Improving user recognition of legit security software vs. rouge

[colonydata]

My grandfather got his computer infected with rouge security software last week.

this is not the first time it's happened. the technical braintrust of the family (my Georgia Tech Mech engineer cousin, and myself) have tried several times to show him how to tell the difference between rouge security software and the legit stuff we have installed on his computer. but it's just not working.

so i have been thinking of ways to improve user recognition of rouge vs. legit.

when i opened my business checking account and they went through the online banking enrollment they had me pick a picture and a write a short description that i would recognize later. the purpose being that after you put in your username it shows you that picture and your description to authenticate to you that you are indeed on the legit site and not on a phishing site.

i am wondering if something like that for AV software might be effective.
obviously it would have to be something known only to the end user and the legit software package. it should not be accessible to other programs (via api or scanning resource strings like the way people were able to get the oauth private key from the twitter for android app) so it's not something that various av packages can share (establishing trust networks would be hard, as it would take a third party similar to a Certificate Authority or validation authority to determine access).

am i missing something? i know it isnt perfect, if it was no one would get phished out of there online banking password), but my security training has taught me that you need multiple layers of security and this seems like it would be a pretty good layer to add.

 

[Xander]

That was pretty much the point of UAC, wasn't it?

 

[Crgky127]

The thing with security software is that at most you are going to have about 3 products at a time, and usually stick with the same for a number of years. So in this case a very short whitelist is more efficient, whereas with online shopping for example, there are a lot of places, so looking for the Verisign/etc logos is more efficient. Just tell them, 'if it isn't <insert products you resell/recommend here>, then don't touch it'. People need the simplest possible rule, because they are too busy driving their car to care about which brand of oil filter they have.

Remember, it's not about rogue vs legit. It's about what legit software should I use vs the rest of legit software and rogue software. I mean it doesn't matter if a user can tell Kaspersky from AntiVirus2011 if you set them up with NOD32, they just need to know if a message window is or is not coming from NOD32.

 

[colonydata]

That was pretty much the point of UAC, wasn't it?

Not really, i probably made it more complicated than it really is.

when you install a legit av package etc, you would be prompted to pick a photo, every time that software showed a prompted it would also display that picture.

that way it would make it extremely easy for a end user to discern between legit software and rouge software.

 

[Fixedathome.com]

It would probably help but good look getting all of the AV companies to implement it.

It may be a better idea to educate the user about the software that is already installed on the system and to look for tell tale signs that software isn't genuine such as spelling mistakes ie. Rouge v Rogue