Advice Request A free VoodooShield alternative?

[cruelsister]

Kill them all.

 

[Arequire]

Good 'ol Littlebits…

• People disable UAC
• People approve anything without knowing anything about its safety
• People do not pay attention when downloading and running files
• People do not keep software updated
• People are reckless
• People do click on everything and download files without checking to see if they are safe
• People ignore UAC prompts by immediately selecting YES

Users are a menace to themselves. Always have been, always will be.

People should be locked out of the system for their own good, so there is real need for anti-executable and software restriction policy software.

I made default-deny work really well for someone who's wasn't even remotely interested or conscious about her laptop's security:
To Supplement EAM or Not?
It worked really well and the only issue I ran into was programs not being able to update themselves automatically; I had to do that manually.
I'm not sure how risky this would be if someone set it up and then wasn't around to update programs on a regular basis though.

Kill them all.

Kind and gentle she says...

 

[Deleted member 178]

I made default-deny work really well for someone who's wasn't even remotely interested or conscious about her laptop's security:

People not interested in their system security will never heard about default-deny apps...

However, deny-default applications like anti-exe don't need constant updates since they just do one thing : block and prompt ANY executables, so no whitelistinng/blacklisting maintenance are mandatory.
Devs usually make it easier for users by adding a whitelist (mostly Windows executables) to avoid prompt shower and crashes.

 

[shmu26]

Ask cruelsister about this? Malware is being signed with legit sigs now days.
I use bothe an SRP Appguard and Voodooshield Pro

Signed malware is more expensive, usually it is used in targeted attacks, rather than in mass spam campaigns. So blocking unsigned and unknown exe files provides a good degree of protection.

 

[Azure]

Signed malware is more expensive, usually it is used in targeted attacks, rather than in mass spam campaigns. So blocking unsigned and unknown exe files provides a good degree of protection.

Since we are talking about signed malware.

I saw this tweet a few hours ago.

 

[TairikuOkami]

Ask cruelsister about this? Malware is being signed with legit sigs now days.

So few of them, that you can count them on fingers compared to millions blocked that way. Most use invalid or outdated certificates.

EDIT: As you can see in the post above, it is about 5000 total, which were ever detected, so that is like a dozen new ones a month.

 

[cruelsister]

Azure- be careful about charts like these (and not that I am a Fan of the Signing process):

1). First off. MSFT concentrates on things like Win Phone apps and Office stuff, so should be pristine.
2). Consider that credentials can be stolen (like the CCleaner fiasco- this was a Symantec- now Digicert certificate). This is the fault of the software company (poor security) and not the Authority. One should always assign Fault to where the Fault actually lies.
3). Not that I would know about such things (being Kind and Gentle), but in the Old Days Ophelia tells me that it wasn't too much trouble to generate a rogue Root Certificate (like from Verisign), and use this to generate a secondary rogue by another company. Once the Whitehats caught on to this we saw stuff like SigCheck which showed certificate chains (sigh...)
4). I do wish the author concentrated on Browser extensions, which are a more Clear and Present Danger.

 

[Andrew999]

I recommend SecureAPlus or Crystal Security, both are cloud based, free, and light.

Crystal Security
Free Cloud Antivirus & Application Control for PC | SecureAPlus

 

[shmu26]

IMO if you want to block unwanted executable files all you really need to do is enable:

• Block executable files from running unless they meet a prevalence, age, or trusted list criteria

This is one of the new advanced settings in Windows Defender/Exploit Guard/Attack Surface Reduction.
You can enable it as detailed on the microsoft docs page
Use Attack surface reduction rules to prevent malware infection
Or just use Andy Ful's ConfigureDefender, and tick the appropriate setting.

This should be coupled with safe user habits, especially locking down -- or avoiding the use of -- highly exploitable applications, such as MS Office and Adobe PDF apps. Or just install OSArmor for protection against scriptors.

 

[ichito]

Is there a product that uses whitelisting like Voodooshield which is free? Thanks.

Best alternative is NVT ExeRadar Pro...for me the latest 3 version is most stable. Here you can find link for the last v.3 that is free
NoVirusThanks EXE Radar Pro turns Freeware

 

[509322]

IMO if you want to block unwanted executable files all you really need to do is enable:

• Block executable files from running unless they meet a prevalence, age, or trusted list criteria

This is one of the new advanced settings in Windows Defender/Exploit Guard/Attack Surface Reduction.
You can enable it as detailed on the microsoft docs page
Use Attack surface reduction rules to prevent malware infection
Or just use Andy Ful's ConfigureDefender, and tick the appropriate setting.

This should be coupled with safe user habits, especially locking down -- or avoiding the use of -- highly exploitable applications, such as MS Office and Adobe PDF apps. Or just install OSArmor for protection against scriptors.

Windows requires full lock-down protection to be safe. Exploit Guard ain't it.

The first billion-dollar whopper is coming. It's just a matter of time. And you all can thank Microsoft for it.

 

[FleischmannTV]

Billion-dollar whopper?

 

[509322]

Billion-dollar whopper?

Billion-dollar stealing malware.

 

[shmu26]

Billion-dollar stealing malware.

I guess I don't have to worry about it, then. I don't have a billion

 

[509322]

I guess I don't have to worry about it, then. I don't have a billion

That's what it will take to have a watershed moment. Even then, I don't think the types and magnitude of change will be very effective. Human society doesn't like change - especially the kind that costs a lot of money. The vast majority of the time society is forced to change by disaster & devastation. So, it will take a billion-dollar whopper to get people and institutions to really pay attention.

I really don't think things will change until a hack causes trillions of dollars in damage - something on the scale of a massive market crash. Then enough rich and powerful people will demand security be improved - and well, being who they are and what they represent, they will get what others have been asking for many years.

In the future, the cost of IT security is going to increase dramatically for consumers. Think $50 per month instead of $50 per year.

 

[Deleted member 178]

yeah, once Mr Robot will crash the global economy, maybe we will have some changes in infosec.

 

[Sammo]

Comodo Cloud Antivirus works fine with default deny and autosandboxing.