Vyacheslav Medvedev: To lovers of freebies

Vyacheslav Medvedev Computer protection

Trying to promote their software, sellers of new software products sometimes distort and even grind the facts, and sometimes even exert psychological pressure on a potential buyer. About how not to succumb to the tricks of Soft sellers - senior analyst of Doctor Web in a new column on Polit.ru.

There are two infinities in the world - an endless universe and an endless thirst for freebie.
Quote from the Internet

Free cheese happens only in the mousetrap, but someone paid for it when buying.
Aphorism

“How many times have they repeated to the world ... but only everything is not for the future.” The ingenious words that constantly come to mind when you look at the technical support or read forums. Everyone does not want to overpay, but if possible - I do not want to pay at all. The desire is understandable, but for some reason at the sight of slogans such as “20 percent for free!”, “Sale!”, “New Year's discounts!” And similar ability to think is turned off automatically.

All this was a saying. Actually, the reason for writing the article was one book that advertises free products. I personally have nothing against free, but since I am engaged in safety by the nature of the activity, I decided to look into it ...

At first I wanted to write a review, but then changed my mind. The bottom line is that the methods used in the book are typical. I met them repeatedly, so let the book remain nameless, but serve as a source of “typical” quotes for analysis. We will leave spelling and punctuation in quotes unchanged.

As they say, disclaimer. The author has nothing against free programs in general. Moreover, he uses free programs. The article is not directed against specific programs - many of the recommended applications to the author are familiar with firsthand and the declared functions perform. The article is directed against the methods of promotion, defaults and direct fraud. That is why you will not find a single name of the program here.

“ In 2008 alone, 15 million (malware - V.M.) were already discovered, and in 2009, it is scary to even imagine, almost 34 million. With such an increase in “malicious ones”, a critical temporary point is just around the corner, when the computer simply “chokes”, its computing resources are simply not enough to work an antivirus program using the signature analysis . ”

This is a substitution of concepts and pressure on emotions. Yes, the growth of harmful programs is terrible (who is interested - live . Drweb . Com to help), but:

• All these millions will not be processed on any user's computer. How much you downloaded files from the Internet a year ago, you will download the same amount. The number of files verified, respectively, will not increase much;

• At the moment, there are no signatural antiviruses (that is, detecting malicious files according to the characteristic pieces of code - signatures). All of them died out at the turn of the century, when polymorphic viruses appeared, nor having constant signatures: their body was created again at each launch. Again, professionals work on antiviruses. If there are three and a half million records in the database, you do not need to sort them out all - there are methods of minimizing the path to the right entry (more details in the theories of databases; if, say, to look for personal information in the country's population database by crossing, you can not wait for the end of the search, and the information is issued almost instantly);

• Quite often, dozens, hundreds and thousands of malware are found by one entry, or using the heuristic mechanism (about it below).

So everything is not so scary.

“ In five years, a viral base of any traditional antiviral program will occupy a volume of about 1 gigabyte! Each time when updating the viral base (and this is a good antivirus program 3 to 4 times a day) will need to download hundreds of megabytes of new antivirus synutures! ”

Well, first, normal antivirus programs are updated once per hour, or even more often. The figures of the forecast, of course, are amazing, but they are taken from the ceiling. Now updates are measured by kilobytes per day. Someone notices how he comes daily at 12 receptions, say, with a margin of half a margin?

Why are these horror stories? “ As you understand, the further development of traditional antivirus programs is a dead end. The way out of this dead end is the use of “cloud” antivirus services to protect the computer . ”

Cloud services really have many advantages. Clouds, whatever one may say, is fashionable. And, of course, clouds are safe. Everyone knows this. Let's look at the argument?

“ How does it work? Cloud antivirus consists of two parts - client and server. The client part is installed on the user's computer and has a minimum size. This part contains the engine. The engine scans the data and sends for analysis, and not the files themselves, but only the control amounts of files (the so -called hash) on the server. The server (and not on the user's computer !) Contains the base of synatures ( viral base). Having received the hashs of files, the server is looking for analogues in its viral base. If malicious programs are detected, then the server sends scripts (special commands) to the user's computer when executing which the computer is cleaned of “cereals” . ”

Almost right. For the verified file, the control amount is considered unique to each file, and this number (namely, not a file) is transmitted to the server. But then more interesting. The file is not transmitted to the server (someone scared us the size of the update, it is scary to imagine that all your files will be referred to a remote server. Yes, and you are unlikely to be happy if your personal files travel on the Internet). The server is not a shaman. By the control amount, determine that there is a virus in a certain file inaccessible to it, it cannot. He can only compare it with previously arrived control amounts. The viral base is not needed for this. If there is no control amount in the database, then to find out whether there is a virus or not, the check is carried out on the user's computer. Thus, the procedure is actually approximately as follows: the calculation of the control amount on the local computer is a reference to the remote server, a comparison in the database with previously received amounts - response to a local computer - checking for viruses, if there was no amount in the database. Few people know that the control amounts were considered earlier, and the computer did not check the files that have not changed. With the transition to the clouds to this procedure, another time was added to the reference and to wait for the answer.

Well, do not forget that with each update of your programs (and this must be done so that the viruses do not climb through vulnerabilities) control amounts must be recounted. But this is not scary.

Another thing is more interesting. Not all viruses are known to the antivirus at any time. The path from the hacker to infection is much shorter than the “hacker - infection - infection - obtaining a malicious program with an antiviral company - the release of update - receiving an update by the user.” Therefore, the wounds of revered and cleaned files must be double -checked and recalculated for them all control amounts. You never know what. Recall: updates go once an hour.

In fact, the cloud is a knowledge of a million “lemmings” that a certain file present among the majority was recognized as clean. Suppose someone received updates first, double-check the files and climbed into the cloud with a cry: “I have a virus there!” What will he get in response? Right. “Without racing, a million lemmings cannot be wrong.” Meanwhile, only one to three minutes is required to take all the money from the banking account on statistics.

So maybe antivirus manufacturers who do not drive their users kicks into the clouds are not so wrong?

By the way, by the way. The data transfer to the clouds should be safe - you do not want hackers to replace the transmitted data on the fly? Therefore, something type of encryption or protected channel should be used. Both that and the other additionally slows down the transmission process (for encryption, as well as for the process familiar to everyone in the archive, it takes time). And the realities of Russia are required when using encryption from each independently using them using a special license to work with cryptographic tools. The law is harsh, but have you ever heard of a user who received such a license?

Next:
“ So, the use of a“ cloud ” antivirus :
2. It makes it possible not to update the viral base (it is on the server). ”

We have already dismantled this - viral databases should be on a local computer. Otherwise, with a break in communication with the Internet, or only with updates servers, the computer will remain without protection.
“ 3. Provides the best protection based on the so -called“ collective mind ”. Millions of computers connected to the “cloudy” antivirus service are sent information to the service about new threats to automatically detect and classify new types of malware ” .

Oooh! It was said above that there is no database on the local computer. How do they find out on it, is there a virus in the file? In the antivirus, there is artificial intelligence with the qualification of a viral analyst, capable of not only recognizing a new threat that is absent in bases, but also classify it? Otherwise, I cannot explain this information. Why is the media to be silent? Where is the Committee for the Protection of Artificial Intelligence?

“As it were, Antivirus was not good ... , there is always a threat to let some kind of“ representative ”of malicious software on a computer . You can reduce the threat by setting
The computer is a second antivirus program that will not conflict with the main one . ”

One program could not cope - we put the second and we hope that they will not climb to fight with each other, trying to get access to one file at the same time. Again, instead of one check, the file is now checked twice. Someone hopes that the waiting time for opening a file will be reduced from this?

"The XXX uses a Yyy -engine with an heuristic analyzer."

And the men did not know! In all antiviruses, except for, may be falseangs (http://ru.wikipedia.org/wiki/lzhaantivirus), heuristic analyzers are used. They are needed to detect malicious programs that have not yet been analyzed for analysts, but similar in behavior to previously studied. Apparently, there is nothing more than a standard opportunity since the last century.

“ When testing XXX I found as many as 84 (according to other sources, almost 100 - V.M.) spy, Trojan, etc. Which missed the antivirus installed on the tested computer . ”

A typical approach to advertising. A hundred discovered, and how much was? What is the percentage of detection? And were the viruses? Maybe “clean” files were declared viruses? False triggering is erroneous detecting a file or site that does not contain malicious code. The phenomenon is rare, but it is found. Especially with the level of paranoidality of the heuristic mechanism, hidden under the ceiling.

“ 4. Another of the mandatory security applications that you need to have on the computer is the so -called anti -pioneer program .”

Another magnificent myth. For some reason, it is believed that antivirus catches exclusively viruses. Other types of harmful programs should catch other programs - Anti - Malware , Anti - Spyware , Anti -Retutes. But for some reason I have not seen Antitroyanov. Apparently, you do not need to catch them?

In fact, antiviruses catch everything! And viruses, and Trojans, and spy software, and ... in general, everything that can harm the computer. No need to put the third and fourth antivirus.

“ Spyware software is programs - spies that are imperceptibly placed on you on your computer to control and report on the user’s actions. They became a real scourge of the Internet . ”

The Beach Internet is Trojan programs for theft of money from your accounts. That's what it is really difficult to defend yourself and where the money spin!

“ Consider the best, in my opinion, Spyware ZZZ program . It has a resident monitor, which in real time monitors the system and prevents attempts to penetrate the computer of malware . The scanner available in the program will help to find and place in "karatin" or remove already introduced objects. The program also includes the virus protection module (Clamav ). ”

As expected - the third antivirus.

“ In addition, this program works very quickly and does not slow down the system .”

One works fast, the second - fast, the third is also quickly. But for some reason, the smaller the size of the viral base (the amount of knowledge about the viruses), the faster the search for it. Maybe, before talking about the speed of work, let's take a look at the number of records in the viral base?

“ The last wave of infection of computers with Trojans, which requires to unlock the entrance to the system, send fraudsters a paid SMS message occurred while trying to close the porno-bank. By clicking on the closing cross of the window, users launch the installation of Trojan on the computer . There is the possibility of blocking banners. This can be done by the browser setting up. But the easiest way, especially for ordinary users who have no time to deal with the settings, is to install a wonderful free program ... The program blocks most of the porn advertising and advertising sites of dubious content. The program does not require additional settings . ”

Maybe you don't need the fourth antivirus? The fight against the Trojans is the case of an antivirus program. Part of the stream, of course, can be blocked by blocking pop -ups, but not all. Not all.

“ An excellent tool for protecting your computer is a“ cloud ” service ... The service automatically blocks sites containing viruses , security threats . Fishing sites are also blocked . ”

Each normal antivirus has filtering Internet resources on black and white lists. External DNS services have their own niche -for example, protection of computers and mobile devices, which can not be put antivirus on one reason or another. But for some reason, it seems to me that the computer, which has already been piled up by four antiviruses, does not apply to this.

“ To date, this is the only one in Russia (there are a lot of analogues in the world) a free “ cloud ” Internet filtering service .”

Not the only one. But we will not start advertising, especially since the paragraph below describes an almost complete analogue.

“ Parents who are baking about the moral health of their children, I strongly recommend installing the program ... Unlike the service ... DNS, which works on the principle of“ not to let the user on the dangerous and malicious sites ”, the program ... works on a different principle -“ put the user only on well -known safe sites ”.

In one program, black lists were used so as not to let them on them, in the second - they simply prescribed a list of well -known sites recognized as normal.

“I recommend that the seventh component part of the complex protection establish a unique program ... The program ... is not an antiviral program, not an anteshpion in its classic form, not a firewall. ... allows you to control the installation of programs and warns about attempts to implement malicious programs. ... controls especially important system areas - the loading area, system files, registry. It is these areas that are usually changed by malicious programs. ”

E ... what does the antivirus do? After all, it also controls dangerous places (on the same list) and prevents attempts to implement if someone is unresolved tries to change these areas.

“Well, the last brick in our complex protection is an extremely useful utility ... During the work, the developer decided to make an algorithm for identifying malicious programs more universal. And he succeeded! "

Total - 8 programs and utilities that play the role of antivirus. Someone wanted to make sure everything works and does not slow down? Tips for you. Maybe you don’t need to suffer and you just have to put an antivirus?

It is stupid to hide that the goal of any company is profit. If only because employees sometimes want to eat. And if possible, eat delicious. Yes, there are sales at a loss, but usually these are one -time promotions in order to clean the warehouse, change the type of activity or displace a competitor from the market. For some reason, there are no sponsors for commercial companies that allow them to live at a loss for a long time. For interest, let's figure out. There are no viral analysts in the present time. In the company developing antivirus, they need at least a dozen two. And you won’t manage students here - high -paid professionals are needed. And you can’t put a small salary to them - they will lure instantly: they have hunger on the market. But the antivirus core is not enough to write. You need to write the program itself (and under a bunch of operating systems), test the lack of problems and compatibility with a bunch of programs, write documentation, make and support the site. We need developers, testers, technical recorders, web designers. Accountants and managers are also needed. How much will the people get? At least a hundred. Look on the Internet at work search sites, count only salaries and multiply them by three - taxes, rent, purchase programs and computers ...

Автор гарантирует: за время написания статьи не пострадал никто, кроме поддавшихся на советы доброхотов.