Consumer AVs And Exploit Prevention
Targeted attacks exploiting endpoint vulnerabilities are becoming more and more common and increasingly aggressive. For this reason I could not help but notice the dealing with the capability of 13 consumer grade AV products, to protect against two critical Microsoft vulnerabilities ( and ). The successful exploitation of these critical vulnerabilities could result in arbitrary remote code execution by the attacker leading to very harmful consequences for the victim, such as, for instance, to make it become part of a botnet. Unfortunately a very common scenario in these troubled days. Even if these vulnerabilities are a couple of months old (and patched), the resulting is not so encouraging, and renews the dramatic question: are endpoint protection technologies, on their own, capable to offer adequate protection in the current cyber-landscape? Probably not, considering the the findings which are quite frustrating: Only 4 of the 13 products blocked all attacks: exploit preventionremains a challenge for most products; More than half of the products failed to protect against attacks over HTTPS that were blocked over HTTP, a serious deficiency for a desktop AV / host intrusion prevention system (HIPS.); Researchers are not the only ones testing security products – criminal organizations also have sophisticated testing processes in order to determine which product detects which malware, and how the various products can be evaded. Some crimewares will (already) include various one-click buttons to “Bypass VendorX,” for example. Ok, you might argue that only consumer-grade AV products were tested, so enterprise organizations are not so exposed against exploit attacks. Mmh… Do not jump to conclusions, as I believe the reality is pretty much different and enterprise organizations are even more exposed for the following reasons: More and more organizations are approaching the BYOD philosophy policy in which users are free to use their own devices. Even worse, too oftenthese are equipped with outdated EPPs (how many organizations enforce NAC policies to check the integrity of the endpoint?). Most of all… If cyber criminals have sophisticated testing processes in place, aimed to test the detection capability of the various products, why should they use them only for consumer products and not (also) for the most appealing enterprise crime market? Yes, definitively I believe endpoint protection technologies, on their own, do not offer adequate protection for exploit prevention, and the time has come for Advanced Threat Detection/Prevention technologies (like :-)). Related Posts Share this: Like this: Like Loading...