Do you need an antivirus on FreeBSD today ?

Agreed. On the flip side of virus scanning is ensuring none of your critical O/S (and app) files have not been altered. This is where tripwire and aide can help out. Of course tripwire and aide are not a silver bullet. You simply can't install and forget them. Each needs a comprehensive change management strategy to work properly. Otherwise it's just noise.

Many companies want that silver bullet to solve this problem. They fail to realize that tripwire and aide are only 15% of the solution. The other 85% is organizational to track change and communicate that to the security officer who maintains the baseline signatures in tripwire and aide. Otherwise every alert is a "compromise" where in fact it's probably a patch or legitimate software install. The time spent doing this after the fact will quickly result in missing an unauthorized change to a critical file.
There's kind of a difference between unauthorized changes to files and unauthorized network connections / host intrusions. BTW, FreeBSD has security/snort and Wireshark for packet sniffing, if you like. It's usually kind of a pain to remember to turn the antivirus off every time you need to upgrade/patch something. This is why most companies just have a few dedicated appliances set up as firewalls. You gotta have appropriate tools for the job.
 
And how would the browser access that code in a pdf on your computer? (Answer: it can't.)
Totally agree. The JS bug was probably written for a windows client.
Nonetheless It is helpful to know that you have javascript embedded in files in your downloads directory.

I would rather weed thru 250 false positive Open Office macros just to find that one malicious file.
Even if not exploitable. I want to know about it.
Thanks to ClamTk I do.
I do like my firewalls tripwire.
 
There's kind of a difference between unauthorized changes to files and unauthorized network connections / host intrusions. BTW, FreeBSD has security/snort and Wireshark for packet sniffing, if you like. It's usually kind of a pain to remember to turn the antivirus off every time you need to upgrade/patch something. This is why most companies just have a few dedicated appliances set up as firewalls. You gotta have appropriate tools for the job.
Firewall is not the same as patching, antivirus, file signatures and the like. Firewalls are one piece of the puzzle. People who stand up a firewall and consider the job done are always surprised when when their site is compromised. (Just like people who think a VPN will protect them.)

Security is a layered approach. One piece of the puzzle does not secure a site.
 
Firewall is not the same as patching, antivirus, file signatures and the like. Firewalls are one piece of the puzzle. People who stand up a firewall and consider the job done are always surprised when when their site is compromised. (Just like people who think a VPN will protect them.)

Security is a layered approach. One piece of the puzzle does not secure a site.
I do agree that security is a layered approach. But there are appropriate tools for every layer. You can't exactly tell snort to act like pf. This is partly why I'm not wild about solutions that claim to be all-in-one, like Aide or Tripwire. They tend to focus on just one layer, and other layers suffer as a result.
 
That goes directly to my point about what is actually doing rendering of the document. Most browsers have a knob that lets you disable automatic execution of javascript, of course doing that can break a lot of websites.

Yes I figured out how to use Ublock very well. Site by site blockage, Some just multimedia elements off and some sites all javascript off. I like the granularity. Some slippery ones still get by.

Having a hosts blocklist right at the firewall is nice.
Firefox seems to hide the settings for how to handle pdf and wants to render it for you. SeaMonkey is respectful.

I've always preferred downloading and using my own application to open or explicitly set my application as the one to use in the browser.
Absolutely. On top of that I use xpdf which does not have modern virus prone features.

I realize ClamAV works by heuristics, and that is not perfect. But I cannot look inside every file.
Clam is a resource hog. I don't run it automatically just monthly. Usually run it overnight.

So my approach is layered in my mind. Security is a state of mind.
If you really wanted to be secure you would not be connected to the internet.
 
  • Like
Reactions: mer
Uhhhh... It was researchers at Kaspersky who uncovered the Stuxnet virus back in 2010's. To build an effective defense against a virus or a DDoS - it does take a bit of knowledge of how it even works, and what's targeted.
Well, Kaspersky is a particularly interesting case of virus work. It is well known that Kaspersky and InfoWatch are deeply tied to the Russian espionage service (the FSB), and to Russian black-hat culture (some of which work for the Russian government, some for criminal organizations). Kaspersky is also a white-hat business that sells legitimate virus scanning software, and it has gone to some effort to legitimize itself. This double-duty setup is very much like a bad mafia movie, where the mafioso guarantees your security, but also takes protection money for that.

Stuxnet is widely acknowledged to be an Israeli effort to damage the Iranian nuclear program, perhaps (or likely?) with assistance from US government agencies.

Would I buy or run Kaspersky software myself? Hell no. Might as well send to copy of my disk right to Moscow.
 
… Security is a layered approach. …


I use it as much for blocking advertisements etc. as I do for blocking things such as scams.

1653126374979.png 1653126553842.png

 
Malware BrowserGuard would be replaced by ublock Origin, noScript, deCentralyse extensions here. Any reason to use it in addition or as a replacement? I know Malware coy is an antivirus coy though.
Also Trocker, CSS Exfil Protection and minerBlock. Bonus for Privacy Badger.
 
You you have citable sources or is it chitchat?
Start at the Wikipedia page. In particular the ones for Mr. and Mrs. Kaspersky (they are the CEOs of the Kaspersky anti-virus company and of InfoWatch, an anti-leak company, respectively).

For more details, you just have to search the web. But, as I said above, Kaspersky tries to straddle both worlds: On one side they are white-hat hackers that sell legitimate and useful anti-virus or data protection products; on the other side they work closely with both government and non-government organizations in Russia.
 
Start at the Wikipedia page. In particular the ones for Mr. and Mrs. Kaspersky
Be assured that I do at least low hanging research before pressing the "Post reply" button. My conclusions from reading Wikipedia was and still is, that what you said cannot be confirmed by reliable sources. As long as you cannot provide appropriate cites from credible sources you make assumptions.

There is nothing wrong with assumptions, they may be or not may be facts. And that is the point where beliefs are starting.

You write "InfoWatch are deeply tied to ..."
I would write Infowatch may be tied to ... and those are assumptions, which I'm not in the position to confirm from independent sources.

For this reason I asked for citable sources. It could have been that you know hard facts. I'm sorry that this is not the case. Talking about whatsoever deeply ties to any government secret services around the world as a not insider is just adding a little noise, I guess.
 
Malware BrowserGuard would be replaced by ublock Origin, noScript, deCentralyse extensions here. Any reason to use it in addition or as a replacement? …

I can't imagine uBlock Origin being a suitable replacement for Malwarebytes Browser Guard. (Not unless uBlock Origin is set so aggressively that it breaks many websites.) Please see, for example:
Worth noting: Expanding a malware domain list : uBlockOrigin – too arduous, I abandoned attempts to improve what was used by the extension at the time.
 
My conclusions from reading Wikipedia was and still is, that what you said cannot be confirmed by reliable sources.
I freely admit that I do not have citable sources for my opinion that both these businesses are tied to the Russian state intelligence operations. There is lots of circumstantial evidence on the web; search for "FSB Kasperskaya" or InfoWatch or Kaspersky (Kasperskaya is the last name of Mrs. Kaspersky in the Russian way of writing it, she's the CEO of InfoWatch, and co-founder and ex-wife of Kaspersky anti-virus). This includes legal documents and articles in respectable newspapers. Hard facts that are published tend to not exist when government intelligence is concerned.

For my personal taste, it is sufficient if US federal agencies tell their contractors (which includes pretty much all large computer companies) that they must not use Kaspersky antivirus products (nor SuperMicro motherboards) on any work that involves the federal government as a customer. That happened quite a few years ago, long before the current Ukraine kerfuffle, and long before the Trump presidency.
 
I can't imagine uBlock Origin being a suitable replacement for Malwarebytes Browser Guard. (Not unless uBlock Origin is set so aggressively that it breaks many websites.) Please see, for example:
Worth noting: Expanding a malware domain list : uBlockOrigin – too arduous, I abandoned attempts to improve what was used by the extension at the time.
I was sure that the Malware Browser Guard would focus on malware while uBO is meant to block scripts, XS scripts, etc almost similar to noScript. I was not so sure *ware was necessary on *BSD as most people have been saying here.

Interestingly, there is pfblocker-ng at firewall to block these *wares thereby leaving the web-clients to block scripts etc.
 
I can't imagine uBlock Origin being a suitable replacement for Malwarebytes Browser Guard.
It is.

None of that is needed. Complete waste. The provided lists are all you need. Keep it updated.
Then you use your buttons for screening individual sites.
They are very important.
At the far right is "Click to wholly disable Javascript on this site". This is nuclear.
To the left of that are lessor blockers for multimedia and popups.
These buttons maintain a site by site preference for your javascript.
That is the strength of uBlock to me. Blocklists are a dime a dozen.
Heck I used to keep a several megabytes /etc/host file now all done at the firewall.
 
I was sure that the Malware Browser Guard would focus on malware while uBO is meant to block scripts, XS scripts, etc …

Malwarebytes Browser Guard offers a good mixture.

It is. …

When I last performed a comparison: for malware sites, uBlock Origin was not.

… The provided lists are all you need. …

When I last performed a comparison: for malware sites, the lists that were used by uBlock Origin were not. That's why I aimed to improve the lists.

Is there evidence that the lists have improved so much since then, to excel?

Emphatically:

set so aggressively that it breaks many websites.

I don't want that breakage. You might accept that (as a side effect) from a complementary product, but Malwarebytes Browser Guard does not do that.
 
I freely admit that I do not have citable sources for my opinion
Thank you for your honerable clarification.

... if US federal agencies tell their contractors (which includes pretty much all large computer companies) that they must not use Kaspersky antivirus products (nor SuperMicro motherboards) on any work that involves the federal government as a customer.
Have you seen this paper? Do you remember when it was issued (month/year)? And which agency issued it?
 
GSA issues blanket purchase agreement for purchases. So they are the purchasing agency.


Then there is this:
 
Back
Top