In an interview with Blorge.com, David Hall, Symantec’s Product Manager Asia-Pacific Consumer Products and Solutions, was reported to have said,

“If you are only relying on free antivirus to offer you protection in this modern age, you are not getting the protection you need to be able to stay clean and have a reasonable chance of avoiding identity theft.”

This is actually an incredible statement coming from Symantec. Mention Symantec’s anti-virus software at a techie meeting and you will often see people’s eyes roll with comments such as bloatware and jokes about the Symantec product being the virus itself, with many having major problems removing the Symantec AV product even when using the Symantec removal tool! 

Hall went on further to comment on Microsoft’s Microsoft Security Essentials offering as an incomplete solution.

“Microsoft’s free product is basically a stripped down version of the OneCare product Microsoft pulled from retail shelves. Consumers don’t need less protection, they need more.”

The fact is no virus checker free or not is failsafe. It is a myth. Consumers also don’t need more protection, they just need protection that works and in spite of the best endeavours of the AV industry, it is failing to provide protection that works. There are many reasons for this mostly to do with the fact that there are many known methods to bypass Antivirus software and as can be seen in the diagram below the Antivirus software itself has provided hackers an opportunity to compromise every single system within an organisation due to the fact that it integrates into the core of your operating system and many AV vendors are not using secure coding techniques.

                                                © Nruns.com – Death of Defence in Depth

The diagram above illustrates just how open to attack AV can make your entire organisation. It is from an article called the Death of Defence in Depth about how your AV solution can work against you by bypassing your entire defence system and also gives line by line descriptions of simple techniques hackers regularly use to bypass your AV defence.

Drive by downloads
The point here is that whether your AV solution is free or not is that your system is still open to infection. So the real question is what can a free AV give over paid for AV? According to Hall

“If you look how most infections are coming now, they are coming from drive-by download, and while these often do come through the web browser, attackers are not necessarily only targeting the web browser. Think about all the plug-ins you have installed on your machine – RealPlayer, Flash, QuickTime – all of these have vulnerabilities too. With free antivirus software you may or may not be updating against these vulnerabilities, and we’ve seen that more than half of the attacks are getting browser plug-ins rather than the browser itself.

That’s why free antivirus is not enough: you need in-depth layered technologies, which only come from the more mature paid suites. Imagine what it must be like for somebody who is not actually charging to be able to pay their security researchers to be able to keep up. We’ve made more virus definitions last year than we have in the last 10 years.”

Summary
So is Hall correct? Once you understand from the aforementioned Death of Defence in Depth article the lines used to bypass virus checkers then it is relatively to write counter code. However with thousands of pieces of malware being created every month – perhaps Hall is correct and free vendors don’t have enough resources to write counter-code or perhaps he is just spreading FUD (fear, uncertainty and doubt). We can’t know for sure. But we do know AV is dying a death and that there is a lot of help for our decisions from sites such as AV Comparatives which give free reports on virus checkers and how they have coped with the latest million or so viruses.

References

Tech.Blorge: Symantec: It’s Dangerous to Rely on Free Antivirus
Blorge Jan 2009: The Best Free Anti-virus Software
Blorge Dec 2007: Symantec Kills Internet Instead of Virus

Nruns.com: Death of Defence in Depth PDF

SecurityVibes article: Best Virus Checkers No Defence Against Modern Malware
SecurityVibes interview: Death of the Virus Checker

DarkReading: You're Not Paranoid, Your Antivirus Just Doesn't Work Well

AV-Comparatives.org: Virus checker comparison