Antivirus Makers Work on Software to Catch Malware More Effectively

Consumers and businesses spend billions of dollars every year on antivirus software. But these programs rarely, if ever, block freshly minted computer viruses, experts say, because the virus creators move too quickly. That is prompting start-ups and other companies to get creative about new approaches to computer security.

“The bad guys are always trying to be a step ahead,” said Matthew D. Howard, a venture capitalist at Norwest Venture Partners who previously set up the security strategy at Cisco Systems. “And it doesn’t take a lot to be a step ahead.”

Computer viruses used to be the domain of digital mischief makers. But in the mid-2000s, when criminals discovered that malicious software could be profitable, the number of new viruses began to grow exponentially.

In 2000, there were fewer than a million new strains of malware, most of them the work of amateurs. By 2010, there were 49 million new strains, according to AV-Test, a German research institute that tests antivirus products.

The antivirus industry has grown as well, but experts say it is falling behind. By the time its products are able to block new viruses, it is often too late. The bad guys have already had their fun, siphoning out a company’s trade secrets, erasing data or emptying a consumer’s bank account.

A new study by Imperva, a data security firm in Redwood City, Calif., and students from the Technion-Israel Institute of Technology is the latest confirmation of this. Amichai Shulman, Imperva’s chief technology officer, and a group of researchers collected and analyzed 82 new computer viruses and put them up against more than 40 antivirus products, made by top companies like Microsoft, Symantec, McAfee and Kaspersky Lab. They found that the initial detection rate was less than 5 percent.

On average, it took almost a month for antivirus products to update their detection mechanisms and spot the new viruses. And two of the products with the best detection rates — Avast and Emsisoft — are available free; users are encouraged to pay for additional features. This despite the fact that consumers and businesses spent a combined $7.4 billion on antivirus software last year — nearly half of the $17.7 billion spent on security software in 2011, according to Gartner.

“Existing methodologies we’ve been protecting ourselves with have lost their efficacy,” said Ted Schlein, a security-focused investment partner at Kleiner Perkins Caufield & Byers. “This study is just another indicator of that. But the whole concept of detecting what is bad is a broken concept.”

Part of the problem is that antivirus products are inherently reactive. Just as medical researchers have to study a virus before they can create a vaccine, antivirus makers must capture a computer virus, take it apart and identify its “signature” — unique signs in its code — before they can write a program that removes it.

That process can take as little as a few hours or as long as several years. In May, researchers at Kaspersky Lab discovered Flame, a complex piece of malware that had been stealing data from computers for an estimated five years.

Mikko H. Hypponen, chief researcher at F-Secure, called Flame “a spectacular failure” for the antivirus industry. “We really should have been able to do better,” he wrote in an essay for Wired.com after Flame’s discovery. “But we didn’t. We were out of our league in our own game.”

Symantec and McAfee, which built their businesses on antivirus products, have begun to acknowledge their limitations and to try new approaches. The word “antivirus” does not appear once on their home pages. Symantec rebranded its popular antivirus packages: its consumer product is now called Norton Internet Security, and its corporate offering is now Symantec Endpoint Protection.

“Nobody is saying antivirus is enough,” said Kevin Haley, Symantec’s director of security response. Mr. Haley said Symantec’s antivirus products included a handful of new technologies, like behavior-based blocking, which looks at some 30 characteristics of a file, including when it was created and where else it has been installed, before allowing it to run. “In over two-thirds of cases, malware is detected by one of these other technologies,” he said.

Bits Blog: Android Malware Creeps Into Cellphone Bills

Lookout

Smartphones are meant to be headache-free compared with old-school computers. But malicious software written for Android devices can be even sneakier than the malware that invaded PCs.

The most prevalent form of Android malware scrapes small amounts of money from smartphone owners by making secret charges to their phone bills, according to a report published by Lookout, a mobile security company in San Francisco. This type of malware is called toll fraud, and it has the potential to fool plenty of people who don’t pay close attention to their phone bills every month.

But how does toll fraud work if the carriers control our bills? The process is actually very complex, said Derek Halliday, a product manager at Lookout.

First, it helps to understand a legitimate transaction involving text messages. Say, for example, a person wants to send a text message to a service to buy a new ringtone. When this happens, the cellular network forwards the text message to a middleman service, which handles the transaction between the wireless provider and the ringtone provider. The ringtone provider then shoots a message to the cellphone owner asking for confirmation of the order. When the customer confirms the order, he receives the ringtone, his cellphone bill is charged, and the carrier takes a cut and gives the rest of the money to the ringtone provider and the middleman service.

Here’s how toll fraud works: A person downloads a malicious app. The app invisibly sends a text message to a service that uses a middleman service that has a relationship with the malware author. A confirmation message is sent back to the malware, which blocks it from being seen by the customer and confirms the charge. The charge goes to the user’s bill, and the carrier takes its cut and gives the rest of the money to the service and the middleman, and thus the malware author.

In its  report, Lookout estimates that from the beginning of 2012 to the end of 2013, 18 million Android users may encounter malware. About 72 percent of the malware that Lookout detected this year was toll fraud, and the company expects this number to grow, because even though the process is complex, the code isn’t difficult to replicate. The company advised cellphone owners to regularly check their bills for suspicious charges.