App Review Webroot Secure Anywhere vs Zero Day Scriptor

[cruelsister]

Actually as I have noted on a number of the threads, the malware being used is not a script itself, but has script-like effects. A rather large difference. And as it has only been observed in a few recent targeted attacks, it is not a current pain at all.

But if I'm back by the time Windows 10 is released, I'll add one more video to the marathon.

 

[Martin_C]

Thank you very much for a very informative post.

Actually as I have noted on a number of the threads, the malware being used is not a script itself, but has script-like effects. A rather large difference.

Ah, so lets sum up what we know so far.

Even though damages from scripts ARE a pain, and even though malicious scripts ARE acknowledged by the security industry and even though Microsoft are making new features available in Windows 10 to fight these problems - then your present malicious code has nothing to do with these.

The name, judging by the comments it produces, seems to be click-bait.

And as it has only been observed in a few recent targeted attacks, it is not a current pain at all.

But if I'm back by the time Windows 10 is released, I'll add one more video to the marathon.

Ah, so what this suggest is that the company you apparently work for has simply discovered a vulnerability.
Nothing new here.
This happens on every OS on a regular basis and has been happening since the very first OS was written.

The usual chain of events for responsible researchers are to report the newly found vulnerability to the vendor of said OS, Microsoft in this case, it will get verified, patched and all users benefit from the added security.

But since you claim you will be back in a couple of months to retest on Windows 10 RTM, we can conclude that it has not been reported in correct channels.

From your posts we can read you work in the IT industry, you and your employer has seemingly not reported found vulnerability and you have chosen instead to use it to make "funny" YouTube videos ??

Could we please have the name of your employer ??

/ sarcasm on

Because I think every CEO and end user in the world, are bursting with excitement to do business with you, when you are gambling with everyones security just so you can harass various companies in the IT security industry on YouTube.

/ Sarcasm off.

 

[Tony Cole]

Do you really have to be so rude/blunt, we do have several IT/security experts on the forum, e.g., Fabian Wosar from Emsisoft and Nico@FMA who runs his own AV company, but may be they too are lying.

 

[Martin_C]

Do you really have to be so rude/blunt, we do have several IT/security experts on the forum, e.g., Fabian Wosar from Emsisoft and Nico@FMA who runs his own AV company, but may be they too are lying.

Actually I think any vendor including those you mention, will prefer to be contacted through proper channels instead of through YouTube.

 

[ifacedown]

A good combo is WSA + AE (a lot of WSA fanboys use VS).

actually, VS (VodooShield) is becoming popular because of its simplicity and protection. In its Website it recommends Webroot as its partner AV.

Webroot + VS == light good protection

 

[Deleted member 178]

Actually I think any vendor including those you mention, will prefer to be contacted through proper channels instead of through YouTube.

reporting is a matter of choice; some do, other don't. By using Windows or any softwares , we are not bound to report their flaws.
After all we are not paid by them to do their job, for free.

Not saying that many flaws are discovered by government agencies and not reported until the usefulness of the flaw is done.

 

[cruelsister]

Rod- Thanks for the feedback on the music. I definitely love Buddy Guy, but lately have been moving more in the direction of Lisa Gerrard and Sleepingdog.

As to the AV question any answer from me is probably not want you want to hear. In the past malware was written for High and Noble purposes (like making desktop icons move around when the mouse pointer got near them or something like deleting random directories- that sort of thing). But with the advent of things like Data Stealers and Ransomware (where the Blackhats want to get paid) things changed. This change was more a function of the badguys changing servers in order to avoid detection more than anything else. Basically the malware has morphed to a new version is in place, and so on. But as I really don't want to go into the weeds here, I direct you to these reports if you are interested:

http://www.imperva.com/docs/HII_Assessing_the_Effectiveness_of_Antivirus_Solutions.pdf

and here: https://www.fireeye.com/blog/executive-perspective/2014/05/ghost-hunting-with-anti-virus.html

A second reason is the inability of traditional AV solutions to detect script based codes (like the one I wrote that was highlighted in this series of Videos). Inability is probably not the best word to use, as they could be able if they change the way their products worked. The issue is that many will use a script for diverse legitimate purposes, but a simple change in the script can turn it into malware. As it is extremely hard to detect the difference between good and bad (and consistent FP's will be bad for business) they prefer to ignore them. This has led to numerous severe security breaches in place like Home Depot, Target, etc. The malware I wrote for these tests highlights this blindspot (with the added surprise of bypassing UAC). In short, this is not new knowledge to anyone.

Umbra-

After all we are not paid by them to do their job, for free.

Good point. Companies like Endgame in the US and Vupen in France charge millions for passing on the exploits they uncover.

 

[Rod McCarthy]

Rod- Thanks for the feedback on the music. I definitely love Buddy Guy, but lately have been moving more in the direction of Lisa Gerrard and Sleepingdog.

As to the AV question any answer from me is probably not want you want to hear. In the past malware was written for High and Noble purposes (like making desktop icons move around when the mouse pointer got near them or something like deleting random directories- that sort of thing). But with the advent of things like Data Stealers and Ransomware (where the Blackhats want to get paid) things changed. This change was more a function of the badguys changing servers in order to avoid detection more than anything else. Basically the malware has morphed to a new version is in place, and so on. But as I really don't want to go into the weeds here, I direct you to these reports if you are interested:

http://www.imperva.com/docs/HII_Assessing_the_Effectiveness_of_Antivirus_Solutions.pdf

and here: https://www.fireeye.com/blog/executive-perspective/2014/05/ghost-hunting-with-anti-virus.html

A second reason is the inability of traditional AV solutions to detect script based codes (like the one I wrote that was highlighted in this series of Videos). Inability is probably not the best word to use, as they could be able if they change the way their products worked. The issue is that many will use a script for diverse legitimate purposes, but a simple change in the script can turn it into malware. As it is extremely hard to detect the difference between good and bad (and consistent FP's will be bad for business) they prefer to ignore them. This has led to numerous severe security breaches in place like Home Depot, Target, etc. The malware I wrote for these tests highlights this blindspot (with the added surprise of bypassing UAC). In short, this is not new knowledge to anyone.

Umbra-


Good point. Companies like Endgame in the US and Vupen in France charge millions for passing on the exploits they uncover.

WOW! Will peek at the articles, probably above my head, shame there is no really good IS software.

Oh and do u like the Zeppelin song...

You are probably a lot younger than myself, but even 50 years later my generations music is still popular.

I don't think rap will have the longevity of Zeppelin, Pink Floyd, or Ten years After...lol Just MHO

 

[woodrowbone]

Thx for all the testing cruelsister!
I just read about Netflix dumping their Antivirus solution, going for the next generation in protection they said: SentinelOne.
Join The Next Generation Endpoint Protection
I never tested this myself, but it would sure be interesting to see if the "next generation" can stand up to your scrip like malware.

Cheers

W

 

[Moose]

Salutations,Friends!

What is the cost for home users? And can you use with Sandboxie, Shadow Defender and (Toolwiz) Time Freeze?

Kind regards,

 

[FleischmannTV]

What is the cost for home users?

If they don't quote prices on the website, it's out of your reach, period. It usually means you have to buy a lot of licenses and each license costs more than what you usually pay for one home user license. You can easily expect a minimum commitment in the four figure range.

 

[cruelsister]

Actually for a decent sized organization it's more of the 6 figure ballpark. but certainly not for home use.

Sent1 is actually a decent product in that it takes advantage of the current trend of Dynamic Analysis (essentially Real-Time Forensics). For those not familiar, in a nutshell when a file is run the specific actions of the file is monitored, and if it fits into a malicious pattern it is immediately stopped (God, that is a very small nutshell- for those that are familiar with DA forgive me- this post has to be less than 100 pages).

The issue with Sent1 is that they are doing this without a sandbox, and the reason they give is that some malware are sandbox aware, so wouldn't be caught by those security products based on Virtualization. This is my issue with the product. Although totally true that some malware are indeed Sandbox aware and will slip by the riff-raffy Enterprise virtualization solutions (no names) the higher quality Solutions will use Dynamic Analysis within a sandbox. The point of this approach is that prior to the malware realizing it is within a sandbox, it must first query its environment. This is the point that the malware will be terminated- basically if you open your eyes to see where you are we will kill you.

Using Dynamic Analysis without virtualization will also kill any malware that questions its environment, but will not stop anything that as a first action does something malicious (like deleting files). Last year I stopped off at their booth at some conference or other and brought up this point. The answer was that they are working on damage mitigation procedures that will be out real, real soon (in other words, you're screwed). Although to be fair their product does automatically shut down trashed Endpoints very fast (sarcasm).

And that AV-TEST award still makes me giggle. It's almost as meaningful as being crowned King of the Hobo's.

 

[FreddyFreeloader]

Wondering if Webroot has incorporated AMSI into it's products?

 

[Moose]

Webroot Antivirus:
You can reach Tech support Monday - Friday from 7 am to 6:30 pm MST at 1-866-612-4227
http://www.webroot.com/us/en/home/products/geeksquad-dl

Look for Online Support in link above. And ask them!

Help Ticket Link Below:
Webroot Customer Service

http://www.webroot.com/us/en/company/contact-us