App Review F-Secure SAFE vs Ransominator

[bayasdev]

Content source

https://www.youtube.com/watch?v=EqfBuyGvX1Y

I've setup protected folders but my sample is not able to trigger it or DeepGuard

Spoiler: DISCLAIMER

This test shows how an antivirus behaves with certain threats, in a specific environment and under certain conditions.
We encourage you to compare these results with others and take informed decisions on what security products to use.
Before buying an antivirus you should consider factors such as price, ease of use, compatibility, and support. Installing a free trial version allows an antivirus to be tested in everyday use before purchase.

 

[MacDefender]

This matches my results with F-Secure. Even the Ransomware Protection designated folders doesn't overpower their whitelisting of the 7zip executable.

This has resulted in successful in the wild exploitation in the past -- except in the real world, the attacker just brought along a Node.js runtime.

 

[LDogg]

Yikes, as a home user, and tech savvy myself, probably have a low chance of encounter this. Sounds like a wild pokemon when in this context.

~LDogg

 

[MacDefender]

Yikes, as a home user, and tech savvy myself, probably have a low chance of encounter this. Sounds like a wild pokemon when in this context.

~LDogg

I would still feel confident about F-Secure in the real world. Check out @harlan4096's final test report, Malware Hub Report - F-Secure 17.8 Beta - January 2020 Report

Of all of the tested samples, F-Secure only allowed one to encrypt your documents, and that was using the Node.js technique to bypass DeepGuard using a whitelisted binary. F-Secure did fairly well for static scanning. It did as well as I've seen other products do in the Hub for bonus dynamic testing (basically just DeepGuard testing). It has 4 or 5 engines layered together with differing strengths while remaining light.

DeepGuard used to have a reputation for having too many false alarms. These days, I find this new balance to be totally reasonable. Given all this talk about whitelisting individual Steam games to use Protected Folders, etc, I understand why F-Secure might have decided to implement their Protected Folders in this fashion.

 

[LDogg]

I would still feel confident about F-Secure in the real world. Check out @harlan4096's final test report, Malware Hub Report - F-Secure 17.8 Beta - January 2020 Report

Of all of the tested samples, F-Secure only allowed one to encrypt your documents, and that was using the Node.js technique to bypass DeepGuard using a whitelisted binary. F-Secure did fairly well for static scanning. It did as well as I've seen other products do in the Hub for bonus dynamic testing (basically just DeepGuard testing). It has 4 or 5 engines layered together with differing strengths while remaining light.

DeepGuard used to have a reputation for having too many false alarms. These days, I find this new balance to be totally reasonable. Given all this talk about whitelisting individual Steam games to use Protected Folders, etc, I understand why F-Secure might have decided to implement their Protected Folders in this fashion.

I feel confident as I know the software is a top notch, just when people do this it can be/seem scary for other(s).

~LDogg

 

[MacDefender]

I feel confident as I know the software is a top notch, just when people do this it can be/seem scary for other(s).

~LDogg

Yep it's a great reminder that no AV software is perfect. You have to pair it at least with good common sense, and never feel so confident in your malware protection that you're willing to handle potentially unsafe files using a valuable computer.

 

[LDogg]

Yep it's a great reminder that no AV software is perfect. You have to pair it at least with good common sense, and never feel so confident in your malware protection that you're willing to handle potentially unsafe files using a valuable computer.

Yes, one has to use common sense for daily activities for sure.

~LDogg

 

[The Ordynary]

goodbye deep guard,