abuses by the industry?

I propose an agency, commission, organization, board, watchdog group or something that all A/V vendors are a part of and follow the decisions of, so you only have to appeal your case to one group to clear your products name. A sort of better business bureau for the industry. Many A/V vendors belong to various Internet Security Bodies but there is no body for Anti-Virus.

I also suggest a fourth category, separate from virus, worm or trojan. A category of just programs, that only alerts the user that a program is present that may *possibly* be abused in some fashion. Present the user with the option to find out more information about it or acknowledge that it is supposed to be there and never bug them about it again. Nothing scares a person more than seeing INFECTED! or TROJAN! Applied to something on their computer. A less frightening dialog that gives an advisory that says there is a program on their computer that could be a vulnerability would bring some sanity to this problem. Some companies already have a similar "exclude" feature but not all do and they still throw up scary warnings. For the IT community, the ability to filter definition files not to include programs that are supposed to be there would make their lives easier, rather than having their users freaking out at the Anti-Virus warnings.

I still feel it is important that if the A/V vendors insist on detecting anything and everything that may be a malicious tool that they don't play favorites, they should list EVERYTHING, including their own products. Many of us realize the merit of these fringe programs (most of which are free) and use them in place of big named box products but don't want to have to fight with our Anti-Virus packages to use them, and should'nt have to.

People are demanding more and stranger things from their computers and sometimes it's necessary to borrow code from the book of virii and trojans to achieve this. The line has blurred between a nasty piece of code and a great product. Sometimes it's only the marketing that makes the difference.

Renderman, 01/13/00
Www.AntiAV.com
Webmaster@AntiAV.com