Top security suites fail exploit tests

Security software suites don't protect users from real-world exploits, a bug tracking company charged today after launching 300 test attacks against a dozen programs, including popular software from McAfee, Symantec, and Trend Micro.

"The Internet security suites are marketing themselves as the one solution users need to be safe online," said Thomas Kristensen, chief technology officer at Secunia, which ran the tests. "In our opinion, that's just not true."

[ Learn how to secure your systems with Roger Grimes' Security Adviser blog and newsletter, both from InfoWorld. ]

Secunia sicced hundreds of vulnerability exploits -- some proof-of-concept code that triggered a vulnerability, others that included payloads -- on 12 suites, including Symantec's Norton Internet Security 2009, Microsoft Corp.'s Windows Live OneCare, AVG Technologies' Internet Security 8.0, and McAfee Inc.'s Internet Security Suite 2009. The attack code was delivered by files of various formats, including Office documents and malformed images, and by malicious Web sites that triggered browser and ActiveX bugs. The target was a Windows XP SP2 machine missing "certain patches and with a number of vulnerable programs," according to Secunia.

While Symantec's Norton Internet Security 2009 took honors, it detected only 64 out of 300 exploits, or just 21 percent of the total. Even so, that beat most rivals by substantial margins. Trend Micro's Internet Security 2008, for example, only detected 2.3 percent of the exploits, while McAfee's Internet Security Suite 2009 identified 2 percent and Microsoft's OneCare spotted just 1.8 percent of the exploits.

The reason why current security suites had such trouble detecting the 300 exploits, Kristensen explained, is that anti-virus software vendors are geared toward cranking out signatures for hacker payloads: the worms, Trojan horses, and spyware that are identified in the wild, given names, and then spotted by adding a new detection "fingerprint" to the software.

"They don't focus on detecting vulnerabilities, they focus on detecting the payload," Kristensen said. "But the problem with detecting the payload is that you're always behind [the hackers]. It's easy for the bad guys to create a new payload that's not detected by the scanning mechanisms and current signatures."

In order to craft a signature for a specific payload, security companies must first capture a sample, analyze the malware, and write a detection fingerprint. Then they must push that new signature to users. The process, said Kristensen can take hours at best, and then must be repeated as soon as a new piece of malware is bundled with an exploit.