Ask our Principal Software Developer anything

@Nunzio d'Abbruzzo

can you tell me if the free version of Bitdefender, which is arousing great interest, will be implemented with some other features? Or whether some advanced security features will be made available and activated?

There are a number of proposals for making few more things available, but I cannot say for sure when (and if) such features will make it into the free version.

Also it would be nice and interesting to equip the TrafficLight extension with a good AdBlocker.

You can always try the free trial of Total Security, which contains quite a number of privacy-oriented features - Anti-Tracker which integrates with major browsers, Safepay for a completely isolated environment and VPN. An adblocker, while making website visit more easier, is exactly not a security feature. But point taken.

@Gjoksi

Can you tell us what is your opinion on the future of malware, in the means of new malware trends and new malware attacks, and will be the malware of the future independent and adaptable, something like AI-driven malware?

I think the malware has diverged in the last years (and take these lines more as a personal consideration, being involved in some areas of security but less in others). If initially there were college kids that split files in half just for fun, today malware specializes, much like various gangs specializes (some guys are loan sharks, others steal identities and money, others spam/fishing and so on). There is state-sponsored malware; various groups more or less sponsored by other organizations; small timers; home loners; copy pasters - and I can go on for a while.

What I can say is, from my (technical) point of view, is that the weakest link is still the user. Social engineering, imperative emails asking for immediate passwords reset, applications not updated/patched, misconfigurations, and the fact the regular user should not be always alert - these are, for a consumer user, the main troubles. This is why we stress this part to the user and various Bitdefender products scan regularly for such indicators that might lead to trouble.

If some obscure group makes a DNS flood attack on some ISP we might not be able to post or watch movies for several hours, or perhaps a day, but not much else happens at home - while receiving an extortion email, click-me-you-will-see-beautiful-******-ladies links, or having an unpatched web browser and visiting websites with dynamic content posted by all sorts of people - that is the immediate danger.

Malware trends - most likely there are tools, proof of concepts, researchers and alikes working around the clock to employ every exotic form of technology, including AI, adaptability, machine learning, or other elaborate forms of saying the code behind is also taking decisions based on various criteria, and not doing the same thing over and over again. Most likely these technologies are used to analyze sample user data uploaded from malware, establishing a some kind of profile and devising a secondary set of attacks based on what the analysis produced, and I think this is where ML/AI is most involved: data analysis.

After all, a malware can do only a small set of effects: destroy, collect, trick the user to do an action (or, in more elaborate forms, trick the user to create the conditions for subsequent actions), or be itself a host for other dedicated malware by downloading another attack vectors or creating intentional vulnerabilities. I'm sure all these technologies and more are used on the backend - everyone having customers (willing or not) does analyze them - but less so on the end device.

But on the end-user device, I'm a bit conservative to say if such complex technologies will be used on a large scale. Not for other reason, but the end user does not worth the effort to employ tactics and means too consuming. Although the real world does have (even very old) examples that might contradict me - I'm thinking on one of the oldest malware known, Tremor (first spotted in 1993), which was - at that time - polymorphic, self-modifying, deciding behavior depending on environment, spreading using another executables and a lot of other intelligent techniques - and that was like a lifetime ago before ... almost anything.

On the business side, I'm afraid I'm not too qualified to comment. I suppose malware is somewhat similar in the techniques with what affects the end-user, only with more emphasis on misconfigurations, user rights and unauthorized data access. Here AI techniques are probably more often involved, reward being much higher for a business malware. But even so, in the end, irrespective of technique, malware is looking for the same vulnerable things: unpatched software, weak passwords, users inserting USB devices in all sorts of places etc.

@mrmirakhur Thank you for the comments. Quite a list, and the scanning part is not exactly my daily thing, but I'll try to address at least some of them.

First I want to let you know that all your comments and suggestions were made available to the team. I'm confident we will look into them. While I cannot say at this time what and when we can pick up, we will discuss all of them shortly.

Now getting into your list. Remember there are zones where I am not writing code and/or I am not directly implicated, so please take what follows as my personal view, and at times not necessarily the best one.

I personally find the scanning speed of bitdefender for windows to be slow.

That depends on many factors, but mainly on how the scan is performed. The number of options and depth is quite large, and to compare two products' scan when one is using a handful of flags and the other a lot more will obviously make the first faster; add to this the tradeoffs picked on by various products (how much memory it consumes, if there are CPU/RAM limits etc). That being said, since it's not my dev area, I forwarded this observation to those knowing in detail what happens.

[...] there should be an option where only user gets to choose whether he wants to delete all the files or disinfect the files [...]

It looks like a reasonable proposal. But, again, there is a tradeoff. You are a malware researcher, which places you in a small class of power user, and I understand the need for various touches to help you doing your job. On the other hand, this is a consumer product, which means the number of options, while needed, has to be kept in check, otherwise what looks for your natural and helpful might end up as overwhelming and unnecessary complicated for the other 99%.

[...] Resolution would be very easy. [...]

It might look this way, but it never is. A list with 10k files introduces a slew of other complications - think virtual lists, pagination; do we keep all the items and the associated data - persistent or not - in memory? how the scrolling behaves? do we risk UI freeze? should we use recordsets? Should we make it paginated? should we implement a filtering, combined with exclusions operators? And the possibilities of ending up with a mini-Excel just for one feature is quickly adding up.

Think on a web page with 10 or 10000 DIV elements inside: the 10k one surely pushes the DOM limits. Or opening Windows Explorer in a folder with 10k files; one quickly notice what happens when opening a directory containing a large Git repository, for example.

Don't get me wrong, I would like to have a full search feature, filtering and composing operations, even a scripting feature. But a consumer product have to be simple, and the one-size-fits-all almost never works unless one is targeting a very specific set of users.

Can the developers try to recheck on the current gui of bitdefender and if possible bring back the old gui of the version 2017/2018

Well, it's not up the developers - we just implement the UI. That being said, in the Settings page there is the Dark Mode which is similar, with a slightly different theme. Bringing back an old GUI might send a mixed message to the users, but in this matter I am preferring my UI to stay the same for years, the GUI has to evolve as well. The rule of thumb here is not easy to follow - while a product obviously needs to have its own identity, it also needs to integrate with an existing operating system.

[...] mobile security for android and I have been trying very very hard to get this thing implemented from last 3-4 years but the development team is not approving this [...]

I am not in touch with the Android team, so I cannot speak for their to-do list. What I can think is again related with what I said above: the product is targeted for users dealing with malware as it comes, one, perhaps a handful at a time, but not thousands. While I understand your use case, as a researcher, it is vastly different than a regular user one and needs available editing tools to perform needed actions, such a feature will probably will not be easily implemented, simply because IMHO its place looks more in a some form of mini-IDE/advanced editor rather than a security product.

Regards,

Cristian

@Nunzio d'Abbruzzo

why do the Bitdefender AVs use a lot of RAM even at "idle"?

Usually these are automated, scheduled things (things like "check if we need to display an alert", "check if vulnerabilities are present"), update checks, and OS detections triggering various routines (i.e. a new device has connected to USB, a new device appeared on the network etc.). So even if, for example, your PC is doing nothing but someone connects to the same WiFi network you are connected to, an entire array of things might be activated (do we know this device? is it running a known OS? it is a device running a Bitdefender product? etc etc etc). And in top of that, the entire infrastructure of an AV (which is really a suite of executables, engines, scanners etc.) gets complex very quickly because of the myriad of things it implements and being in constant connection with the OS. It's not like a paused game, that I can tell.

Have you ever thought about reducing the percentage of RAM usage? For the latest generation PC, having 8GB of RAM or even more than 8GB the problem does not arise, but PC with lower RAM becomes a little more critical.

We do, all the time, but we can do little when the OS requirements moves past 8 GB. Think Windows 7 which had no troubles accommodating AV, Office, browsing, games etc. in this amount of RAM, which is mandatory now for a Windows 10 or 11 doing barely nothing. But point taken, I am thinking on some areas that might enjoy a recheck to make them lighter in terms of memory. At least for discrete tasks, such as vulnerability scan - when comes to Safepay, for example, which is an entire browser, is quite hard to squeeze memory when an entire browser is launched and the webpages are so consuming these days. It's a constant struggle, that much I can tell.

@Nunzio d'Abbruzzo

I noticed that if you insert a USB stick, even if you have the on-demand scan enabled, no scan request pop-up appears. If, on the other hand, real time protection is deactivated and a USB key is inserted, the scan request pop-up appears.

Followed up with the guys knowing more than me. I'm not sure how this is supposed to work (I suspect it is by design), but it doesn't hurt to recheck.

@bluewill I am not aware of a firm date to end support for Windows 7, nor Windows 8.1. Surely it will be announced on the product page (or maybe it was already and I missed that), but from where I stand, we are still supporting and testing Windows 7 at this time.

@bluewill That looks true. But I would say Windows 7 will be supported a little longer, not for any other reasons but the number of users still running Win7. Anyways, I will ask the business guys and as soon as I have news I will get back.

The updates will probably not work anyways, since without two critical KBs (those related to TLS and new certificate signatures) nothing will work, and Windows Update on Win7 is dead as well.

About 8.1 I think it will depend on both time and user base. I will ask this as well.

@JeremyC

[...] *Some of these settings are hidden or managed by your organization." [...]

This is displayed by Windows, not by us. It is an indication displayed for certain settings "this might be controlled by n outside admin". Usually this means the computer is joined to a domain (the story is far more complex, involving ActiveDirectory, Group Policy, the presence of certain tools such as Company Portal - or not etc). The documentation of MS itself is not generous as well.

"in this case, through the Vulnerability module and through Bitdefender, those notifications are only informative and once you click on Fix, nothing is happening because Bitdefender does not have the necessary permissions to change such options"

It might be the case. Or Vulnerability can change the values, only to be rolled back or reinstated by an administrator ****** or tool in case the device is enrolled in an enterprise. Or indeed it might happen the value remains as set by the vulnerability - it really depends on what policies are present on that machine.

And the suggestion of be able to undo changes is really interesting. Perhaps also a possibility to ignore some of them by marking them as such and be able to re-bring them later into scan can be useful.

@MengJi I have to ask the management and the OEM guys, I am not aware of this. Will be back as soon as I know more.

@Termite If you plan to keep them both and you have free slots in your license, I am recommending to install Bitdefender on both computers. If you plan to exclude the old computer, then install Bitdefender on the newer one.