App Review Best Antivirus vs Unknown Ransomware II (TPSC)

[cofer123]

Content source

https://www.youtube.com/watch?v=3co-80OeHQE

 

[Schug]

This helps showcase the lack of good behavioral detection in Malwarebytes and ESET. Would something like this affect the average user? No. A good watch nonetheless! I say this as a ESET user.

 

[nikos200]

kaspersky!!!always one of the best!

 

[bazang]

Would something like this affect the average user? No.

LEO is using a basic way to encrypt files. There is nothing extraordinary about his ransomware simulation. What he shows is completely realistic and any user is susceptible to it.

 

[Schug]

LEO is using a basic way to encrypt files. There is nothing extraordinary about his ransomware simulation. What he shows is completely realistic and any user is susceptible to it.

The situation this represents is an unknown zero-day ransomware attack. That is what is unlikely to be experienced by the average user. However, in this situation behavioral detection is necessary. Maybe I'm misunderstanding?

 

[Dave Russo]

Does anyone know when Microsoft Defender was tested did he enable control folder?

 

[McAlex]

Great idea for a test and great execution! Thank you. However, the most popular paid programs are missing - Norton (Avast), McAfee, F Secure.

 

[Andy Ful]

I am impressed. Leo pushed the testing methodology in the XXII century. He created a golden sample that can show which AV is better against ransomware.
... or maybe I am wrong, and this video is just a presentation of one of many possible results (depending on the tested sample).

 

[cofer123]

A reasonable explanation on the ESET forums for the outcome of this sample:

As I have already mentioned, this file encrypts files only in the current folder from which it was run. It does not walk through other folders like other actual ransomware which might account for why it was not detected by the Ransomware shield prior to adding the detection.

Many "test" ransomware such as KnowBe4's Ransomware simulator: Ransomware Simulator | KnowBe4 operate as noted above; encrypt files in a single designated test folder/directory. As has been discussed previously at length in the forum: Ransomware Simulators - A Detailed Analysis, Eset will not detect these test ransomware due to the fact they don't exhibit actual ransomware behavior. Encrypting files in a single folder/directory per se is not "real world" ransomware behavior.

 

[Andy Ful]

Testing such custom-made samples can sometimes be useful for AV vendors. There are many ways to bypass any usable anti-ransomware protection. AV vendors do not cover all possible attack vectors, even if they know those vectors. The main purpose is to cover the methods that already happened in the wild and the new attacks that will probably happen soon.
The good thing about the video is showing the differences in applying the protection. For example, Kaspersky used the rollback feature to recover the files (including the malware) and other AVs did not. Other AVs prefer protected backups, protected folders, etc. Microsoft recommends automatic file backup in OneDrive, so the files can be easily restored.

 

[CyberDevil]

A reasonable explanation on the ESET forums for the outcome of this sample:

Suppose the malware creates its sample in the documents folder and then executes it from there - is that enough to bypass Eset's protection? On the one hand the scheme is too complicated, on the other hand ... If Eset understands that the encryptor works only if the program handles several different directories, but it doesn't have a rollback function like Bitdefender and Kaspersky, then we get guaranteed possibly very significant damage to personal files until the antivirus is triggered. Although the presence of a cloud backup will still offset these risks, and the encryptor will not be able to get to system and program files in time to damage the OS, it may not be a big deal. In general, it's important to always have a backup in any case.

By the way, since in V18 it is now possible to protect document folders without going through manual HIPS rules, the risk is probably even lower.

 

[tofargone]

Yes but Kaspersky is out, if you are in the USA.... Which makes me angry, not because I'm a super Kaspersky fan...

 

[bazang]

itman said:

Encrypting files in a single folder/directory per se is not "real world" ransomware behavior.

_ _ _ _ _

itman doesn't know what he is talking about. Ransomware that targets a specific directory has been around for years. It is just that it is not how most ransomware works.

The discussions and excuses on the ESET forums are total nonsense and living in denial behaviors.

 

[bazang]

Suppose the malware creates its sample in the documents folder and then executes it from there - is that enough to bypass Eset's protection? On the one hand the scheme is too complicated, on the other hand ... If Eset understands that the encryptor works only if the program handles several different directories, but it doesn't have a rollback function like Bitdefender and Kaspersky, then we get guaranteed possibly very significant damage to personal files until the antivirus is triggered. Although the presence of a cloud backup will still offset these risks, and the encryptor will not be able to get to system and program files in time to damage the OS, it may not be a big deal. In general, it's important to always have a backup in any case.

By the way, since in V18 it is now possible to protect document folders without going through manual HIPS rules, the risk is probably even lower.

The people on the ESET forum have no explanation as to why Kaspersky System Watcher detects and stops a single-directory encryption.

"But, but... you don't understand how ESET works! Single folder encryption is not real world!"

Sounds just like Webroot fanbois and fangirlz.

 

[CyberDevil]

Sounds just like Webroot fanbois and fangirlz.

Unlike Webroot Eset shows high signature detection and stable level of protection in all tests. It is enough to look at Shadowra tests. So there is no need to exaggerate.

 

[bazang]

Unlike Webroot Eset shows high signature detection and stable level of protection in all tests. It is enough to look at Shadowra tests. So there is no need to exaggerate.

The ESET forum is full of fanbois and fangirlz. Their behaviors are exactly like the Webroot fanatics on the Webroot Community.

They say the very same things that Webroot devotees say:

"But you don't understand how Webroot (ESET) works."
"That is not real-world!"

Oh yes. It is real-world and the product does not protect.

Same thing applies to ESET Community and ESET product.

 

[RoboMan]

Wait! Leo just posted a video where he tests a single file and doesn't push 1,000 files at once? And he didn't disable any components????

Is this the real life? Or is this just fantasy?

 

[cofer123]

Wait! Leo just posted a video where he tests a single file and doesn't push 1,000 files at once? And he didn't disable any components????

Is this the real life? Or is this just fantasy?

There's a first time for everything.

Except for ESET acknowledging their behavior detection is pretty much non-existent.

 

[mlnevese]

Wait! Leo just posted a video where he tests a single file and doesn't push 1,000 files at once? And he didn't disable any components????

Is this the real life? Or is this just fantasy?

You know... I think I'll start believing all those people who say the end of the world is near.

 

[nickstar1]

he will have to re-test malwarebytes they added script and fileless attack protection today it was not active the time of this video in the product.