AOH :: ISN-2877.HTM

Virus-creating magazine slammed




Virus-creating magazine slammed
Virus-creating magazine slammed



http://www.techworld.com/security/news/index.cfm?newsID=6658 

By John E. Dunn
Techworld
16 August 2006

A consumer magazine has been condemned for possibly adding to the virus 
problem by creating a series of "test" viruses just to review anti-virus 
scanners.

In an act that has long been considered technical taboo, US-based 
consumer affairs organisation, ConsumerReports.org, decided to generate 
5,500 "test" viruses to run, under lab conditions, against 12 leading 
anti-virus software products.

The organisations own website describes the methodology used: "To pit 
the software against novel threats not identified on signature lists, we 
created 5,500 new virus variants derived from six categories of known 
viruses, the kind youd most likely encounter in real life."

The organisation said it had enlisted the help of Independent Security 
Evaluators (ISE), an external consultancy, to help design the tests and 
ensure they matched real-world conditions.

The magazine itself reckons the world's total virus population to be 
around the 100,000 mark, which makes the new variants a sizable increase 
in one fell swoop.

While the viruses are not expected to pose any threat to companies or 
individuals, their creation of viruses is still controversial.

"The AV community has always been very strongly opposed to the creation 
of new malware for any purpose," said John Hawes of Virus Bulletin in a 
blog on the issue. "There's just no need for it - plenty of new viruses 
are being written all the time, why would anyone in a responsible 
position want to add to the glut?"

Graham Cluley of Sophos echoed his concern. "When I read about what 
ConsumerReports has done I want to bash my head against a brick wall. 
With over 185,000 viruses in existence was it really necessary for this 
magazine to create 5,000 more? It's a bit like Fire Monthly Magazine 
testing fire stations by lighting umpteen fires around the country and 
seeing who is the fastest at putting them out.

"It's irresponsible behaviour, and will be frowned upon by the 
anti-virus industry. Leave anti-virus testing to the independent testing 
bodies with expertise in the field."

David Emm, senior technology consultant at Kaspersky Lab also questioned 
the methodology: "It's not actually clear that Consumer Reports has 
created new viruses. If this is what they did [] with several other test 
bodies who are very experienced in conducting tests, why does Consumer 
Reports feel the need to conduct tests themselves, especially if they do 
not intend to make the results publicly available?

"If, on the other hand, they did actually create new viruses, we would 
not approve. After all there are many many thousands of viruses in 
existence already and we're adding around 200 new signatures to our 
database every day, why the need for someone to create new ones?"

ConsumerReports.org is the online wing of the well-known Consumer 
Reports brand set up in 1993 by the publisher Consumers Union. The 
organisation has so far been unavailable for comment.


_________________________________
Visit the InfoSec News store!
http://www.shopinfosecnews.org 

Site design & layout copyright © 1986-2014 CodeGods