Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

Antivirus Tools Underperform When Tested in LinuxWorld 'Fight Club'

In LinuxWorld 'fight club,' only three antivirus tools catch all the viruses thrown at them

Oh, antivirus products. They're a commodity item, right? They're all pretty much the same.

Wrong, according to a live test of antivirus products for Linux conducted last night at the LinuxWorld event in San Francisco.

In an antivirus "fight club" conducted in front of an audience by network gateway vendor Untangle at the show, 10 antivirus products were confronted with 25 viruses, many submitted by members of the audience. The goal: to see whether the AV tools would catch 'em all.

The results: Only three of the antivirus tools caught and blocked all 25 viruses thrown at them. One tool caught fewer than 10 percent.

"What's surprising about a test like this is how much difference there is between the antivirus products' performance," says Dirk Morris, CTO and co-founder of Untangle. "Some of the products you think will do well don't, and some of the lesser-known products, like open source tools, end up doing well."

The "winners" in last night's contest were Linux tools from Kaspersky and Symantec, and the open source Clam AV. All three tools caught 100 percent of the viruses they encountered. FProt and Sophos caught 94 percent; McAfee caught 89 percent; and GlobalHauri, Fortinet, and SonicWall caught 61 percent.

One product, WatchGuard's Linux AV tool, caught fewer than 6 percent of the viruses sent to it. "We're not exactly sure what the problem with WatchGuard is," says Morris. "The test was set up the same way for all of the vendors."

WatchGuard disputes the test results, stating that it uses ClamAV -- one of the products that caught all of the viruses -- in its own product. "We don't see how the results could be valid -- our product uses ClamAV," a spokesman says.

Untangle first conducted the AV "fight club" two years ago, when it was trying to decide which AV tool to include in its network gateway, which offers a variety of security and network performance tools. "It's a simple test," Morris says. "We just wanted to see which tools worked best."

ClamAV, an open source product, finished at the top of that first test, just as it did last night, and Untangle chose to use the open source product in its gateway. "Open source AV products often get overlooked because they aren't very well marketed," Morris observes. "When we looked at ClamAV's Website a couple of years ago, it was really bad. But the product itself works as well or better than the most expensive tools out there."

For last night's test, Untangle accepted viruses submitted by audience members and other interested parties, and its test set is available online. No zero-day exploits were included. "Most of these are everyday viruses. Some of them have been around for years," Morris says. "These are all things that an antivirus tool should catch."

— Tim Wilson, Site Editor, Dark Reading

Tim Wilson is Editor in Chief and co-founder of Dark Reading.com, UBM Tech's online community for information security professionals. He is responsible for managing the site, assigning and editing content, and writing breaking news stories. Wilson has been recognized as one ... View Full Bio

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
7 Old IT Things Every New InfoSec Pro Should Know
Joan Goodchild, Staff Editor,  4/20/2021
Cloud-Native Businesses Struggle With Security
Robert Lemos, Contributing Writer,  5/6/2021
Defending Against Web Scraping Attacks
Rob Simon, Principal Security Consultant at TrustedSec,  5/7/2021
Register for Dark Reading Newsletters
White Papers
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2021-05-14
An HTTP Request Smuggling vulnerability in Pulse Secure Virtual Traffic Manager before 21.1 could allow an attacker to smuggle an HTTP request through an HTTP/2 Header. This vulnerability is resolved in 21.1, 20.3R1, 20.2R1, 20.1R2, 19.2R4, and 18.2R3.
PUBLISHED: 2021-05-14
Hexagon G!nius Auskunftsportal before allows SQL injection via the GiPWorkflow/Service/DownloadPublicFile id parameter.
PUBLISHED: 2021-05-13
Piwigo 11.4.0 allows admin/user_list_backend.php order[0][dir] SQL Injection.
PUBLISHED: 2021-05-13
The Flask-Caching extension through 1.10.1 for Flask relies on Pickle for serialization, which may lead to remote code execution or local privilege escalation. If an attacker gains access to cache storage (e.g., filesystem, Memcached, Redis, etc.), they can construct a crafted payload, poison the ca...
PUBLISHED: 2021-05-13
Bitcoin Core 0.12.0 through 0.21.1 does not properly implement the replacement policy specified in BIP125, which makes it easier for attackers to trigger a loss of funds, or a denial of service attack against downstream projects such as Lightning network nodes. An unconfirmed child transaction with ...