Serious Discussion iDefender

[B-boy/StyLe/]

Hello,

Sorry if already there is a topic about this one, but the search didn't return anything related.
Did someone of you is aware and tested this Korean freeware application?
I watched some tests and one application caught my eyes. It is called iDefender.
Didn't have the time to test it yet, but it looks promising and interesting.
What do you think? Is it worth a try? Probably @Shadowra or @cruelsister can give it a test as well?

Here are the tests:





This seems to be the homepage (with Google Translate):

무료 멀웨어 및 랜섬웨어 방어 | iDefender

iDefender의 작동 방식은 HIPS와 유사하다. 즉, 프로세스 하나하나 세심하게 관리하고픈, 또 관리할 수 있는 여력을 보유한 고급 사용자를 위한 취약성 공격 차단 및 멀웨어/랜섬웨어 방어용 Windows 보안 프로그램이라고 할 수 있다.

singingdalong-blogspot-com.translate.goog

The GitHub page:

Releases · wecooperate/iDefender

iDefender（冰盾 - 终端主动防御系统）. Contribute to wecooperate/iDefender development by creating an account on GitHub.

github.com

The download link: (the latest version is 2.9.1).

https://imonitorsdk.com/publish/iDefender.exe

The installer is clean regarding the virusTotal results:

VirusTotal

VirusTotal

www.virustotal.com

Best regards!

 

[Shadowra]

I don't know it, but I'll try it soon.

 

[lvseqiji]

It's a basicly a manaul HIPS come with many internalrules.
A Chinese company made it. The company makes a living by selling their iMonitorSDK(which is the tech inside iDefender) to big companies.
Have some screenshots:

Spoiler

You can see, iDefender's rules are based on template.
There are some templates with internal rules like System Reinforcement, Intelligent Protection, these templates are enabled by default.

 

[B-boy/StyLe/]

It's a basicly a manaul HIPS come with many internalrules.
You can see, iDefender's rules are based on template.

I see. It reminds me a little bit of a mix between OSArmor and Malware Defender.
I don't know why, but it gives me vibes of those.

 

[piquiteco]

I don't know why, but it gives me vibes of those.

 

[Moonhorse]

It reminds me a little bit of a mix between OSArmor and Malware Defender.

For me it looks like mix of OSArmor and huorong. It does look good, but does it work...will wait for testing

 

[Shadowra]

Tried it quickly and was rather disappointed.
The product is nice and so is the interface, but I noticed several problems.
Note that I used an old malware pack to see how the software would behave.

Here's what I noticed:

- The interface is quite nice and clear. However, there are still translation problems. On one alert, I saw symbols in Chinese, which can be disturbing. The software tries to guide, but can make bad decisions.
Example on this TDSS Rootkit once installed.

Spoiler: Rootkit

- On the RATs, it's clearly bad...
I quickly built a NanoCore-RAT which I encrypted with a crypter and selected to inject MSBuilder.exe and connect directly to one of my VPS servers. No reaction (I forgot to screen, sorry)

- On this test, I decide to run PolyRanson, a Ransomware that also releases ViraLock. The software tries to block the launch of the Ransomware, but after 2 minutes of struggle, the Ransomware launches...

Spoiler: PolyRansom

And to conclude, the software lacks maturity and has very few rules.
On the other hand, it did block my JS, VBS and HTA attacks, and the same in PowerShell, but it lacks rules for other malware...

I'll make a video about it later, but I strongly advise against using it on its own...
Why not use it as a second protection with Microsoft Defender, for example.

 

[B-boy/StyLe/]

I guess it will only be good in addition to the main solution installed on the system to complement it (if such addition is needed, of course).
I will stick to my current combo then (Comodo Firewall and Kaspersky Free) with my own settings.
The main reason I opened this topic was to see if it can compare with AppCheck Anti-Ransomware and KART to decide if I should recommend it as a companion against ransomware.
These were also good regarding the tests Nuri Anti-Ransom (not free anymore), INCRYPT (no longer available), Owlyshield (need to be further developed) so I hoped that iDefender could also be included in my recommendation list. Too bad that RansomOff and RanStop were abandoned a few years ago. They also had the potential to be good.
Thanks for your time testing it.

 

[lvseqiji]

Tried it quickly and was rather disappointed.
The product is nice and so is the interface, but I noticed several problems.
Note that I used an old malware pack to see how the software would behave.

Here's what I noticed:

- The interface is quite nice and clear. However, there are still translation problems. On one alert, I saw symbols in Chinese, which can be disturbing. The software tries to guide, but can make bad decisions.
Example on this TDSS Rootkit once installed.

Spoiler: Rootkit

View attachment 277804

- On the RATs, it's clearly bad...
I quickly built a NanoCore-RAT which I encrypted with a crypter and selected to inject MSBuilder.exe and connect directly to one of my VPS servers. No reaction (I forgot to screen, sorry)

- On this test, I decide to run PolyRanson, a Ransomware that also releases ViraLock. The software tries to block the launch of the Ransomware, but after 2 minutes of struggle, the Ransomware launches...

Spoiler: PolyRansom

View attachment 277805

And to conclude, the software lacks maturity and has very few rules.
On the other hand, it did block my JS, VBS and HTA attacks, and the same in PowerShell, but it lacks rules for other malware...

I'll make a video about it later, but I strongly advise against using it on its own...
Why not use it as a second protection with Microsoft Defender, for example.

It still lacks rules. And it's not like comodo, it will not alert unless there is a rule.
For the translation problem part, its actually just the name of the rule template(which is in chinese), can be manually changed.

 

[lvseqiji]

I guess it will only be good in addition to the main solution installed on the system to complement it (if such addition is needed, of course).
I will stick to my current combo then (Comodo Firewall and Kaspersky Free) with my own settings.
The main reason I opened this topic was to see if it can compare with AppCheck Anti-Ransomware and KART to decide if I should recommend it as a companion against ransomware.
These were also good regarding the tests Nuri Anti-Ransom (not free anymore), INCRYPT (no longer available), Owlyshield (need to be further developed) so I hoped that iDefender could also be included in my recommendation list. Too bad that RansomOff and RanStop were abandoned a few years ago. They also had the potential to be good.
Thanks for your time testing it.

It's not really an anti-ransomware solution.Just an old-school HIPS with some custom rules.
Detecting a ransomware is much more complicated.

 

[B-boy/StyLe/]

It's not really an anti-ransomware solution.Just an old-school HIPS with some custom rules.
Detecting a ransomware is much more complicated.

Yes, I noticed that rollback is not available.
However, it was good in the Ransim test and most of the ransomware samples used in the clip in my first post.

 

[cruelsister]

Although this is a very interesting application, I personally wouldn't suggest it as either primary or secondary protection as it suffers from far too many flaws.

With regard to ransomware, utilizing the program with default rules in place one will notice that although certain items in the Documents folder are protected (as long as one ONLY has certain file types- like doc, docx, xls, etc- essentially those things set in the protection rule), other items not in the rule will be trashed. A further issue will occur if an added rule for txt files is added. Although protection will be afforded for these items, I noticed HIPS-like warnings when installing legitimate applications that will throw out txt files during installation.

Also file types in other locations will not be protected, so at default everything in the Pictures , Video, and Music folders will be encrypted' even more of a pain is stuff on the Desktop are toast.

As to other malware forms, although most Scriptor Worms are prevented (along with their persistence mechanisms), other are not. Malware utilizing Powershell are detected and prevented, but once again there are issues with valid applications that use Powershell- warnings will also appear here making it difficult to decide what is malicious and what is benign.

DLL side loading and straight dropping with persistence were also seen to be problematic as was the creation of malicious services.

So although I did a quite cursory test, it was enough to determine that iDefender is a sub-optimal choice for protection against malware.

 

[NormanF]

Hello,

Sorry if already there is a topic about this one, but the search didn't return anything related.
Did someone of you is aware and tested this Korean freeware application?
I watched some tests and one application caught my eyes. It is called iDefender.
Didn't have the time to test it yet, but it looks promising and interesting.
What do you think? Is it worth a try? Probably @Shadowra or @cruelsister can give it a test as well?

Here are the tests:





This seems to be the homepage (with Google Translate):

무료 멀웨어 및 랜섬웨어 방어 | iDefender

iDefender의 작동 방식은 HIPS와 유사하다. 즉, 프로세스 하나하나 세심하게 관리하고픈, 또 관리할 수 있는 여력을 보유한 고급 사용자를 위한 취약성 공격 차단 및 멀웨어/랜섬웨어 방어용 Windows 보안 프로그램이라고 할 수 있다.

singingdalong-blogspot-com.translate.goog

The GitHub page:

Releases · wecooperate/iDefender

iDefender（冰盾 - 终端主动防御系统）. Contribute to wecooperate/iDefender development by creating an account on GitHub.

github.com

The download link: (the latest version is 2.9.1).

https://imonitorsdk.com/publish/iDefender.exe

The installer is clean regarding the virusTotal results:

VirusTotal

VirusTotal

www.virustotal.com

Best regards!

Latest version is 2.9.3

 

[NormanF]

Tried it quickly and was rather disappointed.
The product is nice and so is the interface, but I noticed several problems.
Note that I used an old malware pack to see how the software would behave.

Here's what I noticed:

- The interface is quite nice and clear. However, there are still translation problems. On one alert, I saw symbols in Chinese, which can be disturbing. The software tries to guide, but can make bad decisions.
Example on this TDSS Rootkit once installed.

Spoiler: Rootkit

View attachment 277804

- On the RATs, it's clearly bad...
I quickly built a NanoCore-RAT which I encrypted with a crypter and selected to inject MSBuilder.exe and connect directly to one of my VPS servers. No reaction (I forgot to screen, sorry)

- On this test, I decide to run PolyRanson, a Ransomware that also releases ViraLock. The software tries to block the launch of the Ransomware, but after 2 minutes of struggle, the Ransomware launches...

Spoiler: PolyRansom

View attachment 277805

And to conclude, the software lacks maturity and has very few rules.
On the other hand, it did block my JS, VBS and HTA attacks, and the same in PowerShell, but it lacks rules for other malware...

I'll make a video about it later, but I strongly advise against using it on its own...
Why not use it as a second protection with Microsoft Defender, for example.

Its robust with custom rules. Not so much as a standalone. This is an HIPS not an anti-exe.

 

[Shadowra]

Its robust with custom rules. Not so much as a standalone. This is an HIPS not an anti-exe.

I know but I was pointing out that by default, its rules are too weak

 

[NormanF]

I know but I was pointing out that by default, its rules are too weak

Yup. If cruelsister has a custom rule config for this kind of software, it could provide very strong protection. Its own default rules don't make it as capable as it could be.

 

[NormanF]

Although this is a very interesting application, I personally wouldn't suggest it as either primary or secondary protection as it suffers from far too many flaws.

With regard to ransomware, utilizing the program with default rules in place one will notice that although certain items in the Documents folder are protected (as long as one ONLY has certain file types- like doc, docx, xls, etc- essentially those things set in the protection rule), other items not in the rule will be trashed. A further issue will occur if an added rule for txt files is added. Although protection will be afforded for these items, I noticed HIPS-like warnings when installing legitimate applications that will throw out txt files during installation.

Also file types in other locations will not be protected, so at default everything in the Pictures , Video, and Music folders will be encrypted' even more of a pain is stuff on the Desktop are toast.

As to other malware forms, although most Scriptor Worms are prevented (along with their persistence mechanisms), other are not. Malware utilizing Powershell are detected and prevented, but once again there are issues with valid applications that use Powershell- warnings will also appear here making it difficult to decide what is malicious and what is benign.

DLL side loading and straight dropping with persistence were also seen to be problematic as was the creation of malicious services.

So although I did a quite cursory test, it was enough to determine that iDefender is a sub-optimal choice for protection against malware.

Its not meant to be an anti-ransomware solution. Stick to your AV or AppCheck for that. Ice Shield is intended to provide HIPS protection by leveraging the Microsoft kernel using its built-in protection and its more of a front-end to it here.

 

[lvseqiji]

Updated to 3.2.0.0
A lot of usability improvements, especially the rules template system.
Many new rules were added too.
This product is being updated quite frequently.

 

[B-boy/StyLe/]

Updated to 3.2.0.0
A lot of usability improvements, especially the rules template system.
Many new rules were added too.
This product is being updated quite frequently.

And now the version is 3.2.1.0.
They work really hard (fast), but too bad they don't update the GitHub page and the changes are not in English, so one should use the translator.

 

[NormanF]

Latest version 3.5.0

As mentioned, the Github version is long out of date.