App Review K7 Total Security vs CXK-NMSL ransomware

[stefanos]

Content source

https://www.youtube.com/watch?v=0skXuCq9FPI

 

[Der.Reisende]

Not surprising, K7‘s biggest weakness is Ransomware.
At least DataLocker safes you in 98% percent of cases (I‘ve seen it getting bypassed, too!)
I have a dozen related tickets submitted, they actually fixed the flaws for the samples (maybe families), but it seems very granular and therefore, new variants / other RW will bypass with a chance of 40-50%.

 

[stefanos]

Not surprising, K7‘s biggest weakness is Ransomware.
At least DataLocker safes you in 98% percent of cases (I‘ve seen it getting bypassed, too!)
I have a dozen related tickets submitted, they actually fixed the flaws for the samples (maybe families), but it seems very granular and therefore, new variants / other RW will bypass with a chance of 40-50%.

The same 360 TS.

 

[Parsh]

If I'm not wrong, this hub sample was a similar variant @Der.Reisende tested - that was modified by CS.
It did fail against batch file there too. Though the exe was blocked.
In the video K7 says that it blocked an untrusted program (cmd) from modifying the protected folders but it could trash the rest apparently. Uhm.

 

[Der.Reisende]

If I'm not wrong, this hub sample was a similar variant @Der.Reisende tested - that was modified by CS.
It did fail against batch file there too. Though the exe was blocked.
In the video K7 says that it blocked an untrusted program (cmd) from modifying the protected folders but it could trash the rest apparently. Uhm.

It's K7 DataLocker protecting folders (by default Documents and Pictures; with multiple users, it autodetects the folders). It's not a part of the Behaviour Blocking mechanism. It's rather the last line of defense, which can also fail.
I removed dllhost.exe from, and added SoftMaker Office to the trusted list.


EDIT: K7 DataLocker will block write access for everything not in the list, and to protected folders.
It even blocks Snipping Tool from saving pictures to the same name folder, with same error message, if not whitelisted.