Reform the A/V Industry!

Renderman, 12/28/99
www.AntiAV.com
Webmaster@AntiAV.com


	The year was 1988 and a young graduate student named Robert Morris
Jr. released a self replicating program onto the internet to show off
various holes in system security. Unfortunately when playing with fire,
you can get burned. The Program was supposed to only copy itself to a
system once, but due to some errors in calculating the probable infection
rate, the program replicated itself multiple times on each host on the
network causing ever increasing system loads and eventual system crashes.
This was the first internet panic over a "worm", but would not be the
last. In future years, the Michaelangelo virus, Win95.CIH, and Melissa to
name a few, spread fear rapidly across the net. Anti-Virus company media
men following in hot pursuit of each.

	It used to be easy for the Anti-Virus vendors. Anything that was
self replicating and/or caused damage was a virus and must be hunted down
and destroyed. It was easy, the enemy all wore the same uniform. Though
some were snipers waiting for a specific target and a specific time. Other
Viruses were experts at camouflage that could stay undetected for months
in the wild before being flushed out, but they were all of the same army.
Now it's not so easy.

	If you look at the anti-virus industry today, they seem to be
taking on the jobs of security cure all. As Weld Pond mentioned in his
Buffer Overflow article on 12/20/99, "The scanners are scanning for more
and more software that does not contain virus or trojan code". This is
becoming more epidemic.

	Who remembers the case of Netbus? In February '99 Netbus released
version 2.0 to the public as shareware. They removed many of the stealth
features and changed it's functionality so it was no longer a trojan horse
but an actual product from an actual company. It even achieved a 5 cow
rating on Tucows when released.

	Well, about a month later, the A/V industry started listing this
new version of Netbus as a trojan, this action prompted Tucows to remove
Netbus 2.0 even after it gave it's 5 cow approval. Ultraaccess.net, the
makers of Netbus, tried to talk to the A/V vendors after it was listed,
most would not even return their phone calls. Panda was the only one to
respond in any fashion to ultraaccess.net. Data fellows and a few other
vendors didn't list it until the big vendors and "customer response"
prompted them to add it to their definitions. Ultraaccess.net is not a
large company, they have however, hired a lawyer and are trying to get all
their legal material together for their next version release sometime in
spring next year, but it appears to be an up-hill battle.  (Thanks go to
Judd Spence at Ultraaccess for providing me with the history of Netbus.)

	Another example of the A/V vendors logic is L0phtcrack.  
L0phtcrack was released in 1997 and the latest version in January 1999.  
It has since become one of the premier tools for NT password auditing.
L0phtcrack was recently listed as a trojan by one company then others
started adding similar descriptions. A/V vendors follow each other on
their latest listings, when one company lists a new piece of code, all the
others just copy it, as was mentioned by Weld Pond on NTBugtraq
(http://www.ntbugtraq.com/default.asp?pid=36&sid=1&A2=ind9912&L=ntbugtraq&F=&S=&P=5026).  
So if one company doesn't like your product they can have it added to
their definitions and all the other ducks fall into a row and list the
same program blindly.

	These situations sound like classic David vs. Goliath battles of
the little developer being quashed by big business. With certain A/V
producers also having remote administration products, does this not seem
like a major conflict of interest?  What is to keep them from listing the
competition with muddy descriptions as virii and trojans to scare and
annoy the customer into using their product? In talking to various
security scanner companies I kept hearing the same situation with Netbus;
clients had bought and paid for it, but their A/V package was constantly
deleting it.  What sane person is going to disable their virus protection
so they can run a program? Not a very good plan. This usually has the
effect of forcing the person to change remote administration tools to one
of the big names or to change A/V packages, but since all the vendors
share definitions your going to have the same problem. This can severely
hurt small business with products like Netbus if their clients are getting
frightened with virus warnings. Yet, equally featured products are never
given a second glance.

	If you feel your software was erroneously listed, there is very
little recourse in trying to talk to the companies to have some action
taken. The big vendors haven't returned Ultraaccess.net's phone calls and
the smaller vendors follow the definitions of the big boys. So even if you
successfully remove yourself from one package, one has to go to each
vendor and plead your case all over again. The A/V industry seems almost
like a monopoly that can do what it wants and list anything with impunity,
always falling back on the excuse of "customer demand" (though this is how
many programs get on the list in the first place, but it's hard to verify
if it's a legitimate response or a conjured up one). It's gotten to the
point where the industry can make or break products.

	With big companies like Symantec and NAI that have interests in
other products of their own, I can't believe that they aren't abusing the
public trust to leverage their own products in the marketplace. Again, as
Weld Pond pointed out in his Buffer Overflow article "Symantec's Norton
AntiVirus will scan for the remote control programs, NetBus or BO2K, but
not the company's own PC Anywhere. Network Associates' McAfee VirusScan
will detect the NT password auditing tool, L0phtCrack, but will not detect
the company's own vulnerability auditing tool, Cybercop scanner, or their
network sniffers, Sniffer Basic or Sniffer Pro". If this is not using your
product to force another, I don't know what is.

	The A/V industry is very necessary, but has gotten too complex for
it to continue in the current state. In the very near future, any product
that can be misused to any tiny degree will be listed, and what recourse
will companies have to protect themselves from the abuses by the industry?

     I propose an agency, commission, organization, board, watchdog group
or something that all A/V vendors are a part of and follow the decisions
of, so you only have to appeal your case to one group to clear your
products name. A sort of better business bureau for the industry. Many A/V
vendors belong to various Internet Security Bodies but there is no body
for Anti-Virus.

	I also suggest a fourth category, separate from virus, worm or
trojan. A category of just programs, that only alerts the user that a
program is present that may *possibly* be abused in some fashion. Present
the user with the option to find out more information about it or
acknowledge that it is supposed to be there and never bug them about it
again. Nothing scares a person more than seeing INFECTED! or TROJAN!
Applied to something on their computer. A less frightening dialog that
gives an advisory that says there is a program on their computer that
could be a vulnerability would bring some sanity to this problem. Some
companies already have a similar "exclude" feature but not all do and they
still throw up scary warnings. For the IT community, the ability to filter
definition files not to include programs that are supposed to be there
would make their lives easier, rather than having their users freaking out
at the Anti-Virus warnings.

     I still feel it is important that if the A/V vendors insist on
detecting anything and everything that may be a malicious tool that they
don't play favorites, they should list EVERYTHING, including their own
products. Many of us realize the merit of these fringe programs (most of
which are free) and use them in place of big named box products but don't
want to have to fight with our Anti-Virus packages to use them, and
should'nt have to.

	People are demanding more and stranger things from their computers
and sometimes it's necessary to borrow code from the book of virii and
trojans to achieve this.  The line has blurred between a nasty piece of
code and a great product. Sometimes it's only the marketing that makes the
difference.

Renderman, 
12/28/99 
www.AntiAV.com 
Webmaster@AntiAV.com