Are signature based antivirus or antimalware effective?

Question

Are signature based antivirus or antimalware solutions effective? Has the battle been lost against the ever increasing amount of malware, particularly rootkits, that are in the wild?

Answer 1

A signature-based detection system can't be the only solution, but it can be part of the solution. Indeed you'll find that a lot of the AV products that have behavioural detection and heuristic detection also still employ signature-based detection. It's simple, it's fast, the chances for false positives are very low. But the chances for false negatives are high, and you certainly fail against novel attacks.

Answer 2

I would contend that Anti-Virus/Anti-Malware and other black-list based security systems have long lost their effectiveness due to the following:

1. They cannot possibly protect against new (yet unlisted) threats like zero-day vulnerabilities
2. They provide a false sense of security
3. Their signature files are unbounded in size and always keep growing
4. Due to 3. they become more taxing on resources (memory, CPU, etc.) over time
5. AV software runs with the highest privileges plus it is willingly installed by legitimate users. In essence, it is part of the OS kernel. As such AV has become a preferred exploit target in itself.

In contrast, white-list based security systems which allow what is known, routine and safe, while disallowing (with an option to ask the user whether to allow from now on) everything else, are more sustainable, effective, efficient and actually secure.

This is not just my opinion, it is a principle that many prominent security experts agree on. See for example: This WiReD article

---

[Update: 2014-07-29]

But it gets worse: imagine a big and complex, monolithic application which runs on your computer with the highest privileges. It intercepts many system-calls and sometimes changes their semantics, installs kernel drivers on updates, employs a packet filter which sniffs everything coming in, and effectively tries to control anything your computer can or cannot do. What I just described is the essence of AV software. This is exactly what most of them do. The result is that typical AV software dramatically increases your attack-vulnerability surface. In fact, modern malware often looks for AV software vulnerabilities to exploit (see this reference for example). This is the reason why many security experts consider AV programs to be the among the riskiest viruses ever invented. AV is literally transforming into an extension of modern malware.

---

[Update: 2022-01-09]

It has been ~7-8 years. As feared, the AV landscape has become much more treacherous.

In recent news, users report that a well known and widely used AV software company now officially installs possibly-unwanted additional components (in this case, a crypto miner) by itself. Black-hat involvement of exploiting AV admin privileges is no longer even needed to infect your computer with unwanted software.

https://www.theregister.com/2022/01/05/norton_360_cryptominer_deletion/

---

What I personally would use instead?

A combination of white-list based protections, in many layers. When one fails, the others may succeed:

1. Firewalls permitting only what's known and designed to be allowed
2. Log scanners, trip-wire, file-signature (intrusion detection, based on anomalies) systems
3. Sand-boxes, VMs around more vulnerable software like browsers
4. A hardened operating system that's protecting against execution of data, supports random address loading, does runtime checks like system-call parameter checking, etc.
5. Secure, encrypted connections like those provided by ssh
6. An environment allowing one to look at the source code of the installed software and build from that source or at least download packages from a small number of reputable sources as opposed to a large number of random sites.
7. Stronger/longer passwords & passphrases; a good, and open-source password manager; multi-factor authentication (MFA)
8. For corporations: zero-trust networks and micro-segmentation.

There's no silver bullet. Security is a complex area affected by many factors. One can use the above (and more) principles to increase security but one can never be sure that they're 100% secure given the complexities of hardware, software and high number of potential infection vectors.

Answer 3

Please look at these videos at securitytube

• http://securitytube.net/How-to-make-Files-Undetectable-by-Anti-Virus-video.aspx
• http://www.securitytube.net/AV-Evasion-using-MSF3-Payloads-video.aspx

which both demonstrates how easy it is to avoid antivirus detection. Signature based antivirus needs to live on, but if they want to make a living it won't be sufficient by limiting yourself only to signature based detection.

You have automated tools which can use to disguise your malware making it no hassle distributing a malware which the antivirus will not pick up.

You also have the challenges of Polymorphic code which makes signature based checking even harder. The battle is by no means lost, but it is significantly harder to block by signature today than it was 10 years ago.

Answer 4

It was lost when someone like your mom could lose her identity and payment cards to fraud.

I would say that, no, anti-virus and anti-malware have been very ineffective since the Windows buffer overflow in 1999. In 2010, they are adding fuel to the fire and make systems more insecure, and not just because they provide a false sense of security. They are actively being attacked themselves and used as rootkits or entry points.

Answer 5

It depends what you mean by effective. This method would only notice known viruses. But if a virus is known it is also certain what kind of vulnerability it exploits. In the past those vulnerabilities were either already fixed when the virus spread or were fixed direct after it became known.

So if the system is updated on a regularly basis, a virus scanner would not have much benefit. On the downside the virus scanner slows down the computer and often annoys people.

I often advise home users to not install any anti virus software. Instead they should consider some general hints (regular updates, principle of least privilege etc.). Every half a year or so I check those systems with some anti virus CD. For ~10 years neither of those systems were affected by a virus.

I don't consider the battle to be lost. If the user pays some attention to the security of his computer he could stay safe.

Answer 6

You could do an inverse, i. e. have checksums for valid executables, otherwise signatures are bit out of place.

Answer 7

AV is a blacklist control that tries to enumerate what is bad and block it, allowing everything else by default. This type of control is very convenient but not very effective, and in the case of AV it is more or less an admission of defeat.

From a security point of view it is usually better to enumerate what is allowed and deny everything else by default. This of course is much less convenient but also much more effective.

I'd much prefer to see systems that work by only allowing the handful of programs I've explicitly installed and permissioned to run, than by trying to stop the bazillions of programs I don't want to run. I think the current tendency towards 'app stores' is somewhat helpful in this respect.

Answer 8

I think you have to evaluate your situation to make that determination. The blacklisting AV programs out there are actually able to detect millions of different kinds of malware. If you are vulnerable to that malware and see a lot of malware, I think you would be hard pressed to say it isn't effective.

However, it is only one piece of security defense. Blacklisting is mostly reactive (some generic matching, but higher false positives). When updates are released, by definition they are already old. Any new malware won't be in the list.

A bunch of the large AV vendors are doing a sort of real-time detection and updates via "the cloud," but it just shortens the time between updates.