Topic: Trend Micro CEO: Hackers Hitting AV Infrastructure

[Samker]

It's become an all-too-common scam: A legitimate Web site pops up a window that looks just like a real security warning. It says there's something wrong with the computer, and click here to fix it. A few clicks later, the victim is paying out US$40 for some bogus software, called rogue antivirus.

Rogue AV scams have become a big problem in recent months, but according to Trend Micro CEO Eva Chen, it's part of a more sinister, strategic attack on the antivirus industry in general. Criminals "can fake any other application. Why do they fake AV?" she asks.

According to her, a lot of today's security problems are designed not only to steal information from victims, but to undermine the credibility of companies like Trend Micro itself.

One way hackers have done this is by changing the way their software is put together each time they attack, forcing the AV vendors to bloat up their products with hundreds of thousands of new detection signatures.

In response, Trend was one of the first companies to push reputation-based technology into its antivirus products, developing its Smart Protection Network to identify and block not just viruses themselves, but also the malicious Web sites that are used to distribute malware.

Since 2004 Chen has served as CEO of the company she co-founded in 1988. She dropped by IDG News Service offices in San Francisco this week to answer a few questions. The following is an edited transcript of her interview.

IDG News Service: Microsoft has done a good job of making Windows more secure, but are Windows users better off today than they were five years ago?

Eva Chen: If Microsoft thinks it's secure enough, why do they bother to come up with MS Security Essentials for a free download on the side? With so much social engineered malware it actually has nothing to do with whether Windows itself is secure or not. It's the user's behavior. Plus there are so many applications -- either the browser or other applications' vulnerability, not just Windows.

IDGNS: It almost sounds like you're saying that things are worse?

Chen: Yes I would say so. …It has nothing to do with whether Windows is secure or not. It's just that the whole environment is much more unsafe. Hackers are making more money. And with the economic downturn, the criminal rate is going up, and therefore [there is] more cybercrime.

IDGNS: People say that conventional antivirus has not been up to the task and maybe even takes the wrong approach.

Chen: Actually I was the first one to say that. Last year I said the antivirus industry sucks. We were all competing on something that was irrelevant: our detection rates. You're at 100 percent detection rate this minute, the next minute it's down to 70 percent. What's the point of that competition?

There are really two industries fighting. The hackers, they are attacking the antivirus industry's infrastructure. How? First, they created all these variants and all these downloaders. They knew that the whole industry was competing against each other for detection rate. So when they came out with all these variants, it forced all the antivirus companies to add lots of pattern files. Those pattern files got so bloated because of the competition, [that] one it [created] lots of false alarms. So people hated antivirus for so many popups and false alarms. Second, the performance got really bad, so users tended to disable it. Two years ago there was a survey, called "The Most Hated Application," and antivirus -- not ours, but antivirus -- was on the top. So they attacked the whole antivirus industry in this way and therefore if we continue to compete with the detection rate thing, it just plays into their hands.

The second way they attacked antivirus infrastructure is the fake AV. If you look at this, they can fake any other application. Why do they fake AV? They make money and also they ruin antivirus companies' reputations and confidence in the whole antivirus industry.

Can you imagine our support engineers getting phone calls, "Hey your antivirus did not detect these viruses. This other antivirus detected all these viruses for me." And we have to explain to them, "No no no, that antivirus is actually a virus." It's a large burden for the antivirus [industry] to defend ourselves and to defend against that kind of bad reputation.

(PCW)