Security Software? Think Again

Wednesday, May 11, 2016 @ 10:05 AM gHale


Is the antivirus program running on your computer really making your computers safer to use?

Probably not.

New research from Concordia University in Montreal shows security software might actually make online computing less safe.

RELATED STORIES
Ensuring ‘Trustworthy’ Systems
Looking to Hike Online Social Networks Security
Working to Quash Quantum Computer Threat
DHS’ Risk Analysis Tool Licensed

Fourteen commonly used software programs that claim to make computers safer by protecting data, blocking out viruses or shielding users from questionable content on the Internet ended up examined for the study, said researchers Mohammad Mannan, assistant professor in the Concordia Institute for Information Systems Engineering (CIISE), and PhD student Xavier de Carné de Carnavalet

Time and again, the researchers found these programs were doing more harm than good.

“Out of the products we analyzed, we found that all of them lower the level of security normally provided by current browsers, and often bring serious security vulnerabilities,” said de Carnavalet, who remained surprised by how widespread the problem has become.

“While a couple of fishy ad-related products were known to behave badly in the same set-up, it’s stunning to observe that products intended to bring security and safety to users can fail as badly.”

At the root of the problem is how security applications act as gatekeepers, filtering dangerous or unwanted elements by inspecting secure web pages before they reach the browser.

Normally, browsers themselves have to check the certificate delivered by a website, and verify it ended up issued by a proper entity, called a Certification Authority (CA).

But security products make the computer “think” they are themselves a fully entitled CA, thus allowing them to fool browsers into trusting any certificate issued by the products.

This research has important implications not only for everyday computer users, but also for the companies producing the software programs themselves.

“We reported our findings to the respective vendors so they can fix their products,” Mannan said. “Not all of them have responded yet, but we hope to bring their attention to these issues.”

“We also hope that our work will bring more awareness among users when choosing a security suite or software to protect their children’s online activities,” said de Carnavalet, who cautions that Internet users should not view these security products as a panacea.

“We encourage consumers to keep their browser, operating system and other applications up-to-date, so that they benefit from the latest security patches,” he said.

“Parental control apps exist that do not interfere with secure content, but merely block websites by their domain name, which is probably effective enough.”