Consumer Reports creates 5,500 new computer viruses

Filed under: Security

Consumer Reports creates 5,500 new computer viruses

by Jordan Running Aug 18th 2006

Former Download Squad co-lead Marc Perton wrote in to tell us about a bit of controversy stirred up by his current employer, Consumer Reports, which recently conducted one of the most comprehensive tests of anti-virus software to date. The controversy is that for the test Consumer Reports hired a firm to create 5,500 new variants of existing viruses to see how antivirus software reacted to new threats. And, not unexpectedly, the antivirus companies threw a fit. Here's what McAfee's Igor Muttik had to say about it: "Creating new viruses for the purpose of testing and education is generally not considered a good idea." Consumer Union's Evan Beckford defended the test, saying, "We need to anticipate how antivirus software will react to future threats. This is the only way we know to do it. We think the benefits far outweigh the risks." SANS Institute's Alan Paller agrees, saying, "extremely valuable because a great weakness of most leading antivirus tools is that they are slow in detecting new viruses," adding that creating viruses in a lab isn't wrong--distributing them is.

Among the antivirus software tested, McAfee's scored in the middle of the pack, which was led by offerings from BitDefender and Zone Laps. McAfee denies that its criticism of Consumer Reports' methods was not motivated by its score. You can read Consumer Reports' report on how the tests were conducted here.

So, what do you think? Is creating thousands of new virus variants playing with fire, and do all of us stand to get burned as a result, or are tests like this essential to staying ahead of new threats before they're created?

Tags: antivirus, consumer reports, ConsumerReports, mcafee, security, virus, viruses

Reader Comments (Page 1 of 1)

Erzengel said 3:44PM on 8-18-2006

Bit Defender Rocks all the way. I use it as my main antivirus / firewall, and couldnt be happier.

Adam said 4:05PM on 8-18-2006

If I created 5,500 variants of a disease and released them into Earth's population, something tells me the reaction would be a bit more severe.

Chas said 4:14PM on 8-18-2006

They didn't release the viruses - they kept them in the lab. Interesting discussion over on slashdot.
http://it.slashdot.org/it/06/08/18/1631236.shtml

CharlesJR said 4:16PM on 8-18-2006

Get a grip.

No one released the viruses into the "general population". New human viruses are created every day in the lab. They just aren't released into the public.

Same thing happened here.

If Consumer Reports did it, so could others (quite easily). Nice to see how these programs reacted. Most are SUPPOSE to use various technologies to stop "new" threats.

CharlesJR

Diddle said 4:57PM on 8-18-2006

McAfee sucks anyhow, AVG all the way. It can pull out virii that not even Norton can detect... and it's FREE.

Nick said 5:10PM on 8-18-2006

You know, don't most antivirus programs use "Heueristic" algorithms? And, aren't these algorithms supposed to be able to detect new variants and things, as a backup protection for the consumer? If that's the case, then consumer reports basically proved that the heueristic scanning is bogus. No wonder companies are throwing a fit.

Fabulo said 6:12PM on 8-18-2006

Also, nothing was said about the 'malignancy' of said lab created 5500 viruses.

If I was to create a virus for academic reason, I would protect myself by making the virus harmless. Of course, you have to make sure your code acts like a virus, by at least replicating and or exploiting known flaws. But I certainly would not try to delete files, steal passwords or corrupt documents. Duh.

Viruses and malware are a problem because OS and applications are not *designed* to be secure. They are designed to have a shiny interface and be fast. Security will come with *patches* (duct tape held cardboard on the cracks of the walls)

Antivirus companies have a very lucrative market, and all interest in more viruses, so they sure won't point at the flaws that are part of their business models.

Chris said 5:03AM on 8-21-2006

I don't see the problem with this. Every time I look at the various antivirus' info on new virii it seems they identify many as being "not found the wild". The only thing I can assume from that little quote is that the antivirus companies themselves spend an extraordinary amount of time generating their own virii. What's good for the goose is good for the gander. Independant reviews are always better than the claims of a marketing department. Kudos to Consumer Reports, now if only they'll add 2 or 3 more pages worth of the funny stuff from the end of each issue.

nc web site design said 7:49AM on 8-21-2006

It is probably not that big of a risk. They did it in a lab and controlled (hopefully) the entry/exit.

However, I would hope that there would be a better way to test antivirus products. I wouldn't ram my car into a tree to see if the airbag works.

wogdog said 8:03AM on 8-21-2006

You may not have rammed your car into a tree to see if the airbag worked, but the companies that designed/manufactured/sell the airbags rammed many cars into something to test the validity of the product they were selling. I see nothing wrong with this. Just like many other things, the problem isn't that they exist, it is that they get out into the general public.

Featured Time Waster

Civiballs is a beautiful, soothing physics puzzle Time Waster

I have an absolute weakness for physics games, and while Civiballs isn't the strongest physics-based game, what it lacks in the physics department it makes up for a few times over in style and fun.

In Civiballs, you are presented with a few colored balls, and your goal is to get those balls into the same-colored urn on the level. The "civi" part of Civiballs is that there are 3 sets of levels to play, each representing a different civilization. While the civilization doesn't affect gameplay, the artwork for each level is beautifully themed to it's appropriate era.

To play the game, you are given only one tool - a sword with which to cut the chains that are holding the balls. The puzzle part of the game is in figuring out what order, and with what timing to cut each chain. Do it right, and all the right balls end up in the right urns, with no stray balls entering an urn (a no-no). Do it wrong, and you get to start over again.

Civiballs is not terribly deep on gameplay; the entire game can be completed in about 15 minutes. But if you enjoy this type of game, it will be a very enjoyable 15 minutes.

View more Time Wasters