By: Renderman,
www.antiav.com
renderman@antiav.com

In the months following defcon , products such as Softeyes (http://www.softeyes.com), and Investigator from Winwhatwhere (http://www.winwhatwhere.com/), and other products that are designed to do much of what the A/V industry says makes a program malicious are not scanned for. When a products can advertise "watches and records everything about every window that gains the focus. It records every keystroke, program name, window title, URL, User and Workstation and the optional 'Silent Install' feature will run the installation silently and invisibly" and not be scanned for, it begs the question, how do you decide? Also you may recall the problems that the folks over at NetBus had when they went commercial and started charging for their product. They had a hard time shedding the image of a hacking tool. This really rattled a lot of peoples cages because the logic that was in use by the people who are saying certain programs are malicious does not make sense when you add these new programs to the mix. Just looking at C|net's technology terror guide (Technology Terrors) you can see the number of products that aren't on any A/V list that are as dangerous, if not more, than BO2K.

This whole thing boils down to the question; how do A/V companies decide what criteria makes a piece of code worth being scanned for?

Well, rather than rant on like others might do, I went to the source. I looked on A/V sites for a policy statement or a set of internal guidelines. Nothing found. So I sent a mail like any other customer to the customer support department (and if it existed, the A/V research department as well) of the major A/V companies, Symantec, NAI, AVP, Computer Associates, and Panda Software. There were others that could also qualify, but these are what you find most on store shelves. To all the companies I sent the same letter:

Dear Sir/Madam,

With recent events in the virus industry, it has become apparent to myself and many others that there seems to be a definite bias when is comes to how companies like yours determine what should and should not be scanned for.

By what policy do you decide what should be scanned for and eliminated and what is 'legitimate'? After an examination of your web site, no policy statement could be found. Can you clarify by what criteria makes a product malicious or a legitimate product?

Thanks

RenderMan
www.Hackcanada.com

As you can see, the letter states my conundrum and the clarification I need, and I don't try to hide who I'm mailing as. I waited a couple weeks for the responses to accumulate and re-sent some that I did not receive responses from. In over two weeks I only received 3 responses.

First was a very quick response from Symantec customer support from a gentleman who really was having a really bad day and I think and was not happy to see me. Here is his message with my comments inserted

I can assure you that Symantec has absolutely no bias towards any legitimate software developers (What makes a software developer legitimate, is there a license I'm not aware of? I thought anyone could code?) Arguments by some hackers that certain hacker tools are actually legitimate commercial software are themselves extremely biased to the point of not making any sense (I agree we are biased to a point just as you are, but what makes something a hacker tool or a mis-used administration tool?) A good news recent story about this subject is available for reading at this web page, http://www.msnbc.com/news/287542.asp. Both Symantec management and management at other Anti-Virus developers are quoted in this article about this subject. We really would not have anything further to add to these comments on this subject. (The article does not really answer what I was asking.)

Best regards,
(name omitted)

After not answering my original question, I responded because I thought they still had something they could add. This time I went and asked exactly how they decide what should and should not be detected and give an example:

Interesting article you reference, but it still does not answer my question.

What is your companies policy on determining what should and should not be detected in your Anti-Virus scans?

What is defined by your company as legitimate software developers? Are independent developers not in the same boat as large companies such as yourselves?

What is preventing Back Orifice 2000 from being a legitimate tool? In the article you specified it says "anyone with the other half of the Back Orifice software (the administration tool) can control the victims PC from anywhere on the Internet". Can not the same be said for your product pcAnywhere?

I really appreciate you trying to clear this question up for me.

RenderMan
www.Hackcanada.com

The bit about pcAnywhere was meant to try and get my point across that the differences between good and evil code are blurred. I myself have taken over the computers of friends (with permision) who use PC Anywhere with out passwords and the affect is just the same as using BO2K.

His response was less than pleasant, but interesting. Again, here is a transcription with my comments:

I'm afraid that this is not at all a legitimate question that you ask here. (I'm a customer, I want to know so I can know if your product will protect me from anything that can be bad.)

You know, you aren't even giving me the common courtesy of identifying yourself. (ummm, I signed my name at the bottom, that usually is all people do. The support center never stated anything about needing my full information in order to receive customer support.)

Symantec Operates our discussion groups as a support resource for our customers to use to get help from us. They are not meant for engaging in debates like this. (Whoa, hold on, I really am a customer of Norton A/V, and I'm asking a question, how do you decide what to scan for? This is a customer inquiry.)

pcAnywhere in not designed to be to installing silently and secretly in the background on a system. It was also not announced at a hackers convention. (So if it announces it's presence but formats your drive without asking it's OK? Since when does the location of announcement mean anything about the product itself?)

(name omitted)

After that, I let him get back to blowing off other customers questions.

MS announced DirectX 2 at a conference done along the theme of ancient Rome. Does this mean DirectX is a technology for guys in robes and olive branches? I think not. Fortunately this response from Symantec was not indicative of all the responses I received.

NAI customer support responded quickly as well, this time with a definite different tone.

If a program reproduces itself, we call it a virus. If it does something that the user does not expect, we call it a trojan. If it is harmless and funny we call it a joke. (Not a bad though short summary.)

There are other categories that could be considered such as Hack tools, BackDoors, worms and Password Stealers. (Now it gets weird. Does L0phtCrack count as a password stealer, or a hacktool, or as just another damn good program?)

NAI wasn't clear but I was getting closer.

NAI also sent the 3rd and final response that really got me thinking.

Thanks for your question. The criteria although not obvious, is simple among researchers. The detection's are mainly customer driven, that is if a client requests detection of a particular problem then it is taken into account. Many of the detection's received come from shared collections, collections that are shared among A/V vendors. Some of the detection's are from samples received from customers and others are from sites referred to us from customers who feel there is a valid threat.

Regards,

(name omitted)
Sr Virus Support Analyst
AVERT - a division of nai
//* We eat viruses for breakfast, lock and load *//

Ding, Ding, Ding, We have a winner. The last line "others are from sites referred to us from customers who feel there is a valid threat." So, the A/V industry uses a common database and submissions from customers..... I'm a customer and I want Investigator, softspy, pcAnywhere and SMS scanned for. I submit to you samples of each to add to your databases. There is no way to get BO2K off the lists, the media just won't have it. But by using the normal submission procedure for suspicious files, it may be possible to add other programs of similar features to the database and make the A/V industry re-think itself.

I encourage everyone who has legitimate access to any program that can be used maliciously, submit it to the A/V industry through their virus submission e-mail addresses. A hacker's version of a letter writing campaign. 1 person submitting these programs will be labeled a crackpot, many on the otherhand will have an effect.

I for one want a level playing field. If there is a program on my system that can record my keystrokes, passwords, bank account numbers and ship it off anywhere without telling me, I want to know about it.

If a person wanted to use a trojan for nefarious purposes they need just be a little creative. Just spend the $100 or so on Investigator or a similar program, use something like Silk Rope to wrap the executable with some benign little program and deploy at will. This is a common tactic used to deploy trojans but with this method, not a word will be uttered by any A/V product and the attacker can go along on his merry way unfettered. So unless the A/V industry changes it's position on what makes a piece of code malicious, smart trojan users will fly on by using 'legitimate' products. But why should they scan for those products? After all, they weren't released at a hacker convention :-)

RenderMan
www.antiav.com
renderman@antiav.com