Malware creation breaks all records! 160,000 new samples every day

Cr00zng · 02 Jun 2014

Another report that verifies Symantec was right, antivirus is dead. The technology is ill equipped to protect against 6,666 new malware per hour....

Measuring detection rates using VirusTotal is not a new idea and the firm's results were more or less as might be expected; antivirus software gets better and better at spotting malware as time passes, but the detail reveals some important caveats. When no program on VirusTotal spotted a piece of malware on the first day, it took an average of two days for at least one program to detect it.

Without naming any names, it is clear that some antivirus programs are still better (i.e. faster) at detecting new malware than others, with some examples managing to elude one in ten scanners a full year after their first appearance.

Source

UsernameIssues · 02 Jun 2014

When no program on VirusTotal spotted a piece of malware on the first day, it took an average of two days for at least one program to detect it.

What conclusion can be drawn from this? We don't know how long it was between the time a computer that was protected by (let's say AVG) first saw the bad file in action and the time that it was added to the signature list.

And there are files that are never added to the signature lists. Those file are stopped by heuristics only. Those files will never show as bad via VirusTotal for those companies that opt to handle the files via heuristics. (I think that I read that caveat on VirusTotal's website.)

And then there are the files that AVG deems bad but AVAST claims are not bad. It is a subjective call.

I must be reading the article wrong - because I'm not seeing the value of gathering such data.

VirusTotal (and the like) is a great service, but one should watch the data being mined.

My guess is that most of these 160k files are just variations on a theme. Batches of them do the same thing, but are packaged 1000s of different ways. Let's hope that the servers creating these morphed files don't get to where they can create one unique bad file per computer requesting a download.

Layback Bear · 02 Jun 2014

My thoughts.
New infection will always be a step ahead of security programs.
To me this is not News.
Thousands of people creating and planting infection; some sponsored by countries.
This is also not News.
Choosing your security programs and keep them updated several times a day is still the best thing to do for us normal people.
Keeping your other programs updated is also a necessity.
Paying attentions what is done by the users of a computing system of course is important.

Telling us that China is the most infected country in the world. (DAA) No chit.
It's also the most counterfeit country in the world and unable to get proper updates.

Other than telling us that Trojans are the big boy on the block at this time the article to me is just filling up space on the internet.

A Guy this is not intended to shoot the messenger.
Thank you for posting it along with all your other security updates and articles.

LMiller7 · 02 Jun 2014

This is the "army of malware" approach that has been in use by malware producers for some time. Using automated methods the producer turns out thousands of copies of malware that essentially work the same way but are designed to look different to AV software. Signatures aren't much good in detecting such malware. However many signatures the product may know there are thousands more as yet unknown.

To combat such malware AV software uses a heuristic approach that does not rely on signatures. But it is very difficult and isn't completely effective either. It also requires considerable computer resources and for this reason many users have it turned off.

In the beginning a computer virus was merely an experiment, a proof of concept. But it was early learned that such viruses could do more, they could be used for malicious purposes and for personal gain. As computers and software grew more sophisticated malware matched it's progress. Today malware has become very sophisticated. Some malware has a form of automatic update that update itself when the producer releases a new version. Avoiding detection by the user is a very high priority. The goal is to avoid detection by the very best AV software with the latest definitions. Many viruses succeed, until their secrets are learned. But by then it doesn't matter anymore as there are newer versions released.

Malware authors are no longer just the basement hackers they once were. They are well organized, highly motivated, and well funded. Some governments fund the production of malware as a form of terrorism.

At the present time Windows operating systems are the main target. But this is primarily because up until recent times the others didn't have sufficient market share to bother with. But that is changing.

It is war between malware and AV software. Many people believe that malware is winning.

andrew129260 · 02 Jun 2014

Malware will always win.

There will never be a silver bullet unfortunately. Luckily, windows is starting to be less of a target and more and more malware is targeting apple and android devices. Mostly Android due to the marketshare and openess of the platform.

The good news is once most of the malware focuses on mobile platforms, windows will start to be more secure :)

It's messed up good news, but at least there is good news. -use a flip phone.

Layback Bear · 02 Jun 2014

Just take a look at ones friends and family using cell phones.
Which family member or friend do you think knows anything about securty on cell phones or any other portable device. Most I know don't even want to here about it.
That is why those devices get attacked.
The bad guys no a sucker when they see one.

andrew129260 · 02 Jun 2014

Layback Bear said:

Just take a look at ones friends and family using cell phones.
Which family member or friend do you think knows anything about securty on cell phones or any other portable device. Most I know don't even want to here about it.
That is why those devices get attacked.
The bad guys no a sucker when they see one.

The only people who sometimes learn is the ones that get their identity stolen. And sometimes not even then.

Cr00zng · 02 Jun 2014

UsernameIssues said:

When no program on VirusTotal spotted a piece of malware on the first day, it took an average of two days for at least one program to detect it.

What conclusion can be drawn from this? We don't know how long it was between the time a computer that was protected by (let's say AVG) first saw the bad file in action and the time that it was added to the signature list.

The conclusion is that the AV will protect the system against known malware only and releasing a definition for new malware will take at least two days. And that's in "good case", it does not take into account that malware nowadays routinely kills antivirus protection and/or just exempts itself from the AV scan.

And there are files that are never added to the signature lists. Those file are stopped by heuristics only. Those files will never show as bad via VirusTotal for those companies that opt to handle the files via heuristics. (I think that I read that caveat on VirusTotal's website.)

I don't believe that there's such caveat; quote from the VirusTotal FAQ:

VirusTotal antivirus solutions sometimes are not exactly the same as the public commercial versions. Very often, antivirus companies parametrize their engines specifically for VirusTotal (stronger heuristics*, cloud interaction, inclusion of beta signatures*, etc.). Therefore, sometimes the antivirus solution in VirusTotal will not behave exactly the same as the equivalent public commercial version of the given product.

*-Emphasis mine

In another word, the public has the watered down version of the same antivirus that would not detect malware that VirusTotal detects. Heuristic or not...

I do agree that we still need antivirus, but it needs help. This technology is old and not able to keep up with the number of new malware that is released on a daily basis. I find it ironic that an antivirus company releases statistics that shows, just how impossible for their solution to protect against new malware...

Cr00zng · 02 Jun 2014

andrew129260 said:

Malware will always win.

There will never be a silver bullet unfortunately. Luckily, windows is starting to be less of a target and more and more malware is targeting apple and android devices. Mostly Android due to the marketshare and openess of the platform.

The good news is once most of the malware focuses on mobile platforms, windows will start to be more secure :)

It's messed up good news, but at least there is good news. -use a flip phone.

Or just use a Windows phone...