Anti-Virus Firm Admits Current Methods Can't Catch Things Like Sony's Rootkit

from the that's-a-problem,-isn't-it? dept

Last week, Bruce Schneier raised the question of why no security firm caught the Sony BMG rootkit earlier and suggested that the anti-virus firms were some how colluding with Sony BMG. At least one anti-virus firm has explained the reasoning, making it clear that it’s got much more to do with how they find and classify problems, rather than any nefarious collusion between the entertainment industry and security companies. Basically, the argument is that security firms need to first be alerted to a problem before they can classify it — and no one was complaining about the rootkit, so they never caught it. In other words, he’s basically made it clear that the current method by which many security firms setup their tool is obsolete. Sony “got away” with it, because no one realized what it was doing. This isn’t a new concept — in fact, we’ve discussed problems with such a reactive method of dealing with malware. As long as you can do change the fingerprint of the malware for long enough, it takes time for the security firms to catch up. That’s why a hybrid model that uses both a threat database and some behavioral techniques to note actions, not files, that seem risky can be much more effective. If the security firms were looking for rootkit-like behavior, it seems like they would have picked this up much earlier.

Rate this comment as insightful
Rate this comment as funny
You have rated this comment as insightful
You have rated this comment as funny
Flag this comment as abusive/trolling/spam
You have flagged this comment
The first word has already been claimed
The last word has already been claimed
Insightful Lightbulb icon Funny Laughing icon Abusive/trolling/spam Flag icon Insightful badge Lightbulb icon Funny badge Laughing icon Comments icon

Comments on “Anti-Virus Firm Admits Current Methods Can't Catch Things Like Sony's Rootkit”

Subscribe: RSS Leave a comment
Bob says:


“the argument is that security firms need to first be alerted to a problem before they can classify it”

If this is true, then how can a security firm claim to prevent problems before they occur? The statement is contradictory to the claim.

These firms need to be proactive, seek out and fix problems before they occur, instead of just reacting to them after the damage is done.

I don’t believe there was any collusion, but still.. there’s no excuse for a failure of this magnitude.

Anonymous Coward says:

Re: Security

It’s not contradictory at all — its the simple truth that if you’re hit first with a new, advanced virus that doesn’t look or ‘taste’ like anything the AV scanner has seen before, you’re screwed. You notice things start falling apart, report it, and the next hundred million PCs get spared thanks to your glorious sacrifice upon the alter of insecurity 😉

Anonymous of course says:

Which Actions?

Anti-virus programs that analyze actions are pretty old now, F-Prot by Frisk comes to mind. These might catch the installer but once a rootkit is in place it can be a difficult thing to detect. If the installer does nothing overtly bad, but you still want to try and catch it, the heuristic sensitivity becomes too great and you have to weed out the false positives. Try running F-Prot with the /paranoid switch and you can see how many clever programmers do fishy things in perfectly legitimate programs. I think it’s important to use trusted sources as much as possible. Now that Sony/BMG has proved untrustworthy, they’re off my Christmas list.

LaidLaw says:


Part of the problem with the rootkit debate is that in some cases, rootkits have a legatimate function. Rootkits are just like anything else, they can be used for good or bad.

Another interesting problem in this debate (and I can’t prove this yet), is that I believe that some anti-virus companies install Rootkits of their very own. Sort of, you need a Rootkit to detect another rootkit kind of issue. Can anybody actually confirm the things that I have heard?

Add Your Comment

Your email address will not be published. Required fields are marked *

Have a Techdirt Account? Sign in now. Want one? Register here

Comment Options:

Make this the or (get credits or sign in to see balance) what's this?

What's this?

Techdirt community members with Techdirt Credits can spotlight a comment as either the "First Word" or "Last Word" on a particular comment thread. Credits can be purchased at the Techdirt Insider Shop »

Follow Techdirt

Techdirt Daily Newsletter

Techdirt Deals
Techdirt Insider Discord
The latest chatter on the Techdirt Insider Discord channel...