Immunet Blog - Immunet Blog - False Positive Mayhem

Thursday

Apr222010

False Positive Mayhem

Thursday, April 22, 2010 at 10:22AM |

I had a great conversation with Byron Acohido of The Last Watchdog and USA Today last night about how False Positives (FPs) in our industry occur. As AntiVirus vendors, we all live in fear of major False Positives; it keeps us up at night. It has happened to everyone - including Symantec, McAfee, BitDefender and Kaspersky to varying degrees over the past several years. FP’s vary in their level of severity, and range from minor – such as triggering on very obscure and rare programs used by only a few - to severe – such triggering on a core part of the Windows Operating System, which is exactly what has happened in this case. Believe it or not but minor FP’s happen to vendors several times a week, but they rarely cause widespread damage, affecting only the more obscure applications; which is why we never hear about them at all – they simply don’t make the news.

All AntiVirus vendors use signatures as one form of detection – they are the most precise method by which to detect threats. Most AntiVirus vendors have a variety of signature formats, and also a variety of detection engines – a requirement to keep up with the growing number of threats on the Internet today. Normally you would see FP’s from ‘generic signatures’, behavioral engines, or heuristics, used to detect a complete family or strain of viruses. It’s difficult to say what kind of detection was responsible for the most recent SVCHOST.EXE False Positive that McAfee fell victim to – but it sounds like a very precise detection in this case, meaning a potential lapse in the quality assurance process.

How Something like this can Happen

In order to understand how this can happen, it’s useful to understand the process that AntiVirus vendors undertake in order to generate detections.

Their user base; through the use of behavioral or heuristic engines
Honeypots and web crawlers
AntiVirus Industry sample exchanges with other vendors

In order for SVCHOST.EXE to make its way into a vendors sample collection, it will have come from one of those three sources. Any one of these could have been the culprit in this case, since a reasonable percentage of the files collected through all of these channels are going to be FP’s.

FP’s have historically been produced by both human analysts and automation technologies, so it is difficult to say which the culprit was in this case but clearly SVCHOST.EXE made its way through the analysis process without being recognized as a problem. It is quite possible for a junior analyst to mistakenly misclassify a clean file as a virus.

As vendors become aggressive and threats become more prevalent, the risks of FP’s also increase. McAfee is certainly not alone with this problem. That being said, the traditional form of publishing detections in this way leaves desktops over-exposed to situations like this. There are clear cut safe guards that can be put in place to prevent these types of events, and newer cloud-based solutions have the benefit of detecting and mitigating FP’s within minutes, limiting the damage when they do occur.

I would expect the industry to take note of this event and make a renewed effort to avoid False Positives in the future.

More about the Specific False Positive in the McAfee Case

SVCHOST.EXE is a core part of the Windows Operating System, and it is a well known clean file. Interestingly enough, very basic files like this frequently show up in AntiVirus vendor sample collections. Consumer and enterprise users will often send almost anything suspicious to AntiVirus vendors for analysis, including many core Windows processes that are frequently seen running on the system via Task Manager. It doesn’t help that some viruses actually masquerade as SVCHOST.EXE, leading to confusion and the submission of the legitimate SVCHOST.EXE process for analysis. As a result – the appearance of SVCHOST.EXE in a sample collection is not surprising at all. As for why the FP was not detected during QA, that is more difficult to answer. The file was either not part of the clean set, or the QA process failed somewhere along the way.

At the moment it looks like each machine that was affected requires manual intervention. It’s impossible to say how many systems were actually affected, but this was not an isolated event. Peter Svensson of the Associated Press reports many were affected, including Intel, and CNET’s Declan McCullagh reports, “the University of Michigan's medical school reported that 8,000 of its 25,000 computers crashed.” Geek.com’s Matthew Humphries reports numbers much lower, in the several hundred, in fact, ZDNet’s Ed Bott has some additional information worth a read too.

It would be difficult to estimate the monetary damage. Ironically, the best measure on widespread system failure that we have seen has been that resulting from the widespread virus outbreaks in the past decade. CodeRed in 2001, Slammer in 2003 and Sasser in 2004 might provide some baseline numbers on the effect of large scale system failure.

I can definitely sympathize with McAfee; nobody wants to have this problem while striving to protect people better. They are working to correct the issue as engadget’s Nilay Patel quotes a first response from McAfee (worth a read).

Email Article |

Print Article |

Permalink | Comments Off

View Printer Friendly Version

Email Article to Friend

Reader Comments (10)

carriage, at 6 oclock. Its design is such that the carriage rotates devoid of ball bearingstag heuer|
and consists of a Swiss lever escapement

September 24, 2010 |

replica watches

we provides you the best and most fashionable products. All the products are 100% high quality, competitive price, free shipping with best and timely service, 100% satisfaction. Big discount for big order. Welcome to make your choose.

ghd
hair straightener
hair irons
hair iron
straighteners
straightening irons
ghd iron
cheap straighteners
ghd hair iron

louis vuitton
lv
louis vuitton wallets
louis vuitton purses
louis vuitton sunglasses
louis vuitton bags
louis vuitton handbags
discount handbags
lv
louis vuitton bags

louis vuitton
lv
louis vuitton wallets
louis vuitton purses
louis vuitton sunglasses
louis vuitton bags
louis vuitton handbags
discount handbags
lv
discount handbags
louis vuitton bags

louis vuitton
lv
louis vuitton wallets
louis vuitton purses
louis vuitton sunglasses
louis vuitton bags
louis vuitton handbags
lv
louis vuitton bags

gucci
gucci handbags
gucci bags
gucci wallet
gucci shoes
gucci sunglasses
gucci men
gucci women
gucci cheap
gucci discount
gucci outlet

mbt
mbts
mbt shoes
chesp mbt shoes
walking shoes
discount shoes
comfort shoes
discount mbt shoes

christian louboutin
louboutin
christian louboutin shoes
louboutin shoes
bridal shoes
sexy shoes
high heels shoes

ugg discount boots
cheap ugg boots
ugg boots cheap
discount uggs boots
ugg cardy boots
discount uggs
discounted ugg boots
cheap uggs boots
uggs for cheap
ugg
ugg boots
ugg shoes
ugg tall boots
ugg short boots
ugg boots sale
ugg boots on sale
ugg boots on cheap
ugg discount
uggs
discount uggs
ugg sale
ugg kids
ugg women
cheap ugg

ugg discount boots
cheap ugg boots
ugg boots cheap
discount uggs boots
ugg cardy boots
discount uggs
discounted ugg boots
cheap uggs boots
uggs for cheap
ugg
ugg boots
ugg shoes
ugg tall boots
ugg short boots
ugg boots sale
ugg boots on sale
ugg boots on cheap
ugg discount
discount ugg
uggs
discount uggs
ugg sale
ugg kids
ugg women
cheap ugg

weight loss
diet pills
how to lose weight fast

ed hardy
ed hardy clothing
ed hardy clothing shirts
ed hardy clothes
ed hardy t shirts

christian louboutin
louboutin
christian louboutin shoes
louboutin shoes
bridal shoes
sexy shoes
high heels shoes

chaojimengnan supplier
chaojimengnan

October 1, 2010 |

christian louboutin shoes

October 11, 2010 |

chriatian louboutin

Designer bags are versatile. They are made to go with many different outfitss you can choose.
chanel handbags
chanel handbag
chanel bags
discount chanel bags
chanel

Here you can have a designer handbag without paying thousands of dollars.
handbags
designer handbags
luxury handbags
cheap handbags
cheap designer handbags
luxury designer handbags

The vintage Chanel bag comes in many shapes and sizes, not to mention a variety of colours.
chanel cambon
chanel cambon bags
chanel cambon handbags
chanel cambon 31
chanel cambon handbags prices

The Classic Flap bag is labeled with interlocking CC, which were introduced in 1980s and differs from other Chanel 2.55 bags.
chanel flap
chanel flap bags
chanel flap handbags

A vintage Chanel bag is not only one of the most stylish products out on the market these days, but it is defining personal fashion in a whole new way.
chanel 2.55
chanel 2.55 handbags
chanel 2.55 bags
chanel bags 2.55
chanel handbags 2.55

However, in case you do not have a store in your city, then you can either buy Chanel bags online
chanel handbags 2010
chanel 2010 handbags
chanel bags 2010
chanel 2010 bags
chanel bags 2010 sale

Having a vintage designer bag makes us all feel like celebrities.
chanel wallet
chanel wallets
chanel continental wallet
discount chanel wallets

The bags are one of the more useful accessories in fashion since it can be worn in a number of ways and can be used to keep your important items in as well.
The pre-requisite of designing a bag is that the design should be trendy and according to the style that is in vogue.

October 13, 2010 |

gucci bags

October 15, 2010 |

pizza

Moncler Jackets
Moncler
Women Moncler Jackets
Moncler Jackets For Women
Moncler Lucie
Moncler Alpin
Moncler Angers
Moncler Lans
Moncler Mens
Moncler Coats
Moncler Vests
Moncler Boots
Moncler Bags
Moncler Branson Navy
Moncler Arcs
Moncler Maya
Moncler Auburn
Moncler Ever
Moncler Garcons Everest
Moncler Himalaya
Moncler Clairy
Moncler Quincy
Moncler Nantes
Moncler Badia
Moncler Pop Star
Moncler Shiny
Moncler Daytona
Moncler Limited Edition
Moncler Indre
Moncler Puffer
Moncler Bady
Moncler Bea
Moncler Mokacine
Moncler Chartreuse
Soccer Uniforms

November 7, 2010 |

kevinroy

shoes ralph lauren polo looks Beautiful classic polo ralph Lauren is very Beautiful shoes ralph Lauren is terrific brand polo shirts is very Beautiful shoes ralph lauren online is very nice Beautiful moncler jackets on sale good moncler is online shop for sale umoncler coats good quality cheap Christian Louboutin is very good very good christian louboutin sale uk is very cheep our discount louboutins is Good quality cheap cheap louboutin store is very good very good louboutin uk is very cheep our christian louboutin uk is Good quality boots UGG boots uk is Good quality classic ugg boots sale is very Comfortable very classic cheap ugg boots is very good very cardy ugg boots is very Beautiful boots UGG boots uk is Good quality classic ugg boots sale is very Comfortable very classic cheap ugg boots is very good very cardy ugg boots is very Beautiful good chaussures nike beautiful nice nike air max amazing great air max masterpiece outstanding nike tn grace perfect nike shox wonderful

December 7, 2010 |

UGG

December 12, 2010 |

uggs outlet

upcoming air jordan shoes unreleased
air jordan black basketball shoes
air jordan shoes retro cheap
Authentic Jordans
rare air jordans 5 v on sale
air jordan 11 low
air jordan 11 space jams
air jordan 11 release date
air jordan 11 xi retro silver anniversary
Air Jordan Fusion Shoes for sale
air jordan 11 xi retro snakeskin
air jordan 11 silver anniversary
air jordan 11 xi retro space jam
casual shoes
online shoe shopping
girls shoes
casual shoes
nike air force 1 high supreme
new air jordans
ecco shoes
shoe brands
golf shoes
air jordans for sale
sandals shoes
walking shoes
nike air force 1 high supreme sneaker
air jordan 11
air jordan 11 retro
air jordan 11 cool grey
air jordan 11 low
air jordan 11 space jams
nike air force 1 high black and white
air jordan 11 release date
air jordan 11 xi retro silver anniversary
air jordan 11 xi retro snakeskin

December 31, 2010 |

retro air jordans sneakers

Ralph Lauren Ralph Lauren Polo Ralph Lauren Polo Ralph Lauren Ralph Lauren Polo Ralph Lauren Polo Cheap Ralph Lauren Polo Cheap Ralph Lauren Polo Ralph Lauren Polo Outlet Ralph Lauren Polo Outlet Ralph Lauren Outlet Store Ralph Lauren Outlet Store Ralph Lauren Polos Ralph Lauren Polos Ralph Lauren Clothing Ralph Lauren Clothing Discount Ralph Lauren Women S Polo Shirts Discount Ralph Lauren Women Polo Ralph Lauren Classic Fit Stripe Sport Shirt Polo Ralph Lauren Classic Mens Ralph Lauren Custom Fit Polo Mens Ralph Lauren Custom Ralph Lauren Black Watch Polo Ralph Lauren Black Watch Big And Tall Ralph Lauren Polo Shirts Big And Tall Ralph Lauren Colorful Polo Ralph Lauren Shirts Colorful Polo Ralph Lauren Ladies Polo Ralph Lauren Shirts Ladies Polo Ralph Lauren Polo Ralph Lauren Models Polo Ralph Lauren Models Big Pony Polo 5x Ralph Lauren Big Pony Polo True Religion True Religion True Religion Jeans True Religion Jeans Cheap True Religion Jeans Cheap True Religion Jeans Discount True Religion Jeans Discount True Religion Jeans Herve Leger Herve Leger Herve Leger Dress Herve Leger Dress Herve Leger Skirt Herve Leger Skirt Herve Leger Outlet Herve Leger Outlet Herve Leger Bandage Herve Leger Bandage Herve Leger Dresses Herve Leger Dresses

January 10, 2011 |

xixiwyhes

Comments for this entry have been disabled. Additional comments may not be added to this entry at this time.