Battle Anti-Executable vs. Behavior Blocker vs. HIPS vs. Anti-Exploit: BEST AGAINST 0-DAY Threats/Exploits

[ifacedown]

Alright. The title said it all. I am asking about the components mentioned above. Some of the abilities mentioned above are part of a security suite (for example, Emsisoft has Behavior Blocker, PrivateFirewall and OnlineArmor has HIPS). Well, I am not asking about the protection/capabilities of the entire security suite, but ONLY the said components above. Hence, I am asking the efficiency of the above components APART from the Antivirus/antimalware engines (and firewall), may it be signature/local-based or cloud based.

So, the best protection against 0-day and exploits? Pls elaborate. Also pls mention specific products... for there are many.

THANKS much.

 

[ifacedown]

all these components are very different from each other hence cannot take each others place
you can use good hips like comodo
instead of a antiexecutabe
best BB are from bitdefender ,eset and kaspersky
and for antiexploit malwarebytes antiexploit and hitmanpro.alert

if you are an advanced user you can use HIPS efficiently to block many zero day exploits but not all of them

Thanks.

Here: http://www.wilderssecurity.com/threads/malwarebytes-anti-exploit.354641/page-39
it says that MalwareBytes anti-Exploit blocks payloads right on the 1st layer, where HIPS and anti-executable could be bypassed and infect the system

 

[cruelsister]

You should add Sandboxing to your list. As Enterprises are migrating to it in droves, so perhaps it's time Home users did the same.

 

[ifacedown]

You should add Sandboxing to your list. As Enterprises are migrating to it in droves, so perhaps it's time Home users did the same.

Well thank you. Right now I have ESET NOD32, Windows Firewall, UAC-Default, MCShield and K9WebProtection

 

[hjlbx]

Virtual sandboxes protect, for the most part, the physical system from a permanent infection... so they are worthwhile.

An anti-executable (default-deny) is agnostic and will block all files - both Trusted and Untrusted.

A good AV protects the browser, an anti-executable prevents the launch of unknown files and malicious scripts, and a sandbox is good to evaluate an app.

If I were given only one choice to protect my system, that will offer good protection and usability for typical use, then it would be a behavior blocker - specifically Emsi's behavior blocker.

 

[rocky]

I can't answer this with alot of confidence without the sandbox as a option. If sandbox was an option then one product would come to the top and give you all of them , in my opinion . So using what options you set I would go anti-executable ( VooDooShield ) and I still wouldn't add the antivirus.

 

[ifacedown]

I can't answer this with alot of confidence without the sandbox as a option. If sandbox was an option then one product would come to the top and give you all of them , in my opinion . So using what options you set I would go anti-executable ( VooDooShield ) and I still wouldn't add the antivirus.

Well do you mean to say that without Sandboxie, you will put VoodooShield on top?

Can Sandboxie prevent 'infected' sessions? Like for example, with ShadowDefender, it can 'undo' infections, but it can NOT prevent infection. (I mean preventing an infected session where data could be stolen)

My question here is not about virtualization or sandboxing, but preventing infection.

 

[ifacedown]

Virtual sandboxes protect, for the most part, the physical system from a permanent infection... so they are worthwhile.

An anti-executable (default-deny) is agnostic and will block all files - both Trusted and Untrusted.

A good AV protects the browser, an anti-executable prevents the launch of unknown files and malicious scripts, and a sandbox is good to evaluate an app.

If I were given only one choice to protect my system, that will offer good protection and usability for typical use, then it would be a behavior blocker - specifically Emsi's behavior blocker.

I am not asking about virtualization, or sandboxing, because an infected session would also mean stealing data (am i right in this?), virtualization (like ShadowDefender) only 'undo' infection, but a stolen data is already stolen.

 

[nsm0220]

Well do you mean to say that without Sandboxie, you will put VoodooShield on top?

Can Sandboxie prevent 'infected' sessions? Like for example, with ShadowDefender, it can 'undo' infections, but it can NOT prevent infection. (I mean preventing an infected session where data could be stolen)

My question here is not about virtualization or sandboxing, but preventing infection.

yes in a web bowers long you don't put you personal info in the bower that you sandboxed in and as for files in sandboxe just make sure you hit run file in sandbox before opening it you should be fine

 

[cruelsister]

I am not asking about virtualization, or sandboxing, because an infected session would also mean stealing data (am i right in this?), virtualization (like ShadowDefender) only 'undo' infection, but a stolen data is already stolen.

Yes and no- For something like Shadow Defender you are entirely correct. SD is what is termed a Reactive security product (restoring your system after it has been active). Although products of this type will get your system back to a previous state, as you surmise it won't stop any active malware from stealing and transmitting data. To use a Barnyard parallel, it's like locking the Coup after the chickens have got out (assuming a Coup has a lock).

A Proactive approach is more effective as well as being current- Remember that any malware that attempts to steal whatever data MUST have two separate components- one to do the stealing locally (i.e. on your computer) AND a mechanism to send this data out to the Blackhat server. The new wave of Enterprise security solutions which rely on Sandboxing technology will also have as an adjunct module that will prohibit any sandboxed file from accessing the network in any way. The theory here is that there is no harm in someone attempting to rob your Safe if by doing so they will be forever locked inside of it.

 

[ifacedown]

Yes and no- For something like Shadow Defender you are entirely correct. SD is what is termed a Reactive security product (restoring your system after it has been active). Although products of this type will get your system back to a previous state, as you surmise it won't stop any active malware from stealing and transmitting data. To use a Barnyard parallel, it's like locking the Coup after the chickens have got out (assuming a Coup has a lock).

A Proactive approach is more effective as well as being current- Remember that any malware that attempts to steal whatever data MUST have two separate components- one to do the stealing locally (i.e. on your computer) AND a mechanism to send this data out to the Blackhat server. The new wave of Enterprise security solutions which rely on Sandboxing technology will also have as an adjunct module that will prohibit any sandboxed file from accessing the network in any way. The theory here is that there is no harm in someone attempting to rob your Safe if by doing so they will be forever locked inside of it.

Ok, let me ask, so Sandboxie is capable now of locking in your data so it won't be sent to the servers?

 

[Moose]

Also, consideration the following for a layering effect below with sandboxing.

http://www.easysyncsolutions.com/cryptomonitordetails.html
http://www.novirusthanks.org/products/yaguard/

A combination of the above with firewall.

 

[hjlbx]

I am not asking about virtualization, or sandboxing, because an infected session would also mean stealing data (am i right in this?), virtualization (like ShadowDefender) only 'undo' infection, but a stolen data is already stolen.

Virtualization protects only the physical system; it does not protect data.

An anti-executable will be the best solution, but you still need to protect the browser and system data just in case the anti-executable fails.

Anti-executables are rock-solid, but it is human error that leads to an infection - e.g. forgetting to turn AE back on after disabling it.

Ok, let me ask, so Sandboxie is capable now of locking in your data so it won't be sent to the servers?

Sandboxie does not protect data. No virtualization protects data. Although, you can set Sandboxie to only allow apps run sandboxed to have a low restricted access to resources.

One of the best ways to protect data is outbound notifications from firewall. Plus, if you use an AV product that protects personal data.

The best protection on the local system is a default-deny posture while using an armored browser and a good AV. That can be achieved with an anti-executable and Quarri MyPOQ along with ESET NOD32.

 

[ifacedown]

Virtualization protects only the physical system; it does not protect data.

An anti-executable will be the best solution, but you still need to protect the browser and system data just in case the anti-executable fails.

Anti-executables are rock-solid, but it is human error that leads to an infection - e.g. forgetting to turn AE back on after disabling it.



Sandboxie does not protect data. No virtualization protects data. Although, you can set Sandboxie to only allow apps run sandboxed to have a low restricted access to resources.

One of the best ways to protect data is outbound notifications from firewall. Plus, if you use an AV product that protects personal data.

The best protection on the local system is a default-deny posture while using an armored browser and a good AV. That can be achieved with an anti-executable and Quarri MyPOQ along with ESET NOD32.

Thanks so much! Now I am better understood. Okay, researching Quarri now...

A question, I heard from others ago that HIPS covered much more processes than an anti-executable. Is that correct? Or anti-executables covers them all?

 

[ifacedown]

Virtualization protects only the physical system; it does not protect data.

An anti-executable will be the best solution, but you still need to protect the browser and system data just in case the anti-executable fails.

Anti-executables are rock-solid, but it is human error that leads to an infection - e.g. forgetting to turn AE back on after disabling it.



Sandboxie does not protect data. No virtualization protects data. Although, you can set Sandboxie to only allow apps run sandboxed to have a low restricted access to resources.

One of the best ways to protect data is outbound notifications from firewall. Plus, if you use an AV product that protects personal data.

The best protection on the local system is a default-deny posture while using an armored browser and a good AV. That can be achieved with an anti-executable and Quarri MyPOQ along with ESET NOD32.

I am on Quarri website... where is the download? Do I have to download it?

 

[hjlbx]

Thanks so much! Now I am better understood. Okay, researching Quarri now...

A question, I heard from others ago that HIPS covered much more processes than an anti-executable. Is that correct? Or anti-executables covers them all?

Classical HIPS in full interactive mode will alert for all software actions - good, bad or unknown. Although, in that case you will spend all of your time responding to alerts. HIPS is slowly, but surely, falling out-of-favor because it can be so user dependent and require too much interaction.

Anti-executables are much more manageable in my opinion - they block everything that is not white-listed.

But they do not protect against everything - such as a software vulnerability exploit. MBAE is good, but if you use Quarri MyPOQ only for financial transactions, then you only need MBAE during normal use of your browser.

When it comes to IT there are so many security holes it is an exercise in futility to try to catch every single one - that is the ones that are known - and does not even consider all the undiscovered vulnerabilities.

 

[hjlbx]

http://malwaretips.com/threads/quarri-mypoq-info-and-access-links.43225/

Quarr infos.

 

[jamescv7]

HIPS and BB can be both blend together like Comodo Internet Security with autosandbox for unsurable programs that can run isolated and depends on the category of probably malicious actions but it needs really a user knowledge to understand it since everything based on ruleset defined.

Perhaps for better optimization concept is Virtualization, Anti-Executable and BB (with cloud protection like Emsisoft Anti Malware Network) as we need to make it easily identified and straight to the point as possible.