Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

A friend told to me the following:

I don't use Anti-Virus software at all, I am just careful about where I go and what I click on.

I've also heard this from other people as I've repaired their PC's and cleaned up the malware/viruses they've received from browsing to the "wrong" sites. Finally I found this blog post that states:

To be blunt: I refused to install any kind of antivirus or personal firewall software on most of my computers (but see Update 1/1/2012, below.) This included a Windows XP Home system that was used by my children as a web surfing / email / game system. I suffered zero infections during this time.

My question is, are there any documented studies that either prove or disprove these claims of being able to browse the internet carefully and having the same amount of risk of infection as that of browsing the internet with anti-virus software?

Note: I thought I remembered seeing a Screen Savers episode one time where they had a PC connected to the internet without any anti-malware or anti-virus and by the end of the show the computer was rendered useless but I couldn't seem to find it.

share|improve this question

migrated from skeptics.stackexchange.com May 31 '13 at 15:38

This question came from our site for scientific skepticism.

    
@Beofett I believe that they are more about corporate security, but I could be wrong about that. –  KronoS May 30 '13 at 16:06
1  
There could be viruses delivered via exploits in banner ads that load on a webpage. Or you could plug in a flash drive with a virus (even if autorun is disabled, see Stuxnet). I personally run with my A/V autoscan turned off and keep my machine patched, but I've seen a few occasions where an A/V scanner detected and cleaned an infection just from browsing to a page with a malicious ad. –  Bigbio2002 May 30 '13 at 16:22
1  
I don't know if there are any studies, but I suffered zero infections during this time. could just mean, has was unable to detect the infections. Actual malware tries to avoid to be detected, can be caught just be drive by and many reputated sites have been used already for attacks. Malicious Ads Detected on Double Click Network of Google drive by infections –  bummi May 30 '13 at 18:51
3  
Both statements you cite are absolutely misguidedf. Any legitimate site that has user-generated content (including ebay, Amazon, etc.) can have XSS vulnerabilities that enable attackes to use those sites to infect visitors via drive-by downloads. This happens very, very frequently. –  Michael Borgwardt May 31 '13 at 14:45
1  
@KronoS Mainly by monitoring my outgoing connections, and (very) occasionally performing an offline scan of my drives. I guess it would be more accurate to say that I never used realtime protection, not that I never used any anti-malware software at all. –  Daniel B May 31 '13 at 18:43

3 Answers 3

up vote 12 down vote accepted

As mentioned in some of the comments, there are no sites which can be guaranteed safe. Even reputable sites have suffered through banner ads, coding mistakes, deliberate attacks etc. so the first problem is that you cannot trust any website. You can work out a level of likelihood of safety by looking at the code from a sandbox and following links, but many attackers write code that hides from debugging tools or from testing environments, and code often changes attack vector with time.

So, to the next part - do you need an antivirus? Absolutely - a huge number of machines connected to the Internet are infected and running as part of botnets. If you don't protect your machine it may end up attacking mine. If you cannot detect malware on your machine I would blame your detection techniques, not think that your machine was clean. Expected infection time for an unprotected machine on the Internet is sub-5 minutes!

share|improve this answer
2  
"If you don't protect your machine it may end up attacking mine." I like that statement. Interesting perspective. It makes me think of the shared social responsibility of vaccination. –  Ryan Ries May 31 '13 at 18:06
    
@RyanRies: and it completely dismisses the fact that none of the AVs can protect you from all threats, especially low-profile ones. –  0xC0000022L May 31 '13 at 21:47
1  
@RoryAlsop: since this appears to be a quasi-religious argument and I don't have a diamond or several k rep next to my name, I think I'll just leave it at this quote of myself from my answer (which attracted already one downvote): "Strictly speaking we can never tell whether a system is clean, whereas we can state that we didn't find anything." –  0xC0000022L May 31 '13 at 21:54
3  
Nothing will protect you from all threats, hence the need for all these layers of security. Doing without a layer reduces your protection. –  Rory Alsop May 31 '13 at 22:04
1  
What does "unprotected" mean in the statement "Expected infection time for an unprotected machine on the Internet is sub-5 minutes!" –  Cybergibbons Jun 1 '13 at 0:58

I'm going to make an analogy: Do I need a condom when I'm really careful when having sex? Yes you do because even when you are safe you don't know the other party involved is even if he or she says they are.So do you need to use a condom/anti virus? Of course you do, better be safe than sorry as getting rid of a virus is very hard.

Do note that even when using an anti virus things can go wrong even when you are being safe! If you suspect things have gone wrong it is best to restore from backup or perform a clean install.

share|improve this answer
    
Unfortunately it happens so that you live a hundred years BCE, what do you do? STDs did exist back then. Would common sense and/or paranoia help or not? –  0xC0000022L Jun 3 '13 at 12:09
    
STDs existed and people got infected and died from them. So the solution would be not to have sex. In this case this would mean not to install software or go on the internet. –  Lucas Kauffman Jun 3 '13 at 12:48
    
oh I think we just have a little problem as to why humanity still exists and the majority of children isn't born with STDs. All I am saying is that your comparison doesn't compute ;) ... at least for me. If it works for others, fine :) –  0xC0000022L Jun 3 '13 at 13:26
    
Not all STDs are deadly and not every virus kills your computer, it's just annoying. –  Lucas Kauffman Jun 3 '13 at 13:40
    
Also have a look at this: ashasexualhealth.org/std-sti/std-statistics.html –  Lucas Kauffman Jun 3 '13 at 13:43

Note: this somewhat elaborate answer won't go down with everyone as the one downvote already shows, but I'll leave it here, because I stand by it. Sure, I don't just say one or the other, not black and white, but unless a moderator or the community feels this answer doesn't belong here, it'll stay no matter how many downvotes it gathers. Heck, perhaps I can break the record for the most downvoted answer after all? :)

There are many many angles to this question and I won't be able to cover all.

Up front a partial disclosure, I am working in the AV industry, but I won't give any more details. Another disclosure, I haven't been using any "realtime" AV mechanisms on my private machines in the past ten or so years. However, I have run offline scans on my machines from time to time.

Several angles to look at the problem

Drive-by-infections and trojans are but two of the potential attack vectors, so careful browsing will not completely relieve you of using common sense or doing your homework in other areas (keeping your software patched and such). There are many more, including targeted (usually known as "spear-fishing", "social engineering") attacks.

Underestimated potential for attacks

For example it has been shown by researchers that placing a USB key that looks like a flash drive but behaves like storage + mouse + keyboard can be used to get into otherwise highly secured areas. No one thinks of an attack first when finding a USB flash drive, right? But it could be.

Anyway, there are many more attack vectors on a wider scale. Most common examples include:

  • vulnerabilities in software you use
    • Adobe Flash and Adobe Reader: PDFs (embedding Javascript or Flash ... or nested combinations)
    • The various browser engines
    • Simple rendering of strings can exploit vulnerabilities (found in the past in font rendering)
    • Java when used as a plugin (although not really necessary any more these days unless you visit a lot of websites from the 1990s ;))
    • use of a number of complex and/or proprietary file formats (pictures, documents ...) where the software decoding the file format has errors.
  • turning your own brain off at the wrong moment
    • getting an email from a loved one with an attachment? Uh oh, email senders can be faked like postcards. You can use cryptographically signed mails to guard against this.
    • actually going to some "erotic" site and just to see that one image or video executing that "downloader"
  • Firmware can be "trojanized" so that your OS doesn't get the slightest chance to detect any wrongdoing on part of the computer.
    • Bluepill by Joanna Rutkowska was a similar approach in that it uses virtualization instructions to move the running system into the guest position while the rootkit itself retains the position as hypervisor.

To just name a few.

Btw: the inverse is also true. One could also engineer a mouse or a keyboard that includes storage and triggers the execution of something off that storage. Here's a project that makes this accessible to a wider audience.

Wrong conclusions

But let's look at the quote you gave.

To be blunt: I refused to install any kind of antivirus or personal firewall software on most of my computers (but see Update 1/1/2012, below.) This included a Windows XP Home system that was used by my children as a web surfing / email / game system. I suffered zero infections during this time.

That clearly shows that the quoted person is not very knowledgeable about the subject. No one, including AV vendors can tell you that you aren't infected with 100% certainty. It's a silly claim. Just because there is no sign of infection doesn't mean there is no infection. There are very few methods, usually involving live CDs/DVDs (example Qubes) which will protect against most attack vectors, but one can usually come up with a scenario where they fail. The most practical are sandboxes that separate programs from each other and this is the approach that Qubes uses.

What I'm saying is that the person uses the wrong justifications and makes the wrong conclusions - not that there is anything wrong with not using AV programs.

AVs won't protect you necessarily, especially pure AVs

My question is, are there any documented studies that either prove or disprove these claims of being able to browse the internet carefully and having the same amount of risk of infection as that of browsing the internet with anti-virus software?

Again, browsing isn't the only attack vector through which malware can enter your system (the autorun mechanism in Windows together with a vulnerability in the icon handler for link files allowed Stuxnet to spread). It was as easy as plugging a flash drive into the computer. The next thing is that a pure AV solution will not filter the websites you access and will only trigger whenever something hits the disk (can also be the browser cache, though). So this makes it clear that a pure AV solution doesn't provide a very good protection against browsing-related infections in the first place.

However, we can assume that most malware needs to persist on the users' machines to be useful to its author - unlike in the past when malware authors proved their knowledge through the creation of viruses and such, these days malware writing is very much a commercial endeavor - such as skimming banking data or using the GPU for Bitcoin mining and what not.

So when it hits the disk, the AV can catch it. Provided that the AV knows about it. And make no mistake, most AV vendors have long departed from the overcome signature-based detection or only use them as a supplementary detection method. That's contrary to popular belief that I have seen voiced time and time again. I am only aware of a single vendor that is basically sticking with the old ways of signature-based detections. The majority of vendors uses a detection that will catch usually hundreds or thousands or related malware samples at once. Still, the AV company has to have come across the malware in order to detect it.

It's a race and in the end also an arms race. Malware writers are using Virustotal and other sites in order to find out whether their creations get detected. Since there is money to be made, be it directly or by renting out your infected machine as a drone, there is enough incentive to keep a low profile.

Dispelling a myth ...

Just for those believers in AVs the results you see in many, if not most, of the certifications are severely skewed. That has to do with two things:

  1. some of them want payment and that of course creates and obstacle for disgruntling the AV vendors
  2. most of the tests allow for loopholes that are mercilessly abused in favor of test results to show off in the respective marketing reports of the vendors

In my opinion one of the better tests is the RAP (Reactive and Proactive) test which measures how good AVs are doing with "outdated" virus signatures. But there are certainly more things that would have to be improved in order to make these tests more objective.

Conclusion: you can't buy security

AVs will provide an additional layer of security to the layman, even to the expert. Period. But - and that's a big but - this added security can never offset lack of education in security-aware computer use. Conversely I hold that, yes, if you are paranoid and diligent enough you don't need an AV as in a must have. The technological layer of protection will not offset the protection you gain from due diligence, paranoia and awareness.

The security provided by an AV can very much be compared to airport security. There's a lot of show, but there's also some actual added security involved. But don't believe that the AV will protect you - or others for that matter - from getting infected.

In my opinion the best protection is awareness and diligence. But unfortunately there is nothing like a driver's license required for computer use. So failing that the next best protection would be sandboxes, whitelisting approaches and also AVs and other anti-malware solutions. They'll never be able to give you a 100% protection (well, whitelisting might), but they can protect you from a wide range of prolific threats. So when in doubt, sure go for an AV solution. But that's where it gets difficult. They differ in quality and even the tests - as I pointed out above - are often severely skewed. Adding another AV engine into the mix may help but there's no guarantee. If inside a single product, the integration of several engines will likely be good and not add too much overhead. However, if you install several AV products in parallel you are asking for trouble.

Also:

keep in mind: Strictly speaking we can never tell whether a system is clean, whereas we can state that we didn't find anything. Every claim to the contrary is either Marketingese or is going to obsolete the AV industry as a whole quickly.

(source: my answer over on SuperUser here)

A yet better security net are backups and frequent rollbacks to a known-clean state - but that's just in my opinion.

Commercialized malware doesn't need privileged access

Over on SuperUser I wrote this:

One more thing. Many Linux (also MacOSX) users fall prey to the assumption that malware that doesn't have privileged access can't hurt you (which is also often cited as a reason why there "isn't" malware for unixoid systems, which also isn't entirely true). This couldn't be further from the truth. Although this prevents it from establishing a system-wide stronghold, it won't keep malware from skimming data from your personal files etc. A rogue browser extension installed in your own profile will still be as dangerous to your account as the one that does it to all accounts. If you do your internet banking with the rogue extension installed, it makes no difference whether you are root or joe.

share|improve this answer
1  
While I agree with most of this, I would actually suggest that you do need AV/anti malware - even if you are aware and experienced in security. –  Rory Alsop May 31 '13 at 16:58
4  
Firewall does not equal security. All a firewall typically does is limit the routes in, but in browsing to a website the firewall is supposed to allow replies. Anattacker doesn't even need to bypass your firewall here. –  Rory Alsop May 31 '13 at 17:16
1  
The figures don't agree with you. And I think you might be misunderstanding this scenario. Folks like Palo Alto are starting to make inroads, but it is early days for them. –  Rory Alsop May 31 '13 at 22:07
1  
@0xC0000022L Agree with your assessment completely. Drive by downloads are not magic. It only happens because of a) an 0-day exploit for a fully updated browser b) human stupidity. In the first case, if it is a targed 0-day, then AV is a fail there in the first place because it hasn't seen the sample before. And in the second case, if the operator is stupid, trust me AV can't protect the machine. –  void_in May 31 '13 at 23:04
1  
"malware doesn't need privileged access" reminds me of this: xkcd.com/1200 –  Jon May 9 at 14:12

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.