PC Stuff Made Dead Simple

Conficker and Swine Flu

What do they have in common?

 

The Pig that Flew

Both threats have been vastly exaggerated by the media, and by the authorities

charged with internet security and public health respectively. Early in May, the

World Health Organisation was ready to declare the Swine Flu a full-on pandemic. At

the time, the tally was 19 confirmed deaths world-wide, and some 800 infections.

It turned out to be just another flu, yet Australia’s stocks of antiviral drugs were

exhausted before the country recorded a single case of swine flu. Our Health Minister

had to order more Tamiflu and Relenza from drug makers doing summersaults

all the way to the bank. In the first two months, 100 people died from the swine flu

worldwide. In any two months, 600 people die from ordinary flu in Australia alone.

 

The Worm that Grew Legs

Conficker turned out to be just another worm, despite headlines like ‘Conficker worm threatens April Fools' chaos’, accompanied by the picture on the right. ‘World waits as Conficker worms into action’ was another.

 

 

 

No, it wasn’t just the media, as youcan see from headlines like ‘Conficker's next move a mystery to researchers,’ with the by-line 'Impossible to know what massive botnet will do April 1, researchers say.’

 

Experts Clueless, Public Panics

The massive botnet was already 8 million strong, according to security software

vendor F-Secure, and still growing strong. ‘Security researchers are in the dark,’ Computerworld’s Greg Keizer wrote on March 24, ‘about what will happen next week when the newest variant of Conficker, 2009's biggest worm by a mile, begins trying to contact its controllers.’

As the worm reportedly infiltrated the French government’s naval systems – forcing

the French to ground their warplanes – and the British Parliament’s computer

network, experts were aghast at the breadth of the worm’s reach. Soon, there were

hushed warnings of an impending ‘digital Pearl Harbor.’

In an unprecedented move, malware researchers teamed up to fight the worm, and Microsoft put a US$250,000 on the gang’s heads, saying it wasn’t prepared to ‘sit back and let this kind of activity go unchecked.’

Just why these experts couldn’t figure out what this worm would do, despite using

harvested samples to infect their test PCs and observing their behaviour, is a very

good question. It’s obvious that they didn’t have a clue and decided to play it safe

like the WHO with the swine flu – better safe than sorry, right?

 

The Things that Panic Us

Bruce Schneier, a down-to-earth security expert, said that Conficker's 1 April

deadline was just the kind of event humans tend to overreact to. ‘It's a specific

threat, which convinces us that it's credible. It's a specific date, which focuses our

fear. Our natural tendency to exaggerate makes it more spectacular, which further

increases our fear. Its repetition by the media makes it even easier to bring to

mind. As the story becomes more vivid, it becomes more convincing.’

http://www.guardian.co.uk/technology/2009/apr/23/conficker-panic

We know that humans fear things they can’t see and can’t understand more than anything else. The graph below shows it clearly: it charts the media coverage of various topic over the past decade, and the biggest peaks here are all about the smallest things - from left to right: the Y2K bug, SARS, Bird Flu and Swine Flu.

 

 Courtesy of http://www.informationisbeautiful.net/2009/mountains-out-of-molehills/

 

The Y2K bug cost the commercial world $250 billion dollars and was a fizzer. SARS was another fizzer. Bird Flu really saw the media go nuts with doomsday scenarios but it fizzed too.

 

The Morning After

April 1 passed without incident, but the panic merchants never missed a beat. Now we had the experts and security vendors telling us that this did not mean Conficker was no longer a threat. The public can be gullible but for a rare moment, it got a glimpse of what the PC security business really is: a giant scam. A recession-proof giant scam because people think they shouldn’t skimp on security any more than they should skimp on the tyres of the family car.

The companies who make so much money from security software and services, and all the experts who make a good living from the bits they pick off the vendors’ backs like those birds that feed on Rhinos, have a vested interest in keeping us permanently panicked. In that state, we’ll renew that licence when it runs out next month and gladly pay the price.

Long ago, the anti-malware industry seized on medical and pandemic terms to engender the right kind of panic in PC users. The media went along with it because panic was good for their business too. We had outbreaks, infections that spread like wildfire, bugs that replicated and others that sat tight and ticked away like time bombs. We even had antivirus vendors selling us antibiotics – remember PC-cillin from Trend Micro?

And just in case some punters relaxed when conficker fizzed, Computerworld warned: ‘Mainstream media hype leading up to the Conficker worm's April 1 software update may have distracted people from legitimate cyber threats, the U.S. Federal Bureau of Investigation's head of cyber security said Thursday.’

http://www.computerworld.com.au/article/300670/conficker_hype_problem_says_fbi_cyberchief?eid=-6787

 

Never say Die

The worm refused to go away, though, or perhaps the security experts didn’t want to let it die. While the hype slowed dramatically after April 1, much like it did in the days after we entered a new millennium when the forecast catastrophe failed to eventuate, the worm kept turning. ‘Conficker Worm Still Lurking, Threat Remains,’ said a June 29 2009 headline.

A month later, at the Black Hat security conference in Las Vegas, an F-Secure virus researcher stirred the pot again. ‘The gang behind Conficker are no fools,’ said Mikko Hypponen. ‘They know their stuff, they know coding, development cycles, crypto and they are clever and they are watching us, their enemy in the security industry.’ Needless to say, the IT media jumped on the story hoping to retrieve some of their damaged reputation. The swine flu did a lot better in the same period, with the case load growing rapidly across Australia, which soon had the Health Minister warning that the worst case scenario death toll could be as high as 6,000. One expert said it could exceed 10,000 unless a vaccine became available.

By early August, with spring temperatures rising across the country, the nationwide death toll stood at 74 and the more responsible reporters conceded that the victims had died ‘with’ the swine flu, not from it.

 

The New Year

You guessed it: conficker is alive and well, at least in the minds of the malware industry. Dire warnings persist that the worm will do even more damage in 2010 http://www.net-security.org/malware_news.php?id=1154.

Here’s an example of the kind of stuff they sprout: ‘Although mainstream and industry media coverage of the Conficker worm and its variants has dropped significantly since peaking in the second quarter, it is clear from this data that the worm (and its variants) is apparently still quite active, searching out new systems to infect," Akamai said in its State of the Internet report for the third quarter of 2009, released Thursday. http://www.networkworld.com/news/2010/011510-conficker-worm-hasnt-gone-away.html. And here’s another story along the same lines:

http://www.spamfighter.com/News-13667-Conficker-Expects-to-Dominate-Botnets-and-Malware-in-2010.htm. For the anti-malware industry, conficker is just too good to let go.

The same applies to the antiviral and vaccine industries who won’t let go of the swine flu. This is the highest count I can find for total cases and deaths due to swine flu:

 

 

 http://www.flucount.org/

 

The numbers look pretty serious until you look at the case load and annual death rate of the ordinary flu, which costs 35,000 lives in the USA every year (mostly among people of old age or those with compromised health). In Australia, where a figure of 10,000 was bandied around for the swine flu, it never got past 200 victims.

 

The Bottom Line

Don’t pay more attention to the media or the experts than they deserve. Take it from me: antivirals are a waste of time and money, that’s why vaccines are so important when protection from viruses is the issue. Of course governments know that. They merely buy truck loads of antivirals because they think we don’t know. Then they stand up there and tell us that they have stockpiled the drugs, and that there’s no need to panic. Just don’t ask any questions, please.

Keeping your PC healthy is a lot easier, thankfully. Install decent Internet security software and spam filters, tighten up your browsers, put a canary on them as we suggest in Travel Safely Online. Grab a Free Guide http://bit.ly/Pljwy .

And make sure that you and your staff follow the road safety rules when you’re out on the internet highway. We have a few resources for you on these subjects here: http://www.technoledge.com.au/resources-straighttalk.htm

And if you’re worried that you might have caught this bug, known as Conficker or Downandup, here’s a simple way to find out for sure: go to the first link below and run the free Sophos endpoint assessment test, which will identify any security issues on your PCs http://www.sophos.com/products/free-tools/sophos-endpoint-assessment-test.html

If it looks like one of your PCs has caught the bug, here’s a free removal tool from the same source http://www.sophos.com/products/free-tools/conficker-removal-tool.html

 

Remember: They’re just trying to scare you into buying more stuff.

Internet Security in 2010

Glasnost in internet security suite testing?

 

For years now, we’ve relied on AV-Comparatives to provide reliable guidance on anti-malware products. The lab has a tradition of naming winners at the end of the year, and it has just done so for 2009. The top gong went to Symantec, which does not sit well with those of us who grew up with Norton and watched it put on so much flab that it weighed down any PC, regardless of hardware muscle.

The crushing weight was one turn-off, another was a set of manners that recalled high-ranking Nazis in old movies. You vill vait until I’m finished, you will reboot now, you will get your turn when I say so. For an entertaining read of what life was like with Norton then, check In the Grip of Security – a user’s vain attempts to reason with the antivirus mafia http://www.technoledge.com.au/pdfs/grip_of_security.pdf

 

Back to the Future

When you’ve stopped laughing, come back here and catch up on the current state of play in Internet Security. We ended up using ESET once we got rid of Norton and diced with a few others, and ESET NOD32 was AV-Comparative’s winner in 2007. It was a close runner-up to Avira in 2008, and Avira is one of the best security products. This year, Avira dropped out of the top 3.

The ratings are a compound of results in various tests over the period of a year. The more Advanced + ratings an AV gets, the higher it ranks.

 

 
  

Using that system, Norton comes out on top, followed by Kaspersky and ESET, followed by Bitdefender and F-Secure. The lab makes the point that all the products it tests are decent, since really poor performers – big names like Trend Micro and CA among them – aren’t even included in these comparative tests.

These results here are a remix of my last piece on this subject with quite a twist: I averaged the last 3 tests and came up with GData, Avira and eTrust as the top 3 – check the previous post on my blog http://briard.typepad.com/pc_stuff_made_dead_simple/. I also wonder how Microsoft topped several of the sub-categories. For the full report, click on ‘Summary Report 2009’ in the top right-hand corner at http://www.av-comparatives.org/ .

 

Real world testing

The last couple of years have seen a number of security analysts chastise the AV-software industry for arranging tests that only a fool wouldn’t pass since even the so-called ‘in-the-wild’ list of malware was published to each participating company beforehand. All they had to do was to ensure that they had every gremlin covered.

Pressure mounted on test labs to introduce real-world testing that would pitch security suites against a more realistic mix of malware and also evaluate its user interface and effect on PC performance. AV-Test.org was the first major lab to attempt such a test. Results courtesy of http://www.pcmag.com/article2/0,2817,2357347,00.asp  

MALWARE BLOCKING RATES AND WARNING MESSAGES (FALSE ALARMS)

Tested Product	Malware Blocked	False Alarms
PC Tools Internet Security 2010	94.8%	none
Symantec Norton Internet Security 2010	92.8%	none
Kaspersky Internet Security 2010	89.8%	few
Panda Internet Security 2010	88.7%	none
Avira Premium Security Suite 9.0	87.2%	none
McAfee Internet Security 2010	86.7%	none
AVG Internet Security 9.0	84.2%	few
G Data Internet Security 2010	83.0%	few
Trend Micro Internet Security 2010	81.3%	few
F-Secure Internet Security 2010	80.2%	none
BitDefender Internet Security 2010	77.8%	none
CA Internet Security 2010	73.5%	none

 

The lab analysed each product's ability to detect threat and block their installation, regardless of the protection mechanisms employed. This is a better idea than testing the on-demand scanner alone, or a product’s heuristic detection ability.

This kind of dynamic testing should be more representative, and AV-Comparatives had a go at it as well late last year with what they called a ‘Whole Product Dynamic Test’ (the link is on their website in the same corner as the 2009 summary report). Symantec, Kaspersky and Avira are the top 3 here, with 97 to 99 out of 100 threats blocked. The next bunch is made up of Microsoft Security Essentials (!?), Avast, Gdata, F-Secure, ESET and Bitdefender. McAfee is the big loser here, managing just 86 blocked threats.

 

Real world Questions

The results aren't exactly consistent with AV-Test.Org, where MacAfee rates poorly but is ahead of Bitdefender and F-Secure, who're solid top-six performers in almost any other test. For Trend Micro to be ahead of them in blocking threats is ludicrous enough, but now we have an ad from TM boasting that it’s come first in a ‘real-world’ test (that would be a first indeed) http://apac.trendmicro.com/apac/competitive-benchmarks/ .

NSS is a new lab that uses a ‘Live-in-the Cloud’ test framework to focus on testing how well Internet Security suites protect from web-based threats. The results make the mind boggle:

 

 
The only thing that is sillier than for Trend Micro to come first is for ESET to come last. I happen to know that Rick Moy, the head honcho at NSS labs, used to head up ESET in the USA. Perhaps they didn’t part company amicably. I’m not suggesting anything but the folks at ESET tell me that NSS didn't follow the AMTSO standards and refused to publish the testing methodology and malware samples they used. Whatever the facts, these results make no sense in any known context, and NSS has no track record of any kind, so it's safe to ignore them for the present time.

 

Can Elephants Really Learn to Dance?

Symantec has claimed for some time now that it listened to its users (how many years did it take?) and redesigned Norton IS to float like a butterfly, but most of us didn’t believe it. That Symantec (with McAfee) was fined millions last year for ‘auto-renewing’ annual licences without their users’ approval didn’t endear the company to us either. That clause was buried deep in the EULA. Sleazy.

Neil Rubenking at PC Magazine has been testing AVs since he was a callow youth. His long term support of Norton has troubled me, but Neil’s reputation as the eminence grise of AV-testers cannot be ignored. Here’s his take on IS suites http://www.pcmag.com/article2/0,2817,2351871,00.asp .

With AV-Test.Org, AV-Comparatives and Neil Rubenking all singing the praises of Norton IS 2010, and waxing lyrical about its light hand and velvet footprint, I began to wonder whether Norton could really have changed so much.

 

There’s one way to find out

The Norton IS trial on offer at the company’s website is an opt-out trial. What’s an opt-out trial? You have to opt out before the 30 days are up or they’ll charge your credit card. I'm getting annoyed already, find a trial on the PC Authority website for 60 days without sleaze attached and download the software. Symantec bugs me as soon as it’s installed and I’ve activated the account. Yes, it bugs me to buy NIS 2010 3 seconds into the trial. We’ve gone from sleazy to dumb. Great marketing, Symantec.

The rest of it? It’s a different product from the one I likened to the Mafia - it seems that elephants can be taught to dance after all, but leopards can’t change their spots. The first giveaway is the 100mb download yet the install is fast and free from all those enforced reboots and updates that used to make us froth at the mouth. There are 25mb of updates to come but their installation is slick as well. The quick scan it offers takes just minutes and finds 66 tracking cookies.

NIS 2010 takes a quiet backseat while I buzz around online, and the interface is much improved as well, with the ‘Settings’ option bringing up more detailed panels that let you tweak just about everything to your heart’s content.

 

 
Boot times on my test Vista laptop are 10-20 seconds slower than with Bitdefender, the previous bodyguard. Bitdefender was already 20 seconds slower than ESET but took up only around 20mb of RAM once it settled down. NIS 2010 shows two components running in RAM, one taking between 60 and 130mb depending on whether its idle or doing something, and another taking between 25 and 45mb.

That’s quite a hit for an IS suite that isn’t doing much, and you wouldn’t know unless you looked for the ballast over the side of the ship. It's a surprise then that there’s no drag when you work (at least not on my 2.5gb RAM dual core laptop), the updates are fast, the spam filter is accurate right out of the box and doesn’t make a mess of Windows Mail.

 

Would I buy it?

No. It’s a vastly improved product, top-ranked by several reputable labs or testers. And I could buy 6 copies for all the PCs in our office and have plenty of change left over from $100, but I wouldn’t do that. I don’t like the company and its sleazy tactics, and I’d much rather support a smaller company like Bitdefender, ESET or Avira.

Reality check: I've said it before, and you can see it from the lists above and the one below: no single solution can keep you safe from all harm, and that 2% gap is enough to let in plenty of evil spirits. You’d be mad to rely on any single security solution. That’s why we run and recommend a good IS suite together with Intrusion Protection software like PREVX-3 or Threatfire.

Neil Rubenking produced this last graph a few months back when he tested the ability of Internet Security suites to block and remove spyware.

 

 
Fall-Out

A few interesting points come out of this diagram:

§    The dedicated spycatchers (Webroot, Spyware Doctor) don’t block spyware as well as the best IS suites (NIS 2010 and Bitdefender 2010)

§    These results are not at all consistent with those listed above for AV-Test.Org

§    Kaspersky and Microsoft Security Essentials fare pretty badly with spyware here

§    Malwarebytes Anti-Malware clearly gave neil all kinds of problems

§    NIS 2010 turns in better results than Norton 360. How can that be?

§    The gaps for evil sprits to creep through are 4 - 6% with the best products, so I repeat the previous advice: use two solutions of different types.

A product like PREVX3 may produce numerically similar results as NIS, but it works in a very different way and will catch stuff the other misses and vice-versa. Add a website checker like WOT and you might get close to 100% protection, especially if you use common sense when working online.