Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 807932" data-attributes="member: 32260">SmartScreen Application Reputation filter is based on Artifical Intelligence which can calculate the reputation of applications. It can take as input many factors like application prevalence, digital certificate, reputation history, etc. If the application is signed with a common digital certificate then other factors (like prevalence and reputation history) are also important. So, most signed malware can be blocked by SmartScreen anyway.Yet, if the never-seen-malware uses Extended Validation Certificate (requires verification of the requesting entity&#039;s identity by a certificate authority) or digital certificate stolen from a very popular application, then it can usually bypass SmartScreen. That happened twice in @skalan tests (one malware cannot infect the testing system anyway).In H_C, the SmartScreen is used only for application installers (not payloads). So in the real world, the chances of infection in the home environment via SmartScreen are close to 0, because H_C settings apply other protection layers to prevent payloads.</blockquote>

[QUOTE="Andy Ful, post: 807932, member: 32260"] SmartScreen Application Reputation filter is based on Artifical Intelligence which can calculate the reputation of applications. It can take as input many factors like application prevalence, digital certificate, reputation history, etc. If the application is signed with a common digital certificate then other factors (like prevalence and reputation history) are also important. So, most signed malware can be blocked by SmartScreen anyway. Yet, if the never-seen-malware uses Extended Validation Certificate (requires verification of the requesting entity's identity by a certificate authority) or digital certificate stolen from a very popular application, then it can usually bypass SmartScreen. That happened twice in @skalan tests (one malware cannot infect the testing system anyway). In H_C, the SmartScreen is used only for application installers (not payloads). So in the real world, the chances of infection in the home environment via SmartScreen are close to 0, because H_C settings apply other protection layers to prevent payloads. [/QUOTE]

Verification