Reply to thread

Message

<blockquote data-quote="ForgottenSeer 89360" data-source="post: 927078">This video has three major issues:1. It is not known how behavioural blocking interacts with standard antivirus. By disabling standard antivirus you might also be disabling a platform that pre-extracts attributes and allows for a faster, more accurate decision taking and you are most likely disabling an emulator as well. Some products don&#039;t allow for behavioural blocking to be on if AV is off.2. It is not known whether a true 0-day will really bypass standard AV, as packer heuristics for example might block it, even though it&#039;s brand new. The assumption that a new threat will always evade signatures and heuristics is very wrong.3. It is not known how the Advanced Threat Defence system interacts with the cloud. It might have some sort of hash-check implemented and just because it is detecting this old malware in a controlled testing environment, doesn&#039;t necessarily mean that same will happen with brand new threats in the wild.</blockquote>

[QUOTE="ForgottenSeer 89360, post: 927078"] This video has three major issues: 1. It is not known how behavioural blocking interacts with standard antivirus. By disabling standard antivirus you might also be disabling a platform that pre-extracts attributes and allows for a faster, more accurate decision taking and you are most likely disabling an emulator as well. Some products don't allow for behavioural blocking to be on if AV is off. 2. It is not known whether a true 0-day will really bypass standard AV, as packer heuristics for example might block it, even though it's brand new. The assumption that a new threat will always evade signatures and heuristics is very wrong. 3. It is not known how the Advanced Threat Defence system interacts with the cloud. It might have some sort of hash-check implemented and just because it is detecting this old malware in a controlled testing environment, doesn't necessarily mean that same will happen with brand new threats in the wild. [/QUOTE]

Verification