Virus and Spyware Threat is Larger Than Ever Before - Anti-Virus Companies Struggle to Keep Up with Flood of Spyware - Part 2
Thanks for visiting Tech-Bitz.com, you may want to subscribe to my RSS feed in order to stay up to date with all the latest news, reviews and how-to guides
In Part 1 of this article - Virus and Spyware Threat is Larger Than Ever Before - Anti-Virus Companies Struggle to Keep Up with Flood of Spyware - we talked about the ever increasing threat posed by malware, spyware and viruses.
Today we will be talking about what different anti-spyware companies are doing in order to fight this threat.
Why The Techniques of the Past Will Not Work Anymore
In order to understand exactly what these companies are doing today, we must first look at what they have done in the past to combat spyware and viruses.
In the past anti-virus and anti-spyware companies have always taken the malicious software, be it spyware, viruses, trojan horse programs, etc. decoded it and determined what made it unique, and then how to remove it from a system.
Every piece of malware is unique, just like a fingerprint, they all have a signature that, when analyzed will allow software companies to tell a ‘good’ software program from the ‘bad’.
In order to recognize these programs, anti-virus companies typically fought the invaders just like the human immune system. They would distribute copies of the virus ’signature’ to subscribers who had their
anti-virus/anti-spyware programs installed and that would build up the ‘library’ of known virus programs.
When the individual computer receives or downloads a program or piece of software from a disk, network, email or Internet connection the files would be compared to these ’signatures’. If a match was found in the library of known malicious software, then the file could be quarantined or destroyed before it could do any harm to the computer system that anti-virus program was defending.
That is why a good anti-malware program will constantly update itself whenever an Internet connection is made. Because their protection is only as good as that software library of known viruses or spyware.
This approach has worked very well in the past, when software companies such as McAffee, Norton, Symantec, Webroot, etc. would have the time necessary to break down and analyze each and every malicious software program, and then come up with a ’signature’ that could then be included in the next batch of library or definition updates.
The problem that these companies are now facing is much more fluid and dynamic. Just as armorers and inventors of the past constantly increased the effectiveness and deadliness of their weapons, the weapons evolved from arrows and spears to cannon and black powder muskets, now todway we have balistic missile submarines and stealth fighter jets.
The programmers that are releasing viruses and spyware today are doing the same thing as the armorers and inventors of old. They are improving not only the efficiency of the viruses and trojan horses, but also their stealth capabilities. Only at a significantly increased pace.
The attackers have also found a serious vulnerability in the system that anti-malware companies have used to detect and combat their programs in the past.
The attacking programmers have begun turning their malware programs into changelings, able to update themselves and change their signature as rapidly as anti-spyware companies release their updates.
With a different signature, the traditional anti-spyware software simply can’t ’see’ the virus or spywware for what it is and let it go past undetected. The scary part is that the spyware and worms that are being released have been programmed to change their signature on their own, and it only takes a slight change in order to make the anti-virus programs of the past totally ineffective.
This in part accounts for the vastly increased levels of spyware encountered in the past several years. In the graph below, part of the increase can be accounted for because each time the virus of spyware ‘changes’ it signature, it is counted as a completely new and different threat. As can be seen in the graph below (click for larger image).
This is how you end up with spyware or worms with names like Melissa-A, Melissa-B, Melissa-Ab, and so on, each variation is counted as a completely new threat, even though it is basically the same virus or worm with a slightly changed signature, which in turn forces companies like McAffee and Norton to break down, analyze and release updates for each variation.
This large increase in the sheer number of spyware threats and their variations have forced sofware companies to change the way that they fight the attackers. Much like castle builders evolved higher walls and improved defenses as attackers went from simple catapaults to cannons.
A New Technique is Developed for a New Threat
The ways that anti-spyware companies have come up with in order to battle this new threat and to keep from becomming swamped with the overwhelming numbers of new viruses and other programs is two-fold.
First - They have increased the hardware and manpower available to analyzed and sort out the new viruses. This allows them to lighten the load on servers used to analyze and sort the programs, and more manpower allows more library definitions to become available at a faster rate.
Second - The companies are also getting away from the method of trying to combat each and every new threat and variation of that threat with a specific library definition.
Just as the attackers have used better programming to develop malicious software that can change form.
Software companies are using programs that can recognize multiple threats using a more ‘generic’ version of the definitions.
This new method of spyware recognition is called ‘Heuristic Programming’, basically what this means is that instead of having to provide the anti-virus or anti-spyware program with a specific list of definitions or libray entries, the software companies basically ‘teach’ the software how to recognize patterns in certain types of malicious software. The anti-virus programs can then recognize multiple types of programs as dangerous from one defintion.
This can lead to some unintended consequences however. As definitions become more and more generic in order to combat more and more threats, the number of ‘false postives’ increase significantly.
False-positives can result in ’safe’ programs and applications being recognized as dangerous malware.
The anti-virus software can then attack the ‘good’ software and cause significant damage to applications and operating systems. There have been several reports in the past several years of anti-spyware programs recognizing Windows Operating System components and programs as ‘dangerous’ and a few mouse clicks later, can cripple or even destroy entire operating systems, which results in the entire operating system and all associated programs needing to be reinstalled.
So what are we as consumers and computer users supposed to do about this situation?
Check back here at Tech-Bitz.com later for the third and final part of this article series where we will discuss what the future holds and how we can join the fight to keep our computers running clean even with the increased number of threats on the Internet.
1 Comment »
Filed under: Internet, Security, Spyware Watch
used as Trojan Horses as well as Fake Download Speed Boosters,
