Malware, Vulnerability Management

Trend Micro to boycott security tests

Trend Micro plans to boycott one of the leading tests for vendors of security products, the VB100.

Trend's chief technology officer Raimund Genes issued the boycott todayand hit out at the test procedures, branding the VB100 "old fashioned"and "totally irrelevant" and claiming the tests are "creating a problemfor the industry".

Speaking to SCMagazineUK, Genes claimed that other security companiesfelt the same way about the tests, but were afraid to speak out becauseof the credibility they gained from passing the tests.

Trend Micro joins Panda Security as one of only two vendors to shun thetests. Symantec, Microsoft, McAfee and 34 other vendors are stilltaking part.

"[The tests] are all old-fashioned, but because the [VB100] label isso valuable, Virus Bulletin is creating a problem for the industry,"said Genes. "I hope they are changing the testing method."

He criticized Virus Bulletin for not testing against the prolific Storm Worm, nor testing for effectiveness against rootkits.

He also slated the VB100 for not testing against "real-life threats"and for carrying out its testing offline. Virus Bulletin tests againstthe "Wild List" from wildlist.org, which is run by ICSA Labs and based onresearch from many distributed individuals.

Genes insisted that Trend would continue testing with rival labs AVTest.org and AV Comparatives.

SCMagazineUK asked Genes whether cynics would be right to assume thatits withdrawal from the VB100 was sour grapes for failing the test.

He said: "The cynics are slightly right. But everybody knows that theVB100 is totally irrelevant. We have participated in the test foryears. Sometimes it has slaughtered us, but we continued with thetests."

John Hawes, technical consultant for Virus Bulletin expressed surpriseat Genes' outburst. He said Trend Micro had not told Virus Bulletinthat it was withdrawing from the test: "They have not said anythingabout this to us".

Hawes said that Trend Micro had entered just two out of the last fivetests -- and had failed them both. The vendor "had issues withpolymorphic viruses," he said.

He also defended Virus Bulletin's methodology. "We use the Wild Listfrom reporters all round the world. The test is that [vendors]constantly cover everything on that list. It would be impossible totest every virus because we don't have it. AVtest.org and AVcomparatives have a different style of test. They cover everything outthere. That is very useful and informative, but different in purpose,"he said.

Hawes conceded that the Wild List is "a little behind the times," but said Virus Bulletin was looking at a way to add to it.

He continued: "The only problem is that some products update from theinternet. We operate in a sealed environment and don't allow that," hesaid.

"That's a slightly odd reason for not taking part. I don't see how they could have anything to be upset about."

Get daily email updates

SC Media's daily must-read of the most current and pressing daily news

By clicking the Subscribe button below, you agree to SC Media Terms and Conditions and Privacy Policy.