Top security suites fail exploit tests

I qutote:
'12 suites get 'F'; Only Symantec's detects more than 3% of real attacks'
October 13, 2008 (Computerworld) Security software suites don't protect users from real-world exploits, a bug-tracking company charged today after launching 300 test attacks against a dozen programs, including popular software from McAfee Inc., Symantec Corp. and Trend Micro Inc.


"The Internet security suites are marketing themselves as the one solution users need to be safe online," said Thomas Kristensen, chief technology officer at Secunia Inc., which ran the tests. "In our opinion, that's just not true."
Secunia sicced hundreds of vulnerability exploits -- some proof-of-concept code that triggered a vulnerability, others that included payloads -- on 12 suites, including Symantec's Norton Internet Security 2009, Microsoft Corp.'s Windows Live OneCare, AVG Technologies' Internet Security 8.0 and McAfee's Internet Security Suite 2009. The attack code was delivered by files of various formats, including Office documents and malformed images, and by malicious Web sites that triggered browser and ActiveX bugs. The target was a Windows XP SP2 machine missing "certain patches and with a number of vulnerable programs," according to Secunia.
While Symantec's Norton Internet Security 2009 took top honors, it detected only 64 out of 300 exploits, or just 21% of the total. Even so, that beat most rivals by substantial margins. Trend Micro's Internet Security 2008, for example, detected only 2.3% of the exploits, while McAfee's Internet Security Suite 2009 identified 2% and Microsoft's OneCare spotted just 1.8% of the exploits.


The reason why current security suites had such trouble detecting the 300 exploits, Kristensen explained, is that antivirus software vendors are geared toward cranking out signatures for hacker payloads: the worms, Trojan horses and spyware that are identified in the wild, given names and then spotted by adding a new detection "fingerprint" to the software.


"They don't focus on detecting vulnerabilities, they focus on detecting the payload," Kristensen said. "But the problem with detecting the payload is that you're always behind [the hackers]. It's easy for the bad guys to create a new payload that's not detected by the scanning mechanisms and current signatures."
In order to craft a signature for a specific payload, security companies must first capture a sample, analyze the malware and write a detection fingerprint. Then they must push that new signature to users. The process, said Kristensen can take hours at best and then must be repeated as soon as a new piece of malware is bundled with an exploit.


But by looking for vulnerability exploits rather than for payloads, argued Kristensen, security software could stop multiple pieces of malware with just one signature -- a more efficient defense in the long run.
"If there's a vulnerability in [Microsoft] Office and someone is exploiting that in an Office document, you'll be able to block that attack with just one signature," he said, no matter how many different payloads hackers may try to load into a vulnerable PC. "It's a much better way, we think, even though it's somewhat more time-consuming to come up with a vulnerability signature."


Although Secunia sells its vulnerability research and proof-of-concept exploits to legitimate security vendors, Kristensen maintained that was not the reason why the company tested the 12 suites. Instead, he said, the take-away should be to patch, patch promptly and patch all software, not just the operating system.
"Security software alone isn't sufficient" to protect a PC, Kristensen said. "People need to patch all their programs. Patching is absolutely necessary, and not just the main programs, but third-party software as well."
Secunia has posted a paper that describes its suite-testing procedure and lists results on its site (download PDF).

Original: Top security suites fail exploit tests
 
'nuff said. :D

I must say NIS2009 does WAY better than I would have imagined. :)
 

My Computer

System One

  • Manufacturer/Model
    Home made
    CPU
    AMD Athlon X2 6000+
    Motherboard
    ASRock ALiveXfire-eSATA2
    Memory
    2x2GiB DDR2 PC2-6400
    Graphics card(s)
    GeCube ATI Radeon HD3870 512MiB GDDR4
    Sound Card
    Built in HD Audio, digital output
    Monitor(s) Displays
    Samsung SyncMaster 206BW, SyncMaster 940B
    Screen Resolution
    1680x1050 + 1280x1024
    Hard Drives
    WDC 250GB SATA + lots of externals. :)
    PSU
    Antec Earthwatts 500W
    Case
    Antec Sonata III
    Cooling
    Air
    Mouse
    Logitech G9
    Keyboard
    Logitech G15 (1st edition w blue lightning)
    Internet Speed
    DL/UL: 50/10Mbit
The best security has always been commonsense. Next would be disconnecting from the internet and using your computer as a word processor and playstation.
 

My Computer

The best security has always been commonsense. Next would be disconnecting from the internet and using your computer as a word processor and playstation.

The best security is to lock it away and never use it. But I suppose it kind of defeats the purpose. :)
 

My Computer

System One

  • Manufacturer/Model
    Home made
    CPU
    AMD Athlon X2 6000+
    Motherboard
    ASRock ALiveXfire-eSATA2
    Memory
    2x2GiB DDR2 PC2-6400
    Graphics card(s)
    GeCube ATI Radeon HD3870 512MiB GDDR4
    Sound Card
    Built in HD Audio, digital output
    Monitor(s) Displays
    Samsung SyncMaster 206BW, SyncMaster 940B
    Screen Resolution
    1680x1050 + 1280x1024
    Hard Drives
    WDC 250GB SATA + lots of externals. :)
    PSU
    Antec Earthwatts 500W
    Case
    Antec Sonata III
    Cooling
    Air
    Mouse
    Logitech G9
    Keyboard
    Logitech G15 (1st edition w blue lightning)
    Internet Speed
    DL/UL: 50/10Mbit
Hi Steven,

Thanks for the iteresting info. Luckily Vista is more secure than XP due to service hardening and UAC.

I use this free Secunia app. to check all is patched and up to date

Secunia PSI | Security Download | PC World

SIW2
 

My Computers

System One System Two

  • Operating System
    Vista
    CPU
    Intel E8400
    Motherboard
    ASRock1333-GLAN R2.0
    Memory
    4gb DDR2 800
    Graphics card(s)
    nvidia 9500GT 1gb
  • Operating System
    win7/vista
    CPU
    intel i5-8400
    Motherboard
    gigabyte b365m ds3h
    Memory
    ballistix 2x8gb 3200
best security is turning off your computer when you are not using it.
 

My Computer

System One

  • CPU
    pair of Intel E5430 quad core 2.66 GHz Xeons
    Motherboard
    Supermicro X7DWA-N server board
    Memory
    16GB DDR667
    Graphics card(s)
    eVGA 8800 GTS 640 MB video card
    Hard Drives
    SAS RAID
I don't run any anti-virus, anti-spyware, anti-anything. I've always believed nearly all of that software is complete and udder garbage that does little more than slow your PC to a crawl.

But then again, I use webmail, keep track of running processes and have at least a little common sense. ;^)
 

My Computer

System One

  • CPU
    Q9450 @3.4Ghz
    Motherboard
    Asus P5Q Deluxe
    Memory
    8GB Corsair Dominator @ 1066
    Graphics card(s)
    Asus AH4850
    Monitor(s) Displays
    Samsung 2235BW
    Hard Drives
    2x Seagate 750GB 1x Seagate 160GB (IDE)
    PSU
    Cooler Master Real Power Pro 850
    Case
    Cooler Master Cosmos
    Cooling
    Cooler Master V8
    Keyboard
    Logitech WAVE Cordless
Back
Top