Bugs at Internet speed?

Daily Newsletters

Sign up to ZDNet UK's daily newsletter.

NEWS
To err is human. To spread the error across the Internet ... leave that up to new automated update systems. So say critics of two plans by antivirus vendors to automatically deliver updates to desktop PCs. The systems for delivering antivirus updates are IBM's Digital Immune System, to be deployed by Symantec, and Network Associates' Rumor. They will respond to virus attacks by pumping the latest digital cures down to hundreds of thousands of PCs. In a few years, that number could be in the millions. But are these automated antivirus offerings a panacea or the makings of a disaster? "If they did everything perfectly, there wouldn't be a problem," said Fred Cohen, a security consultant, researcher, and author of the first paper on computer viruses in 1984. A single error, however, could transform the system from helpful to harmful, he said. "If the update gets corrupted, you are essentially sending out to everyone as legitimate updates." That's not so unlikely as it sounds. On Wednesday, an Oklahoma coal and natural resource venture reported that an update from McAfee.com had disabled 250 of the firm's machines for most of the day. In early October, updated definitions for Symantec's Norton Anti-Virus conflicted with Network ICE Corp.'s BlackICE firewall, shutting it down and leaving affected systems open to exploit. McAfee and Symantec are not alone. Almost every antivirus maker has erred with its updates in the past. One reportedly missed detecting the QAZ Trojan in early October. Another dropped several old definitions from its lists, resulting in viruses thought to be a decade dead popping back up on computers worldwide. With the new technologies, isolated incidents could become worldwide problems. Today, program and virus-definition updates are posted to servers on the Internet, and wait there until clients download the data. In some cases, the process is automated, but good system administrators will test the updates, said Rob Rosenberger, antivirus industry watcher and editor of Virus Myths. "In a large organisation, you need to know that the updates work with the software that's on the PCs," he said. "If you automatically update your executables, it may one day break your system." Yet companies are the ones clamouring for a solution that delivers fixes as fast as possible. "In their mind, faster is better," said Rosenberger. That's understandable. During the Melissa outbreak, antivirus software makers responded in many cases within 12 hours to the new macro virus. For panicked customers, however, that wasn't fast enough. The number of unique visitors on McAfee's Web site spiked from an average of 350,000 a day to more than eight million, said Victor Kouznetsov, vice president of engineering and chief technology officer for Network Associates' MyCIO.com business unit. "Virus writers are always one step ahead," he said. "We need a system to help... them." Well, fast is here. The Digital Immune System and Rumor are the antivirus industry's answer to outbreaks of digital diseases such as Melissa and LoveLetter. The Digital Immune System -- based loosely on an analogy of the body's reaction to disease -- pushes solutions down to individual customers as they become available. Rumor, the technology announced last week by MyCIO.com, uses a more sociological analogy -- the passing of a juicy rumour between friends -- to deliver definitions by the currently vogue method of peer-to-peer networking. Both systems will result in the latest definitions being distributed quickly to customers. That means less time for PCs to be vulnerable. Yet, if an error creeps into either the definitions or update code -- or if the software conflicts with other applications -- it also means less time for companies and antivirus firms to react to the mistake. Take me to Pt II/ Errors not unheard of Take me to ZDNet Enterprise To have your say online click on the TalkBack button and go to the ZDNet News forum. Let the editors know what you think in the Mailroom. And read what others have said.

Post your comment

In order to post a comment you need to be registered and logged in.

You can also log in with Facebook. Log in or create your ZDNet UK account below

  • Login

Will not be displayed with your comment

By signing up for this service, you indicate that you agree to our Terms and Conditions and have read and understood our Privacy Policy. Questions about membership? Find the answers in the Community FAQ

Get ZDNet UK's daily newsletter

Enter your email address to sign up

ZDNet UK Live

EvaBrian

This is a great start to leverage virtualization and standardized deployments, however even a well-managed virtualization solution has its...

34 minutes ago by EvaBrian on AWS CloudFormation automates cloud app deployment
EvaBrian

that's a great news for android users! The cloud is set as the battleground that will decide the fate of Google’s Android and Apple’s iOS as...

2 hours ago by EvaBrian on Google's 'Bouncer' scans Android apps for malware
EvaBrian

Google knows that the only way that Android is going to survive is by a superiority of numbers. By doing that, it is playing a completely different...

2 hours ago by EvaBrian on Apple vs Google: Cloud concepts that clash
awbMaven

""As a result of Butyka's alleged conduct, researchers were unable to use the computers for more than two months while NASA removed the malicious...

2 hours ago by awbMaven on US indicts Romanian over NASA climate change hack
subhorup

It simultaneously worries me and uplifts me that a self-proclaimed group of internet activists name themselves after Indian mythical figures....

11 hours ago by subhorup on Anonymous activists release PCAnywhere source code
naviathan

It's actually far easier to work anonymously on the internet than you think. With tools like Tor bouncing your traffic around the world before...

14 hours ago by naviathan on Anonymous activists release PCAnywhere source code
Agnostic_OS

1000272134 and bluedalmatian with you both there but then I'm still in 10.04 land (and happy with it)

14 hours ago by Agnostic_OS on Ten factors that make Ubuntu 11.10 a hit
apexwm

Interesting article and definitely see your points on the products mentioned. One of the top products for our Help Desk (approximately 20% of all...

21 hours ago by apexwm on Ten flawed products that derail productivity
Paul Hutchinson

Absolutely - this should obviously not be handled my isp - but handled by their hosting operator. What's been suggested here is that my isp police...

21 hours ago by Paul Hutchinson via Facebook on MPs urge ISPs to take down terrorist material
Techs UK

Looks like a great phone. I don't notice any deficiencies in WP7. used IOS before, that's pretty good. I don't spend much time in Apps, all i need...

1 day ago by Techs UK on Nokia pins US 're-entry' hopes on Lumia 900
Larry Bloggy

Now with the help of these apps you are always synced with MS outlook while on the move. Just download apps like xobni or outlookreflex and get...

1 day ago by Larry Bloggy via Facebook on Outlook Social Connector beta 2 and the LinkedIn connector
mike40g123

Your details are wrong. The version currently being made is the one with 2 USB ports, 256MB RAM and a network port. This is the Model B. The...

1 day ago by mike40g123 on Raspberry Pi boards set to go on sale
Moley

The thing that has been puzzling me for quite a while is how Anonymous can remain anonymous whilst not only being active on the Internet but also...

2 days ago by Moley on Anonymous activists release PCAnywhere source code
Don Dilly

If what Semantec is saying is rue, that is even worse and shows a complete disregard for thier users. If what Anonymous claims is true and the...

2 days ago by Don Dilly via Facebook on Anonymous activists release PCAnywhere source code
MattChurchy

Didn't seem particularly biased to me either. Oh though you might have mentioned some other competitors with free search and email services...

2 days ago by MattChurchy on Time for an evil umpire: Google, Microsoft & privacy
Simon Bisson and Mary Branscombe

James - exactly as much as anyone paid you for your comment; I don't feel that I need to say that I'm independant and unbiased, but just for you...

2 days ago by Simon Bisson and Mary Branscombe on Time for an evil umpire: Google, Microsoft & privacy
Carl White

Once they realise symantec are willing to pay real money, they will simply keep extorting, unless of course symantec/authorities can use the...

2 days ago by Carl White via Facebook on Symantec offered hackers $50k in source code sting
Jonathan Hassell

You can find more information on BS 8878 by Jonathan Hassell its lead-author at http://www.hassellinclusion.com/bs8878/ The page includes a...

3 days ago by Jonathan Hassell on BSI publishes first British web accessibility standard
servermanagement

Thanks for this list. Now I know, what to include on my system to make it more functional.

3 days ago by servermanagement on Ten flawed products that derail productivity
1000092626

What if it's a 4 car household? The point is, more bandwidth = more things you can do simultaneously, like streaming HD video in one room of the...

3 days ago by 1000092626 on Virgin Media beats 100Mbps schedule, hikes prices