We developed an application (see https://embeetle.com). To avoid false positives, all our executables and DLLs are code-signed with an Extended Verification Code Signing Certificate from Sectigo. Despite this, our users complain that Norton flags and deletes our executables and DLLs immediately when they try to launch the software:
As you can see, the threat is based on the fact that our software is "very new" and has "fewer than 5 users in the Norton Community". It is categorized as a WS.Reputation.1 threat (see https://knowledge.broadcom.com/external/article/191764/endpoint-protection-detects-known-good-a.html).
When using Symantec Endpoint Protection (SEP), the SEP client may log WS.Reputation.1 detections on legitimate executable files or installers from trusted vendors. Depending on policy settings, these files may be Quarantined or deleted. [...] The most common cause of this is a change to the file, such as a new version of an application.
Unfortunately, our executables and DLLs are very vulnerable to this. We push out updates very regularly (sometimes once a week). Such an update means: new executables and DLLs that take time to build up a reputation.
Solution 1: whitelisting executables
The solution most people present is to submit the executables and DLLs as False Positives to the antivirus companies. These companies typically have online submission forms. Unfortunately, this is not a sustainable solution:
Our software consists of many executables and DLLs interacting with each other - around 500 in total. Submitting them one-by-one in online forms would take many hours.
We push out new executables and DLLs at every update. This means we'd have to repeat the online submissions every time.
How long do these online submission forms take to be completely processed? If we push out a new update (eg. for an important bugfix), we don't want to wait for months.
Solution 2: whitelisting our Code Signing Certificate
If we can get our Code Signing Certificate to be trusted by the big antivirus vendors, our business is saved. I've read that big software corporations already practice this. The executables and DLLs they release are automatically trusted by the Antivirus companies.
Large corporations can achieve this - how can a small software business like ours achieve it too?
