Should AV software protect against rogue hack/crack files (was: Re: SCR file being posted to usenet ...)

Adam Piggott wrote:

Explain to me why people who use cracks/key gens should be
protected by anti-virus software? It might just be that the
other vendors have better things to do with their time.

If it's the policy of any given AV company/software to be selective
when it comes to malware detection (ie to specifically NOT protect
against malware that is associated with hack/crack files) then they
should advertise that policy - and let that be a factor in how
consumers choose AV software.

Or do you think that AV vendors should NOT publicize their decision to
not protect against rogue cracks and key-gens, thereby keeping
consumers in the dark about the true compentency or capability of
their AV software?

The way I see it, any AV vendor can certainly choose whether to
include or exclude malware detection within known hack/crack/key-gen
files, but there is no coherent argument that can be raised (other
than pure pettiness or malice) for not making end-users aware of such
a corporate-level decision.

I will continue to post the results of malware detection (or lack
thereof) within hack/crack files to establish if any particular AV
vendor does indeed show a policy of detection-avoidance for such
files.

This raises another point: The use of rogue hacks and cracks would
drop if they were detected as trojan/viral/what-ever. You could argue
that anyone who seeks out and installs a keygen or crack (which does
what it's advertized to do) deserves the (possible) infection they
get. I could argue that the internet-at-large has become more
"polluted" because of the infected user, and the vendor for which the
hack/crack was used against has experienced some (perhaps small)
tangible loss because of the crack - so an AV policy of
detection-avoidance has accomplished nothing in this case, and
arguably it has led to the worse of two possible outcomes.

Besides, the incorporation of a given piece of mal-ware into a
hack/crack file doesn't mean that same mal-ware won't migrate to other
types of delivery mechanisms or payloads. For this reason, good AV
software should be blind to the source (or intention) of a piece
mal-ware and just focus on (and protect against) the threat.
.

Relevant Pages

  • Re: IAS - policy profile IP Packet Filter issue
    ... hard to find any sort of documentation (either from Cisco ... The Vendor attribute I added was Cisco-AV-Pair ... > This is happening because the profile element "IP ... >> I've a problem with the configuration of a policy profile ...
    (microsoft.public.internet.radius)
  • Re: Conflict of Interest - My summary
    ... conflict of interest is as follows: ... vulnerability information that would benefit or promote that security ... Whilst the install base may not be as big as that of an OS Vendor, ... Applications can immediately protect its customer base at almost day zero ...
    (Bugtraq)
  • Conflict of Interest - My summary
    ... "IMHO I think the fear has always been that as long as an OS was closed source, that company owning that OS could write or have inside knowledge of vulnerability information that would benefit or promote that security product more than another company. ... Whilst the install base may not be as big as that of an OS Vendor, many of these enterprise solutions can be critical to the daily operation of a business. ... So any vulnerabilities found in these products, these security vendors can mitigate the risk at day zero by applying IPS / IDS signatures to their existing product range in the absence of a patch. ... is it really such a bad thing that an OS vendor who offers up Security Applications can immediately protect its customer base at almost day zero when a vulnerability has been reported to secure@xxxxxxxxxxxx by adding the protection capability within its Secuirity Apps. ...
    (Bugtraq)
  • Re: Mobile Computers Cannot Access Internet away from home
    ... Lan Settings ... ... If the vendor set up a policy to point the clients at a/the ... proxy server would that override or prevent a manual setting? ...
    (microsoft.public.windows.server.sbs)
  • Re: Semi-OT: My LCD has a bright pixel
    ... bright-pixel "policy". ... If no joy, ... leverage to get a replacement product. ... Usually it takes 30-45 days for the payment to be made to the vendor, ...
    (comp.sys.ibm.pc.games.action)