A very disturbing read concerning the use of A-V

Question

Joxean Koret AV: Additional Vulnerabilities/ 
 http://www.hoystreaming.com/wp-content/uploads/2016/03/hb_bilbo.pdf 
 
 Would like to get an informed take on this from Sophos staff: Various possible security flaws inherent in any A-V, including Sophos, which may increase attack surface. Makes me wonder if risk/reward benefit of running Sophos is too strongly tilted towards risk, leading to overall reduced rather than heightened security. 
 Or is this stuff, however possible it may be for any given A-V, highly marginal/edge case/theoretical and not really applicable to real world threats?

bobcook · Accepted Answer

Hey bvrx, 
 Its definitely an interesting article, but unfortunately very misleading. There is no doubt that complex software is a difficult to create, maintain, and extend and in that respect there is some truth in the list of potential issues. The article leads with &ldquo;the sky is falling and every AV vendor has this long list of problems&rdquo; and then goes through a long list of specific problems attributed to specific vendors. I have no doubt that each specific problem is (or at least was, at one time) an issue, but its disingenuous to suggest all vendors suffer from all problems, and to suggest that all disclosed issues are still unresolved. 
 As mentioned in the article, Tavis Ormandy tore apart our AV engine with solid research. Did we pay attention to what he researched? Yes. Did we, and do we, take this stuff very seriously? Yes. Are the issues he wrote about still a problem? Nope. 
 The end of the article has a long list of "Recommendations for AV companies&rdquo;. We do all of those and more, and any self-respecting modern software development company is also doing all of this and more. Unfortunately that is not universally true for software companies, and not just the AV industry.