AV-Comparatives - Real world AV Test for March 2018

Windows_Security

Level 24
Verified
Honorary Member
Top Poster
Content Creator
Well-known
Mar 13, 2016
1,298
Our tech team pulled dozens of file-less threats and worms off Windows Defender protected machines this week already, WD was quietly and blissfully unaware the entire
Just limit build in shells to call other exec's (block WMIC.exe, Powershell.exe to start child processes with Windows Defender Exploit Protection). Why did not the experts tell those users to use the full potential of WD or better why did not they managed that centrally through GPO without bothering those users?

I am an amateur and I know how to do that :ROFLMAO:
 

ZeroDay

Level 30
Verified
Top Poster
Well-known
Aug 17, 2013
1,905
Our tech team pulled dozens of file-less threats and worms off Windows Defender protected machines this week already, WD was quietly and blissfully unaware the entire machines were compromised.
When Forti was tested in the hub the exact same thing happened. It was bypassed daily and running blissfully unaware that the system it was supposed to be protecting had multiple threats that had bypassed it. and that was with a fully tweaked config file.

My home network, used by 5 people on average, with about 40 devices stops roughly a dozen websites a day for phishing, exploits, malware, redirects, cross scripts and other crap

I'd definitely be educating everyone in your household on basic, safe, security practises in that case. Phishing links don't just randomly decide to hop onto a system they need some kind of user interaction. You can have all the tech in the world but from what you said above you DEFINITELY need to spend some time educating anyone and everyone other than yourself on how to safely browse the web, how to avoid malware, exploits etc as best as a person can. Teach a man to fish and all that.

Our tech team pulled dozens of file-less threats and worms off Windows Defender protected machines this week already, WD was quietly and blissfully unaware the entire machines were compromised.

Had the users allowed files passed Smart Screen, UAC prompts on an SUA, enabled all of WD tweaks, Enabled all of Windows 10 mitigations?
 
F

ForgottenSeer 58943

When Forti was tested in the hub the exact same thing happened. It was bypassed daily and running blissfully unaware that the system it was supposed to be protecting had multiple threats that had bypassed it. and that was with a fully tweaked config file.

So? Your point? FortiClient being tested without the FortiEMS, FortiSandbox and FortiGate appliance is pointless. I assume everyone already knew that? :unsure:


I'd definitely be educating everyone in your household on basic, safe, security practises in that case. Phishing links don't just randomly decide to hop onto a system they need some kind of user interaction. You can have all the tech in the world but from what you said above you DEFINITELY need to spend some time educating anyone and everyone other than yourself on how to safely browse the web, how to avoid malware, exploits etc as best as a person can. Teach a man to fish and all that.

You'd be surprised what hits your network that you are blissfully unaware of.. Your $50 router is 'seemingly' doing a great job, but really, it isn't. Edumacations only goes so far, people click things, that's life. The world is risky, there are lots of threats and especially some pretty crafty threats. But experts are all probably lying I guess.
 
  • Like
Reactions: ZeroDay
F

ForgottenSeer 58943

Just limit build in shells to call other exec's (block WMIC.exe, Powershell.exe to start child processes with Windows Defender Exploit Protection). Why did not the experts tell those users to use the full potential of WD or better why did not they managed that centrally through GPO without bothering those users?

I am an amateur and I know how to do that :ROFLMAO:

Not my issue or department. However, the big boys mostly run VDI's these days so they can dispense with the security theater and still utilize a Microsoft environment. As a corporation if you want security you stop playing theater with individual systems and push it all out via VDI from a highly secure centralized colo.

Wait till SDWAN's filter down.. Pretty soon your network itself might be virtualized and managed, your firewall will be virtualized offsite and incredibly secure. ZScaler is fun, I have a test unit here from ZScaler, a full L7 UTM Firewall completely hosted offsite and managed through a web portable. A small wallet size box on your WAN and presto, all done, bulletproof security for a couple bucks a month without playing router games.

Fun times ahead.
 

Windows_Security

Level 24
Verified
Honorary Member
Top Poster
Content Creator
Well-known
Mar 13, 2016
1,298
So? Your point? FortiClient being tested without the FortiEMS, FortiSandbox and FortiGate appliance is pointless. I assume everyone already knew that? :unsure:
.

You got a point there: they don't participate in HOME user tests on AV-T or AV-C.

Your answer raises a question: why make such a product available to the public when it is true what you are saying. Would not that (making an inferior product available) damage their brand reputation?
 
  • Like
Reactions: ZeroDay

Windows_Security

Level 24
Verified
Honorary Member
Top Poster
Content Creator
Well-known
Mar 13, 2016
1,298
You see AV-vendors moving in with home router boxes (Norton Core, Bitdefender Box), but I think the way Avast is moving makes more sense (cooperating with Telco's). My guess is that soon telco's offer this with cloud storage as added service (Avast would probably offert it as co-branded service, like F-secure offers home PC security in the Netherlands with Ziggo, a subsidiary of UPC/Liberty Global)

"AVAST press release" said:
Available later this year, users will be able to get Avast Smart Home Security directly through an easy to use mobile app along with a hub that connects to the home network. Avast is also working with telecommunications providers to deliver a joint offering to their subscribers.
 
  • Like
Reactions: ZeroDay

ZeroDay

Level 30
Verified
Top Poster
Well-known
Aug 17, 2013
1,905
So? Your point? FortiClient being tested without the FortiEMS, FortiSandbox and FortiGate appliance is pointless. I assume everyone already knew that? :unsure:

Forti was tested exactly how every other product was tested - With it's signatures, cloud and a tweaked config. I've seen you recommend Forti AV alone, but above you're now saying it's useless. What if every other products tested was tested with the full power of everything each security company had to offer? Forti was tested fairly, well more than fairly it's config file was tweaked to max. Don't get me wrong I really like Forti, but I've seen you mention it being powerful once the config file was tweaked, So, I was simply pointing out that as a stand alone product it's just OK. Amazing web filter but the rest in its current state is mediocre at best. You've mention adding sandbox signatures, setting Heuristics to max, Adding all the old sigs etc will make Forti solid, but all the above mentioned settings were enabled and it performed terribly in the hub. And, now you're saying above that it's pointless testing Forti without FortiSandbox and FortiGate appliance. So which one is it?

You'd be surprised what hits your network that you are blissfully unaware of.. Your $50 router

I don't use a $50 router. My home network is locked down tight and I spent a lot of money on the hardware that plays a part in locking my home network down. I just don't mention on public forums exactly how my home network is setup and what equipment I use. I have my own reasons for that and I'm not knocking anyone who does post their network setup. But, let's just say my network home network is setup in a similar way to yours with a few extra's which I'm sure you have and use yourself but don't post publicly.

But experts are all probably lying I guess.
I've worked for some of the biggest names in the security industry over the years and I'm still working in network security. Yes, as a "Professional" I've been in this and other similar positions for over 35 years. I never discuss my exact job title, or who I work for because I like to keep a certain amount of privacy online. I don't even post my security config and the config on my profile page is just for an old laptop I use.

I completely understand where you're coming from - If regular, everyday, non-Tech-Savvy people knew just how many times a day their home network is attacked, or even breached I doubt they'd switch their routers on until they'd paid a professional to secure their home network.

My point about educating the users in your household wasn't an attack it was simple me pointing out that, as you are fully aware if we educate our family members who we share a household with on safe browsing and general safe use of anything facing the internet, then that can only benefit everyone and everything including your network security. There is a lot I agree with you on and, like I said - Me pointing out the weakness of Forti when tested in the hub was simply stating the facts that it was tested, the config wa set to how you recommend it and it didn't perform well at all. And, although WD is a massive target, once setup correctly along with all the other built in security tweaks in Windows 10 it offers a very solid security layer.

I also agree that people being people will click on dodhy links and other crap, but a little bit of education on safe use goes a long way. With that said, However, I do fully appreciate how hard it is to get people to follow your advice on safe computer use and safe browsing. It goes in one ear and out the other, especially when they think 'Oh, dad will fix that don't worry about it' Most people just want to use the web and are not like us on the forums who spend a great deal of time securing our home networks and devices.

Anyway....Happy Friday to all on MT :)
 
F

ForgottenSeer 58943

I've always recommended people run FortiClient with VoodooShield. (this combo is actually a powerful pairing in our tests, try that combo in the hub) I suppose one could run it alone because it's sigs are decent, it has anti-exploit, and the web filtration is good. But I wouldn't suggest it for clickers or newbs in that configuration.

FortiClient is designed specifically as a managed, controlled endpoint solution tied to specific pieces of hardware as part of a protection fabric. If any of those pieces are missing the product is degraded and the fabric is compromised. Which is why I've always encouraged those that run it pair it with something like VoodooShield to seal up any gaps in it.

FortiClient alone, with average-joe's or clickers will universally end up with discouraging results. It's just not going to go well. It's missing too many pieces of the puzzle, there is no fabric, it's not backed by the hardware that's supposed to be backing it. I'd actually expect poor results in the hub given a solo configuration. Remember, even AVC (where Fortinet scores pretty well) has a FortiGate Controller for the Client, they are still missing a few pieces of the puzzle, but just having the gate there improves results quite nicely.

FortiClient Solo (no hardware, no adjunct support) = RISKY unless you are somewhat savvy. (but even I wouldn't roll with this config)
FortiClient w/Hardware, EMS, Sandbox = Incredibly strong.
FortiClient w/VoodooShield = What I personally believe is one of the strongest free setup without system drag.
 
D

Deleted member 178

FortiClient Solo (no hardware, no adjunct support) = RISKY unless you are somewhat savvy. (but even I wouldn't roll with this config)
FortiClient w/Hardware, EMS, Sandbox = Incredibly strong.
FortiClient w/VoodooShield = What I personally believe is one of the strongest free setup without system drag.
So basically Forti is useless for 99% of the people here.
 
F

ForgottenSeer 58943

So basically Forti is useless for 99% of the people here.

I guess you ignored the last line;

FortiClient w/VoodooShield = What I personally believe is one of the strongest free setup without system drag.

That combo is used by quite a number of people here as it is extremely effective, not to mention the best-in-class web filtration.
 
  • Like
Reactions: harlan4096
D

Deleted member 178

Then start with Emsisoft and it's lack of any firewall, IPS or protection from lateral network threats. :ROFLMAO:
I dont work for Emsisoft anymore, so i dont care much. :) for your info, seems you are unaware, it is an AV not a suite.
your 5000$ uber network and setup is sooooo powerful that your kid ended up infected LOL, gimme a break...

By using a SRP or alike (locking the system) + a sandbox to isolate browsers and downloads, this is real tight protection...
 
Last edited by a moderator:
  • Like
Reactions: harlan4096

Nightwalker

Level 24
Verified
Honorary Member
Top Poster
Content Creator
Well-known
May 26, 2014
1,339
I guess you ignored the last line;

"FortiClient w/VoodooShield = What I personally believe is one of the strongest free setup without system drag. "

That combo is used by quite a number of people here as it is extremely effective, not to mention the best-in-class web filtration.

With VoodooShield in a setup even ClamAV can protect a machine very well.
 
F

ForgottenSeer 58943

I dont work for Emsisoft anymore, so i dont care much. :)
your 5000$ uber network and setup is sooooo powerful that you kid endup infected LOL, gimme a break...

Even the most hardened networks can be penetrated, it just depends on who is trying to infiltrate your network, how persistent they are, and how well funded they are. If someone wants through, they'll eventually get through - if you run Windows. I really hope nobody has any illusions about that, do they? It's nothing shameful, I do this for a living and accept the risk, including state sponsored risks.

Oh, he didn't get infected, he 'almost' did and the vector was actually when he took the gaming rig to a lan party, outside of the network. Perhaps I should update my post with our forensic discovery so someone doesn't think they could possibly use that as an insult? Nah, I don't actually care.

I dont work for Emsisoft anymore

Sorry your career was so incredibly short lived.

With VoodooShield in a setup even ClamAV can protect a machine very well.

Technically, VS alone can protect a machine very well so... With Clam you'd be missing a proper web filter, among other things so...
 

About us

  • MalwareTips is a community-driven platform providing the latest information and resources on malware and cyber threats. Our team of experienced professionals and passionate volunteers work to keep the internet safe and secure. We provide accurate, up-to-date information and strive to build a strong and supportive community dedicated to cybersecurity.

User Menu

Follow us

Follow us on Facebook or Twitter to know first about the latest cybersecurity incidents and malware threats.

Top