- Jul 5, 2019
- 607
Divine Barakah's Laptop Security Config 2021
- Thread starter Divine_Barakah
- Start date
- Jul 5, 2019
- 607
That's why it's called legacy.
- Apr 24, 2016
- 7,415
When @Evjl's Rain was still active in testing and we all participated AdGuard blocked almost nothing compared to Google Safe Browsing and Microsoft SmartScreen.
See this thread and/or do your own tests:
Hot Take - [Updated 29/12/2018] Browser extension comparison: Malwares and Phishings
Comparison between browser extensions Test 29/12 Q&A - [Updated 29/12/2018] Browser extension comparison: Malwares and Phishings Test 24/11 Q&A - [Updated 24/11/2018] Browser extension comparison: Malwares and Phishings Test 12/11 Q&A - [Updated 12/11/2018] Browser extension comparison...
malwaretips.com
- Aug 17, 2014
- 11,256
Of course, that's true but for major AV vendors, local BB as own system process is able to work properly even offline to block suspicious files...
I'm using on my daily laptop, MD/WD as my AV, so my intention is never to bash any product, but it's wrong to claim that F-Secure has no advantage compared to MD/WD, we should always mention all points of view, and it's a fact that MD/WD doesn't includes a certain module like BB, default there aren't any settings available, we have to tweak via Group-Policy or the easier way just using tools like Configure-Defender.
- Jul 5, 2019
- 607
Yes, I know. But I'm talking about the browser security option in Adguard Desktop. See How malware protection worksWhen @Evjl's Rain was still active in testing and we all participated AdGuard blocked almost nothing compared to Google Safe Browsing and Microsoft SmartScreen.
See this thread and/or do your own tests:
Hot Take - [Updated 29/12/2018] Browser extension comparison: Malwares and Phishings
Comparison between browser extensions Test 29/12 Q&A - [Updated 29/12/2018] Browser extension comparison: Malwares and Phishings Test 24/11 Q&A - [Updated 24/11/2018] Browser extension comparison: Malwares and Phishings Test 12/11 Q&A - [Updated 12/11/2018] Browser extension comparison...
So, what I said before, in that way Google Safe Browsing also can be used.
- Jul 27, 2015
- 5,458
Sad to hear, but you and anybody else should try to understand that reviews here on MT comes with a specific disclaimer that is very important to understand. Let me try help and quote :
It uses cloud-based processing like McAfee, AVG, Symantec and many others, but it doesn't need a whole file to be sent to the cloud. This is only if the verdict is inconclusive.
How client behavioral blocking works
Microsoft Defender Antivirus can detect suspicious behavior, malicious code, fileless and in-memory attacks, and more on a device. When suspicious behaviors are detected, Microsoft Defender Antivirus monitors and sends those suspicious behaviors and their process trees to the cloud protection service. Machine learning differentiates between malicious applications and good behaviors within milliseconds, and classifies each artifact. In almost real time, as soon as an artifact is found to be malicious, it's blocked on the device.
Client behavioral blocking - Microsoft Defender for Endpoint
Client behavioral blocking is part of behavioral blocking and containment capabilities at Microsoft Defender for Endpoint
docs.microsoft.com
So are you claiming that F-Secure does have system-wide web blocking?
Last edited by a moderator:
- Aug 17, 2014
- 11,256
My point was just to mention that MD/WD doesn't includes a local BB which is able to work even offline to block suspicious files, that's a real downside compared to other major AVs. That is a fact and nothing like claiming my personal opinion as trueIt uses cloud-based processing like McAfee, AVG, Symantec and many others, but it doesn't need a whole file to be sent to the cloud. This is only if the verdict is inconclusive.
How client behavioral blocking works
Microsoft Defender Antivirus can detect suspicious behavior, malicious code, fileless and in-memory attacks, and more on a device. When suspicious behaviors are detected, Microsoft Defender Antivirus monitors and sends those suspicious behaviors and their process trees to the cloud protection service. Machine learning differentiates between malicious applications and good behaviors within milliseconds, and classifies each artifact. In almost real time, as soon as an artifact is found to be malicious, it's blocked on the device.
Client behavioral blocking - Microsoft Defender for Endpoint
Client behavioral blocking is part of behavioral blocking and containment capabilities at Microsoft Defender for Endpointdocs.microsoft.com
According to official Microsoft Whitepaper, found here: http://download.microsoft.com/download/3/0/8/3085D641-1CA8-4E21-92DB-3D17F231D252/Windows security on disconnected devices whitepaper.pdfMy point was just to mention that MD/WD doesn't includes a local BB which is able to work even offline to block suspicious files, that's a real downside compared to other major AVs. That is a fact and nothing like claiming my personal opinion as true
It also has local behavioural detections added to database such as this: Behavior:Win32/SenseToVDMCreateFile20122522112.A threat description - Microsoft Security Intelligence
- Jul 27, 2015
- 5,458
The review sections disclaimer and extra so what I quoted is for All software reviews posted here on MT. That is important to understand. The review section here on MT is not created as something that automatic is more valuable and worth then everything else said, done or ever tested either on this forum or anywhere else. That's partially why the disclaimers exist to help explain.
That said, it does not mean that everything posted, said or stated on members reviews are wrong, but one should understand that, again :
- May 10, 2019
- 2,289
@McMcbrad When I was using F-Secure it used to block IDM from downloading its updates. F-Secure has an option to block applications from downloading harmful content. Can this be considered a system-wide web protection?
I haven't tested it with IDM as I do not use any. System-wide web blocking will work on all apps, regardless of the port and not only when they download files, but when they issue any connection whatsoever.
E.g. Malware.exe wants to connect to 192.168.088.011 on port 65536. The related IP address is already in blacklist and connection is aborted, before any download/upload is initiated. This can prevent not only secondary payload download, but can also stop malware from uploading personal data, such as files, credentials, etc.
Just blocking a download can't be considered system-wide web blocking.
Last edited by a moderator:
- Aug 17, 2014
- 11,256
Where are the settings of "behavioral detection" that isn't fully enabled by default, we need tools like Configure-Defender or tweaking via Group-Policy.
Turn on cloud protection in Microsoft Defender Antivirus - Microsoft Defender for Endpoint
Turn on cloud protection to benefit from fast and advanced protection features.
docs.microsoft.com
Enable block at first sight to detect malware in seconds - Microsoft Defender for Endpoint
Turn on the block at first sight feature to detect and block malware within seconds.
docs.microsoft.com
My tests shows me the opposite, unknown malware can't be detected by Microsoft without active internet connection, that shows me it doesn't work offline, but everyone is free to believe what he want...
Last edited:
Tweaking is indeed needed, but F-Secure in their DeepGuard whitepaper, McAfee in their RealProtect documentation, Symantec in their Endpoint Protection help files all mention that cloud look-ups are performed. It's not guaranteed that without connection, the performance of their behavioural blocking will be the same as online.
Last edited by a moderator:
- Sep 5, 2017
- 1,173
What about Kaspersky , Do you have any idea ??
I believe @harlan4096 is the best person to ask here, but Kaspersky and Bitdefender help files/whitepapers don't mention anything about internet connection anywhere. When I tested Kaspersky, malware removal was triggered after connection to a blacklisted C&C server was attempted, but I did not test whether it will be blocked without internet connection. The information wouldn't be relevant to anyone, as the malware itself was cloud-reliant.
- Apr 28, 2015
- 8,948
Kaspersky has an offline BB but also improves greatly when online and cloud...
- Sep 5, 2017
- 1,173
most APT or silent Trojans will mostly need C&C to downloads their tasks/Other components unless if they are type of worms to make botnet network however ransomware would be good test case and best scenario to test malware which may not need to to communicate with C&C in its first stages
- Sep 5, 2017
- 1,173
yes i think it incorporates cloud analysis and KSN in it but i am not sure as iam not heavy tester as you
Unfortunately I forgot to turn off Kaspersky cloud telemetry whilst writing custom ransomware, my executable was uploaded and was detected the next day (I was just finishing the file iterator), so I couldn't test it against truly unseen ransomwaremost APT or silent Trojans will mostly need C&C to downloads their tasks/Other components unless if they are type of worms to make botnet network however ransomware would be good test case and best scenario to test malware which may not need to to communicate with C&C in its first stages
I had to change the whole key generator logic + the note writer module and it's too much hassle.
The ransomware I discovered/did before was all detected by heuristics set to max. It could be stopped by Application Control as well.
Similar threads
