2

This may not be the correct community for this question, I apologize if that's the case.

Scenario:

A software development company has created a collection of small desktop applications. They have followed best practices, signed their software using an EV code signing certificate, vigorously tested their software, performed thorough internal and external penetration tests and even had their management systems certified to ISO 27001 (InfoSec) and ISO 9001 (quality).

They release their software and early adopters try it out. Their software is 'trusted' by Windows SmartScreen and the code signing pays off with their company name shown in UAC and SmartScreen as a 'verified publisher'. The customer is happy but a few seconds pass and disaster strikes.

The customers AV product quarantined the executable (not bad as it can be restored), but locks the ProgramData folders and thoroughly kills the service (bad, requires a clean uninstall, reboot and install).

So the customer (having now read the documentation) adds an exception to their AV configuration, tries again and lives happily ever after.

The software vendor is obviously frustrated by these events, especially as they have scanned the files using several AV products themselves which all come back clean.

Question: What can the software vendor do to gain additional trust from AV products? Is there somewhere to 'submit' your software for analysis? Is this a trust that just builds organically over time?

  • This migth not be the answer you are lookign for but most AV checks are on specific patterns and/or ways to address OS files/services aso. If a developer encounter such a problem even if its a false positive you can change the programm patterns. Still works for too many malwares – unherz Sep 11 at 23:56
  • When this antivirus program flags your program, what's the name of the virus that it says it is? – Joseph Sible Sep 12 at 1:10
  • It's not flagging it as a virus, it's just treating it as 'unknown' and begins the disinfection process. It's really bizarre. I'll see if I can get some log data today – Arbiter Sep 12 at 8:10
  • They could digitally sign their assemblies using a trusted chain certificate (non self-signed). AV do also have some behaviour based detection that could flag the executables/libraries but usually AV companies do have a sample submit methods so they can be whitelisted for that specific AV. – bradbury9 Sep 12 at 10:05
  • I've found a few pages where I can submit false positive information to major players (such as Symantec and BitDefender). It must be a behavioral issue as they only detect the process when it's running post-installation. I think submitting the application to the security vendors is probably the best way forward. – Arbiter Sep 12 at 15:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.