The activities of malware Flame undermines the reputation of manufacturers of anti-virus programs

Mikko Hypponen (Chief Research Officer for F-Secure) found that antivirus developers have suffered a complete fiasco. What are the benefits of their products, if viruses circulate freely and work over the years? Flame malware successfully spied on users at least two years, and this is an optimistic estimate! Mikko

Hypponen - a renowned expert who is working on developing antivirus for more than 20 years. In his time he has seen the most dangerous virus outbreaks, including Loveletter, Blaster, Conficker and Stuxnet. So he knows whereof he speaks. Video of a recent speech Mikko Hypponen at the conference TED Talk watched over half a million people!

 

Flame - this is not the first incident that points to the archaic and ineffective traditional model of antivirus programs. "Flame was a failure for the antivirus software industry - says Mikko Hypponen. - We really should have had the opportunity to do something. But we did not have such an opportunity. We are faced with an opponent from the other league, in our own game."

Reasons for Flame could not find out for years, are clear: any antivirus software running on the basis of signatures, as the virus did not get into this database, it will not be detected. At the same time, developers of the virus Flame done everything possible to avoid detection (eg, Flame check for virus on infected computers).

Thus, the reliability of commercial antivirus is highly questionable. Especially the bad thing is that the antivirus gives users a false sense of security.

Who steals money from users of devices based on Android?

Sadly, the new viruses for Android are discovered more often. So for example, Sophos has detected a rogue antivirus. Link to this virus is spread through Twitter. After clicking on this link, you are prompted to check smartphone for viruses, update Opera or Skype. Instead, the device is infected by a malicious program that sends SMS on paid numbers.

 Symantec, in turn, found the Android Opfake program. It was possible to download disguised as the driver, popular game, the pornofilm or updating for the browser. The behavior of this virus is similar to the previous one.

In this regard, the magazine Computerworld shared interesting information. According to the magazine, the majority of malicious software that was created in order to steal money from users of devices based on Android created in China or Russia.

According to director of antivirus company F-Secure, 20% percent of all malicious software for Android-platform created in Russia. A further 20% in China. The remaining 60% of the virus of unknown origin. It is possible that these viruses are also produced in the above-mentioned countries.

Free antivirus software for Android to have failed the tests

Many free anti-virus software can not provide sufficiently effective protection of smartphones running the Android platform by introducing thereby user confusion about the safety of their devices.

Tests conducted by the laboratory AV-Test.org, showed that the best free anti-virus for Android, Zoner Antivirus, found 32% of the 160 latest threats. The remaining six free antivirus programs are far behind him, the best of the past has identified only 10% of threats, and one of them has not detected any virus. 

AV-Test.org tested seven free antivirus products downloaded from the Android Market (found for "antivirus"). The most common application is Antivirus Free (Creative Apps), which is used by more than a million users. But that is a fraction of the number of users Lookout Mobile Security and AVG DroidSecurity, 12 and 10 million respectively. AV-Test.org not tested these products because Lookout offers a paid anti-virus software, and DroidSecurity - because of its recently acquired by AVG.

This omission does not mean that the results of tests AV-Test.org comprehensive. But even they are a shocking revelation.

Each free antivirus software was installed on a smartphone running Android, which has been deliberately infected with inactive samples of 150 viruses for Android.

AV-Test.org tested all programs to identify these samples.

AV-Test.org included in the test F-Secure Mobile Security and Kaspersky Mobile Security for comparison. And Kaspersky, and F-Secure have discovered more than 50% of all threats, it is much better than the results of free products.

The second part of the test consisted of deliberate attempts to infect the newly updated device 10 viruses for Android. Products F-Secure and Kaspersky detected and blocked all samples. Zoner Antivirus blocked eight, while the other six free antivirus blocked either one or none. BluePoint AntiVirus Free, Kinetoo Malware Scan and Privateer Lite found only one virus. Antivirus Free by Creative Apps, GuardX Antivirus and LabMSF Antivirus beta test failed completely.

"In general, free products have not shown good results (except one), but the paid applications have shown much better results," - said Andreas Marx, CEO of AV-Test.org. "We are working on a critical article, and will focus its attention on the paid applications."

The full report AV-Test.org to test antivirus Android can be found here.

Comparative testing of antivirus products from AV-Comparatives.org (Summer 2011)

AV-Comparatives regularly holds testing of anti-virus products by two various ways - the test of proactive protection (reveals ability of antiviruses to find out attack of harmful programs) and the test of signature protection (checks as antiviruses use the dictionary of known viruses for detection of new threats).

The test of proactive protection

In comparison with the previous tests executed in November of last year, results of many tested programs have decreased.

In the proactive test of the highest rating (ADVANCED +) have received Avira and Kaspersky.

Rating "ADVANCED" have received - G Data, ESET, Panda, TrustPort, Microsoft Security Essentials 2.0, F-Secure, BitDefender, and eScan.

The rating - "STANDART", has earned antivirus Sophos.

Despite decrease in indicators, ability of anti-virus products to detection of harmful programs has hardly decreased.

Testing of complex remedies

Full dynamic test was conducted jointly antivirus AV-Comparatives and the Institute of Innsbruck was supported by the Austrian government. Testing was conducted every day for several months. System under the protection of seventeen antivirus exposed to thousands of malicious URL-addresses. Using the automated procedure that determines whether the antivirus blocking malicious attacks, missed it or have requested user's discretion.

The full report and comparative analysis of results for 2011 will be published in July.