The Anti-virus Times

Monday, July 2, 2018

Since botnets exist, anti-viruses must be inadequate.
Or, perhaps, they’re completely useless?

A comment from an Anti-virus Times reader

Funnily enough, the above comment appeared while we were wondering whether we should once again write about things that seem to be quite obvious. So we got our answer when we read that comment.

At first, Chinese cyber espionage was regarded as the main motive, but the reality proved to be much simpler than that.

According to the Taipei Times, the drives got infected while Shawo Hwa Industries Co., a New Taipei contractor, was conducting maintenance routines “to transfer an operating system to the drives and test their storage capacity”.

Well, an incident like this one could happen anywhere. We often mention that when a malware attack commences, the anti-virus may not have all the virus definitions it needs. There was a time when one could amass an entire collection of infected CDs with a label stating that they all had been scanned by an anti-virus.

However, the malicious file in the CBI incident:

1. Was created several years ago by a Polish crime ring.
2. Because of its “old” age, it could only infect 32-bit platforms.
3. Most anti-viruses could detect it easily.

So the malicious file "resided" on the supplier's computer (or on another company's machine from which it sneaked onto the supplier’s), and no one noticed anything.

This incident is not unique.

That's why many information security regulations documents and guides contain clauses like this one:

#removable_media #anti-virus_scan #malware