Proud PINOY does not claims any credit for any articles, news and/or photos posted here. All visual content is copyright to its respectful owners. All info's are not accurate and may contains errors. If you are the owner to any photos or articles, and does not want us to post it here, please contact us by e-mail

Sunday, September 9, 2012

Microsoft, 8 other AV vendors flunk lab exploit tests

Less than one in three —actually, a dismal four of 13— leading antivirus products managed to fend off attacks that exploit recently-discovered Microsoft vulnerabilities, a testing company disclosed.
NSS Labs Inc. said nine of 13 popular consumer antivirus products, including Microsoft, failed to provide enough protection against attacks, including those delivered over HTTP and Secure HTTP (HTTPS).
“These results clearly demonstrate protection deficiencies for many vendors when their products are configured with default 'out-of-the-box' settings, which are what’s most commonly employed in the consumer market,” said Randy Abrams, Research Director at NSS Labs.
NSS Labs said its tests found only four vendors – Avast, Kaspersky, McAfee and Trend Micro – successfully blocked attacks delivered over both HTTP and HTTPS.
Abrams said this particular exploit test was a small part of a much more comprehensive endpoint security test. He said the results will be published next month.
Bob Walder, chief research officer at NSS Labs, noted this test showed many vendors that protected against an exploit over HTTP failed to protect against the same exploit delivered via HTTPS.
"Vendors who did not perform well might want to reconsider their default settings in this age of attacks against SSL and other protocols,” he said.
Vendors tested
NSS said the 13 vendors it tested included:
  • Avast Internet Security 7
  • AVG Internet Security 2012
  • Avira Internet Security 2012
  • CA Total Defense Internet Security Suite
  • ESET Smart Security 5
  • F-Secure Internet Security 2012
  • Kaspersky Internet Security
  • McAfee Internet Security 2012
  • Microsoft Security Essentials
  • Norman Security Suite Pro
  • Norton Internet Security 2012
  • Panda Internet Security 2012
  • Trend Micro Titanium + Internet Security
NSS Labs is now running in-depth consumer end point protection (EPP) group testing that will further test all 13 vendors in several key areas.
These include exploits, evasions, performance and protection against live malware, drive-by attacks and phishing.
More concerns
Abrams also cited additional concerns for businesses, particularly for enterprises allowing the "bring your own device" allowing employees to use their own machines in the workplace.
A separate article on PC World said the test checked the 13 antivirus suites' ability to defend unpatched systems against attacks exploiting vulnerabilities in Microsoft's XML Core Services (CVE-2012-1889) and in Internet Explorer 8.0 (CVE-2012-1875), both made public in June.
But PC World also noted the testers also found the antivirus products were good at spotting common evasion techniques such as Base 64, Unicode, and JavaScript.
"Less optimistically, Microsoft and CA's software could be disabled by an attack using 'kill' command," it quoted NSS Labs as saying. — TJD, GMA News


  1. I am new to building sites and I was wondering if having
    your site title related to your content really that
    important? I see your title, "Blogger: ProudPinoy " does appear to be spot on with what your blog
    is about however, I prefer to keep my title less content descriptive and
    based more around site branding. Would you think this is a good idea or bad idea?
    Any kind of assistance would be greatly valued.

    Also visit my blog :: luggage scale

  2. Greetings! I know this is kind of off topic but I was wondering
    if you knew where I could get a captcha plugin for my comment form?
    I'm using the same blog platform as yours and I'm having problems finding one?
    Thanks a lot!

    Stop by my weblog :: sandstorm

  3. Hmm it appears like your site ate my first comment (it was extremely long) so I guess I'll just sum it up what I had written and say, I'm
    thoroughly enjoying your blog. I as well am an aspiring blog writer but
    I'm still new to everything. Do you have any suggestions for beginner blog writers? I'd certainly appreciate

    Also visit my web site - luggage sale