Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Background (not necessary to read):

I've used a few different major AV programs day-to-day over the years, and not one has ever informed me I was running code with known vulnerabilities.

Not only does this bother me since it leaves me open to direct attack from someone aware of those vulnerabilities, but it also means that, if someone with basic intelligence were to copy the vulnerable code from one application for use in a piece of malware, they could do so with the assurance that their code would be immune from AV detection; it would require no thought, and minimal low-level coding ability.

Since the job of AV is to protect me from malware (intentional or otherwise), why isn't this done? Are there legal issues, or do malware programs tend to be easier to recognize because they tend to be smaller than legitimate programs?

...Or have I just let the cat out of the bag, and no one here has ever run across malware designed using that strategy? :P

share|improve this question
    
Actually, come to think of it, if I wanted to attack someone's computer, I wouldn't even bother to write code. I would just direct them to a legitimate company's accidental trojan, and use the existing infrastructure to my advantage; thereby granting plausible deniability, immunity from AV detection, and lack of effort on my part. –  root Apr 5 '13 at 19:47
1  
Kaspersky Anti-Virus 2013 do detect vulnerable installed application and recommend patching please read usa.kaspersky.com/products-services/home-computer-security/… –  Ali Ahmad Apr 5 '13 at 20:17
    
Well, in case anyone's curious, Sophos on OSX doesn't. I had to run a Nessus scan on myself to find out I was running something that had been flawed for years... So, to the person who voted me down because of that comment, well... As long as there are AV programs that don't do this, this remains a valid question, and you can go fly a kite. –  root Apr 5 '13 at 20:50
    
We have warnings about vulnerable software. It's called the "Reboot for updates" nag screen. –  Polynomial Apr 5 '13 at 23:35
    
Except when the flawed software has no 'reboot for updates' nag screen. Unless you mean the AV has the warning, in which case, same. Always keep my malware definition databases up to date... Though I'm aware that doesn't protect me from badly written software I'm running, 0days, social engineering, or programs I write that have runaway pointers. ;) –  root Apr 5 '13 at 23:55
add comment

1 Answer

Its not the role of anti-virus software to detect vulnerable software. We use other tools to detect known vulnerable software, such as Nessus and OpenVAS. We use fuzzing, and source code analysis to uncover new vulnerabilities in software.

share|improve this answer
3  
Correct... Security > AV –  BrianAdkins Apr 5 '13 at 21:49
    
Yes, but my point is that normal people don't know about Nessus, and they rely on AV software to keep themselves secure. Since finding known vulnerabilities not only can be automated, but has been automated, why isn't it bundled with existing AV to protect people? I mean, yes, as a programmer, I am aware of what tools are used to find known vulnerabilities. What doesn't make sense to me is the fact that the two aren't customarily combined. While I'm aware security > AV in practice, I also know the gap between the two could be smaller than it is. –  root Apr 5 '13 at 22:27
    
If I say 'Why isn't there such a thing as a spork?', and you answer with 'Because we have a spoon and we have a fork', that does not nullify the utility of the spork. The spork is still demonstrably a better product than the spoon alone. –  root Apr 5 '13 at 22:29
    
What about firewalls or SPI? What about IDS? Should all AV software handle those as well? ... I think you are looking for security suites that handle many things beyond AV... AV is a piece of the puzzle –  BrianAdkins Apr 5 '13 at 22:30
    
Well, perhaps true. It just occurred to me that one of the things AV tools already do (analysis of executables for known malware signatures) should be modifiable to include signatures of existing products. It would only require more definitions in the database. IDS, on the other hand, requires a fundamentally different kind of behavior. An entirely new team would need to be assembled to write the code to add to the product. –  root Apr 5 '13 at 22:35
show 2 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.