Exploits vs Antivirus – The Last Stand

17 comments

1. The panda products should detect exploits that are inactive

   i understand Kernel Rules Engine is for to protect installed apps from active exploits by using policy rules

   but It better to prevent the inactive exploits from actvating by having detections for them so they get detected immediatly when they enter the system

   Reply

2. In some cases this might even be right, but using AV signatures for detecting exploits is not necessarily the most effective strategy. There are better and more efficient techniques. Btw this reminds me of a similar test published by SANS titled “Effectiveness of AV in Detecting Metasploit Payloads”:
   http://www.sans.org/reading_room/whitepapers/casestudies/2134.php

   Reply

3. I'm just an end user of Panda product and I can personally say that I used in the past Norton but it was slow, heavy and some bad software were not recognised and for these reasons I'm using now Panda (with happiness).

   As end user I can't say the product A is better then B from a technical point of view: I haven't test files to use to check product A and product B, but I would like to write you my point of view: this seems, seems to me, a commercial test because I can't believe Norton has reached 20% and all the other so few (less than 5%).

   I think, as written before from Pedro Bustamante, that if Secunia tries to send these files via e-mail on a victim computer with the relative antivirus program installed and running or if Secunia tries to run / open each file the result will be different.

   As last my personal point I would like to write that automatic updates are important and usefull and normally enabled. So, for me, to check an old exploit in an unpatched operating system / program and to get a goal is less important that to check a new exploit / bad software in a patched system / program.

   I mean, for me to know that Norton finds X dangerous files on an unpatched computer is not so important. For me it's important to know in how much time Norton finds X new dangerous files on an updated computer while the relative fix is missing. This last test will be more important for me and I think that with this the results will be different than Norton 20% other less than 5 %.

   [ I'm sorry for English errors, if present! 🙂 ]

   Reply

4. jon wrote: “The panda products should detect exploits that are inactive”

   That doesn’t work. It is simply WAY to easy to disguise the functionality of code, especially if it is hand-written machine language. (Yes, I come from the days of looking up opcodes in the manual.) White-listing and behavior analysis are highly effective, and you really do have to wait for something to go active before you know what it will do.

   Reply

5. “if they would have tested correctly they would have found out that just with Kernel Rules Engine Panda’s product is able to generically and proactively block 56% of the important threats.”

   Bragging about a 56% detection rate is still a huge SECURITY FAIL..

   Antivirus technology is dead dead dead…the ever increasing number of botnets and the thriving underground malware economy are perfect evidence of this. Wake up Panda.

   Reply

6. It's just an example as proof that there are other technologies that are better suited at stopping exploits than AV signatures. Security Suites have many different layers of technology which the majority of the people, including yourself as its seems from your comment, flat out ignore.

   You don't seem to understand the real problem behind security technologies and bundle it all around an "AV is dead" simplistic view without any real or significant data to back it up. I recommend kurt wismer's blog which has plenty of hard evidence and reasoning against this "AV is dead" thinking and which I will not cover in this blog as its a waste of time:

   http://anti-virus-rants.blogspot.com/

   Reply

7. @fail: You overlooked two times that Pedro was only speaking about one single feature of Panda’s security suite? Wow…

   @Pedro: But I would be interested in knowing the detection rate of the full product according to this “test”. As you were able to get the detection rate for just using KRE you should be able to produce the more interesting result, too, shouldn’t you?

   Btw, reading this post was very amusing! Thanks, Pedro 😉

   Reply

8. Moritz, good to read you around here again.

   As you mention I think it would be very interesting to perform these kinds of tests with real-life exploit-using malware (which btw is not the same thing as only PoC exploits!). I haven't tested every single file in Secunia's test simply because of the effort of running and documenting each one. The results from KRE are based on the type of exploit, not because I've executed each one. The way KRE works any PPT/PDF/DOC/XLS/etc. exploit would have been block regardless of which exploit it is.

   It seems that Secunia in their response post (http://secunia.com/blog/30/) arguing that the original intention of the test was to show that "patching must be done regardless of wheather you have AV or not" (which btw is not what I got out of reading Secunia's report, but whatever) mentions that their next test will take into consideration running the exploits and recording the complete results.

   This brings up another interesting point which is worth investigating further. Is AV supposed to protect against ALL unpatched applications and OS components?

   Reply

9. I was always here, I just didn’t have anything to say.

   I think an important aspect for users is this part of Secunia’s response post: “If a user receives e.g. an Office document, saves it, scans it, and it isn’t detected as malicious, the user would (and should be able to) trust the document as it may be e.g sent to someone else or moved to a system without the same kind of protection.”
   I was thinking the same, when I first read this blog entry. Consider an exploit for a problem patched a long time ago. A company unknowingly wants to include a file containing the exploit in a distribution of their product. The scanner doesn’t have a signature for it and testing the product doesn’t reveal it either, because the affected component is patched, so no malicous code was executed. Of course, the product is installed by a user who disabled Windows updates “because it’s evil”. BAMM!

   So the question is, does it make sense to create a signature for every more or less polymorphically generated exploit, when the exploit has no chance on a patched system and things like KRE would detect it on an unpatched one?
   And how would it be possible to protect against all implementations of every exploit?! There surely are cases where you would need to solve the halting problem to do that, although you might then be able to say, it’s “probably malicious”.

   So I would wish AVs “to be able to detect malicious content while it is passive”, but I don’t think it’s sensibly possible (not mentioning zero-day exploits). But an up-to-date set of signatures fed from the results of KRE et al from the cloud should already be able to handle a large part of this problem.

   Reply

10. Sounds like some sour grapes in the AV community. Someone performs testing they don’t like, and they get a low score. So it’s only natural to scream foul at the test. Admitting your AV Suite has shortcomings would be bad for business, after all.

    I’ve enjoyed reading not just Panda’s reaction, but the reaction of all of the other AV blogs as well. But the fact is that this test is a TINY piece of the consumer AV puzzle. If you have a strong product, there should be no cause for concern. The level of concern tells me that the strengths of these suites tested are in question.

    Reply

11. hey petro,

    Is the exploit KB958644 proactivly detected in vista

    i count’t install it because it gave me a blue screen crashes that said somthing not equal

    i just want to make sure im protected

    please answer my emails

    thanks

    Reply

12. Moritz, you touched on the two main issues: it’s not efficient to maintain signatures for every possible exploit as there are other better suited techniques against this rather than signatures (not to mention patching).

    But more importantly you touched on an issue that was completely missed in the test and all discussions around it: patching is important but what happens with exploits for zero-day vulnerabilities?

    Mikey, that’s one way of looking at it. Another way of looking at it is that those of us who have stronger products get mis-represented more by these type of tests than those who have even less technology against this type of threats (if tested correctly, of course).

    Julevine, send me an email with the details and I’ll look at the problem. I just have one email from you but it’s about the quarantine.

    Reply

13. Hi Pedro,

    Panda Antivirus work well on my pc. Resource hog when panda update virus signature. The file named PAVSRV51.exe used 99% of my cpu usage. Hope Panda team can calculate the best algorithm for that file. Make it use low resource.

    My CPU is intel core duo with 1 GB of RAM

    Reply

14. So? It’s best if an AV can detect inactive exploits. If the exploit is active, damage may have already been done.

    Reply

15. I’m sure if Panda won, Panda wouldn’t be complaining =

    Reply

16. The test is valid. I don’t see how it’s invalid …

    Read this thread:

    http://www.wilderssecurity.com/showthread.php?t=228862

    To condense the contents of the thread, the posters agreed that detection of an inactive exploit was optimal; even Panda, the supposed leader, was not able to stop 100%, much less 70%, of the exploits with real-time and on-demand scanning.

    Now, Symantec already has a head-start of about 30% when it comes to detecting exploits; combine that with their real-time protection, you have a winner.

    Now, those exploits could be, or are, considered and classified as backdoors. That shows that Panda has poor backdoor detection. Along with each other security suite tested = …

    I’m sorry, however getting a poor score on a test does not constitute failure.

    Reply

17. Tech0, I really don’t think you are understanding the issues behind all the things that are wrong with Secunia’s testing methodology. I recommend that you search around for comments by actual experts about Secunia’s faulty methodology and not rely on some anoynmous post who also doesn’t understand the issues behind complex security testing.

    And just for the record, even if Panda would have detected more than the rest of vendors using signatures over inactive exploits, I can assure you I would still be complaining about the lack of valid testing methodology.

    Reply