|
|
|
Microsoft Security Essentials: Road Test |
Si vous voulez bloquer ce service sur vos fils RSS
Si vous voulez nous contacter ou nous proposer un fil RSS
Menu > Articles de la revue de presse : - l'ensemble [ tous | francophone] - par mots clé [ tous] - par site [ tous] - le tagwall [ voir] - Top bi-hebdo de la revue de presse [ Voir]
Présentation : What better way to test the effectiveness of a malware scanner than to go download random binaries from the dirtiest part of the Internet... the P2P networks. Even worse, to really test Microsoft's Security Essentials I decided I would download, install and run LimeWire... and download binaries (.exe files) that I would normally avoid like the plague. It's simple to find malware on the 'net these days... pop open LimeWire and search for something like "Photoshop crack" or "{random app here} keygen"... you'll find all the malware testing you could ever want. As a control to Microsoft's Security Essentials I used VirusTotal.com. If you've never used VirusTotal it's a service that uses the major scanners out there (~40'ish or so) to scan your uploaded file and give you a verdict... pretty neat utility. Since not every Anti-Malware (A/M) program catches all threats it's best to run the binaries I've harvested through this handy-dandy little tool to ensure that I have a good idea of what the competitive products are finding on the binaries I'm working with. I will admit the results are a little... shocking, even for Microsoft's standards. Let the games begin! ----- Testing Method: Download random [suspect] binaries from LimeWire Keyword Search: "keygen" "crack" File Types: Windows .exe files Control: VirusTotal.com ----- 1. Name: "Office Mac Keygen" | Verdict: Obvious | VirusTotal Link: Here ( 89.47%) | MS SecEssentials: Fail 2. Name: "All Sony Products KeyGen 1.2" | Verdict: Obvious | VirusTotal Link: Here ( 92.69% ) | MS SecEssentials: Detected - TrojanDownloader:Win32/Tonick.gen (removed) 3. Name: "ALL_Xilisoft_Products_Keygen_v_1" | Verdict: Obvious | VirusTotal Link: Here ( 90.25% ) | MS SecEssentials: Detected - TrojanDownloader: Win32/Tonick.gen (removed) 4. Name: "berry white incl keygen by REVENGE" | Verdict: Obvious | VirusTotal Link: Here ( 87.81% ) | MS SecEssentials: Detected - 2 Threats (in 2 files) TrojanDownloader: Win32/Tracur.A et Tracur.B (removed) 5. *Name: "conficker_including_keymaker_by_T" | Verdict: Average | VirusTotal Link: Here ( 66.67% ) | MS SecEssentials: Detected - TrojanDownloader: Win32/Tracur.A 6. Name: "solo_le_pido_dios__including_crack" | Verdict: Obvious | VirusTotal Link: Here ( 92.31% ) | MS SecEssentials: Detected - TrojanDownloader: Win32/Tracur.A 7. Name: "umidimmi_var_KeyGen.All_Versions.zip" | Verdict: Average | VirusTotal Link: Here ( 74.36% ) | MS SecEssentials: Fail 8. Name: "SRS_Audio_SandBox_1.9.0.4_with_Keygen.zip" | Verdict: Obvious | VirusTotal Link: Here ( 90.25% ) | MS SecEssentials: Detected - TrojanDownloader: Win32/Tonick.gen 9. Name: "y_hubo_alguin_crack-serial-keygen.zip" | Verdict: Average | VirusTotal Link: Here ( 70.74% ) | MS SecEssentials: Fail 10. Name: "registry_clearner_from_TSRh_team (cracked).zip" | Verdict: Average | VirusTotal Link: Here ( 60.53% ) | MS SecEssentials: Fail Looking at the results, one could conclude that Microsoft's SecurityEssentials did not fare well compared to other anti-malware scanning engines. That being said the Security Essentials detection engine broke down on 1 obvious piece of malware (90% detection rate) and then choked on another 3 pieces of malware that had 60%, 70%, and 74% detection rates respectively. Ordinarily that's pretty bad but when you consider that Microsoft Security Essentials is free... one has to wonder. Overall some things that I noticed is that the engine's real time protection is a little lacking, as it rarely (only once) caught the piece of malware as it was being unzipped, and typically only when I attempted to actually run the file. This obviously isn't optimal, but not an entirely show-stopping failure given that most of the active pieces of malware require you to activate them somehow... such as double-clicking to execute the file. --- Bottom Line: The verdict, unfortuntaely folks... is that Microsoft's Security Essentials is essentially lacking on the detection front. In a world where Internet-borne threats are polymorphic, stealth, and ever-changing the Security Essentials tool fails to deliver real protection against the nasty things that go bump on the 'net. Even when compared against other freeware detection engines (such as AVG) Microsoft's engine still competes poorly, since every single piece of malware that Security Essentials missed, AVG's scanner caught. Sorry to say - but I recommend spending the cash for a decent anti-malware scanner boys and girls, "Code-name Morro" (Microsoft Security Essentials) isn't up to the task of protecting your computer. Interestingly enough - Steve Ragan over at The Tech Herald had exactly the opposite results. Odd... not sure what to make of this yet... but rest assured more analysis is happening as you read this. Check out Steve's absolutely comprehensive analysis (complete with video!) here... http://www.thetechherald.com/article.php/200926/3926/Review-Microsoft-Security-Essentials [][] [] [][]
Les mots clés de la revue de presse pour cet article : microsoft security
Les videos sur SecuObs pour les mots clés : microsoft security
Les mots clés pour les articles publiés sur SecuObs : microsoft security
Les éléments de la revue Twitter pour les mots clé : microsoft security
Les derniers articles du site "Digital Soapbox Preaching Security to the Digital Masses" :
- How NOT To Do a Security Advisory
- Internet Surveillance... for your Credit/Debit Cards?
- RANT Forget SSNs
- Fun PDF Stuffing Feature... hack
- SecurityMetrics - Another Site Security Certification Seal
- RANT Call Me a Realist
- OWASP Podcast #27 - Security Skeletor
- What ever happened to...
- Microsoft Security Essentials: Road Test
- Microsoft Security Essentials: First Impressions
- Bring on the KY
- OWASP 2009 AppSecDC Thoughts
- The iPhone worm ... SRSLY
- Completely Missing the Point
- CSI Annual 2009
- Fox News Bring Your Toddler To Work Day
- Hell in a Handbasket ...
- The Jihad Job ... recruiting via email
- What privacy I use Google ...
- Infosec is Rotten
Menu > Articles de la revue de presse : - l'ensemble [ tous | francophone] - par mots clé [ tous] - par site [ tous] - le tagwall [ voir] - Top bi-hebdo de la revue de presse [ Voir]
Si vous voulez bloquer ce service sur vos fils RSS :
- avec iptables "iptables -A INPUT -s 88.191.75.173 --dport 80 -j DROP"
- avec ipfw et wipfw "ipfw add deny from 88.191.75.173 to any 80"
- Nous contacter par mail
| Mini-Tagwall des articles publiés sur SecuObs : | | | | sécurité, exploit, windows, microsoft, réseau, attaque, outil, vulnérabilité, audit, système, virus, internet, données, présentation, metasploit, linux, bluetooth, protocol, vista, scanner, réseaux, shell, engineering, rootkit, paquet, conférence, trames, wishmaster, téléphone, source, sysun, noyau, mobile, https, mémoire, rapport, botnet, téléphones, libre, reverse, navigateur, patch, snort, scapy, intel |
| Mini-Tagwall de l'annuaire video : | | | | vmware, security, virus, biometric, windows, lockpicking, password, botnet, metasploit, tutorial, attack, crypt, linux, network, iphone, server, exploit, conficker, wimax, virtu, virtual, engineering, cisco, reverse, shmoocon, ettercap, wireshark, hacker, firewall, internet, knoppix, rootkit, arduino, wireless, source, conference, backtrack, openbsd, brucon, systm, overflow, openssh, buffer, access, remote |
| Mini-Tagwall des articles de la revue de presse : | | | | security, microsoft, windows, hacker, attack, network, vulnerability, google, exploit, malware, internet, remote, iphone, server, inject, patch, apple, twitter, mobile, virus, ebook, facebook, vulnérabilité, crypt, source, linux, password, intel, research, virtual, phish, access, tutorial, trojan, social, privacy, firefox, adobe, overflow, office, cisco, conficker, botnet, pirate, sécurité |
| Mini-Tagwall des Tweets de la revue Twitter : | | | | security, linux, botnet, attack, metasploit, cisco, defcon, phish, exploit, google, inject, server, firewall, network, twitter, vmware, windows, microsoft, compliance, vulnerability, python, engineering, source, kernel, crypt, social, overflow, nessus, crack, hacker, virus, iphone, patch, virtual, javascript, malware, conficker, pentest, research, email, password, adobe, apache, proxy, backtrack |
|
|
|
|
|
