I know that recently I’ve been spending a lot of time talking about Windows antivirus. Often, I am quite disappointed at the effectiveness of most antivirus tools. Many security researchers, and my own research on the subject, estimate antivirus to be effective less than half of the time. That said, I still believe that antivirus deserves a place on all systems and I wanted to take a moment to describe the way that I implement antivirus on many of the Windows machines in my life.

Let me start by saying first, that I have very few Windows machines left in my life. Most of those machines that I still use on a day-to-day basis are virtual machines used for very specific research and testing purposes. I use a pretty basic approach for antivirus on these systems, as they are not usually exposed to general use, uncontrolled traffic or un-trusted networks.

However, there are still a few holdout machines that I either use or support for friends and family. On these devices, most of which are Windows, I have begun to use a new approach for antivirus implementation. Thus far, I have been impressed by the solution and the effectiveness of keeping the machines relatively virus free and operating smoothly. So, how do I do it? Well, for starters, I use two different antivirus products. First, I install Clam AV for Windows and configure it for real-time protection. Clam is free software and so far I have been very impressed with its performance. One of the nicest things about the clam solution is that it has a fairly light system footprint and doesn’t seem to bog down the system even while it performs real-time protection. Next, I install the Comodo firewall and antivirus solution. This solution is pretty nice. It includes, not only antivirus, but also a pretty effective and useful firewall. This software is also free for noncommercial use. On the Comodo antivirus, I remove real-time protection and instead, schedule a full antivirus scan every night while my family member is sleeping.

By combining two different antivirus products, one in real time and the other for periodic ongoing scanning, I seem to have been able to reduce my service call infection rates by about 50%. From an attacker standpoint, a piece of malware would need to be able to evade both products in order to maintain a presence on the system longer than 24 hours. While such an attack is surely plausible, it simply is not the threat pattern that my family’s home personal use machines face. By combining two different products and leveraging each of them in a slightly different way, I have been able to increase the effective defense for my users.

As always, your mileage and paranoia may vary. Certainly, I am not endorsing either of these products. You should choose whatever antivirus products you feel most comfortable with. I simply used these examples as free solutions in a way to illustrate this approach. Thanks for reading, and be careful out there.

The ubiquitous PDF, it just seems to be everywhere. With all of the recent hype surrounding a variety of exploits that have come to light in the last couple of weeks, many of our customers are asking about how to defend against malicious PDF documents. This is both a simple and a complex question.

The simple answer, and of course the least realistic, is to disallow PDFs altogether. However, as you might already suspect, this is nearly impossible in any modern enterprise. A couple of recent polls in customer enterprises showed that even when staff members said they didn’t use PDFs for anything in their day-to-day work, nearly all of them realized suddenly that PDFs were an important part of some process once PDF documents started to get blocked at the perimeter. Not one single organization that is a client has reported success at blocking PDF documents as a blanket solution.

So, if we can’t block something that may be dangerous, then we are back to that age old game of defense in depth. We’re going to need more than one single control to protect our organization against this attack vector. Sure, almost everyone has antivirus on their workstations and other systems, however, in this case, most antivirus applications show little progress in detecting many malicious PDF attack vectors. But, the good news is, that antivirus is as effective as usual at detecting the second stage of a malicious PDF attack, which usually involves the installation of malware. Some organizations have also started to deploy PDF specific heuristic-based solutions in their email scanners, web content scanners, firewalls and IDS/IPS systems. While these technical controls each have varying levels of strengths and weaknesses, when meshed together they do a pretty good job of giving you some detective and maybe preventative capability for specific known attack vectors using PDFs.

Obviously, you want to back up these technical controls with some additional human training, education and awareness. You want users to understand that a PDF can be as dangerous, if not more so, than many other common attachments. Many of the users we have talked to in the last few weeks have been surprised by the fact that PDFs could execute remote code or be harmful. It seems that many users trust PDF documents a lot more than they should. Given how many of the new PDF exploits work, it is a good idea to make your users aware they they should pay careful attention to any pop-up messages in the PDF reader and that if they are unsure about a message they should seek assistance before accepting or hitting OK/Continue.

Lastly, PDF attacks like the current ones in circulation, continue to show the importance of many of the projects in our 80/20 Rule of Information Security. By leveraging projects such as anomaly detection and enclave computing, organizations can not only reduce the damage that a successful client side attack can do, but they can give themselves a leg up on identifying them, blocking their sources and quarantining their victims. If you would like to discuss some of these approaches, please drop me a line or give us a call.

What approaches to PDF security has your organization found to be effective? If you have a winning strategy or tactic, leave us a comment below. As always, thanks for reading and be careful out there.

That’s right! No longer do you have to spend days and nights worrying about the state of your network. No more fretting about your partners, security or other traditional concerns.

Today is the dawn of a new day for network engineers around the globe!

Want to know how your network is? ASK YOUR PACKETS!!!!!

MicroSolved’s revolutionary new product, code named, NED or Network Emotion Detector, will continually update you on the emotional health of your packets. If there’s a network problem, a security breach or if you happen to fall out of compliance with the Pennsylvania Concrete Institute’s (PCI) standards, your NED will immediately alert your team to the lack of happiness being experienced by your packets as they traverse the various public and private networks!

Even more powerful than the executive dashboard, the GUI can be operated near the data center hallway window, so passing executives can quickly identify the happiness quotient (TM) of your network. When they see NED smiling, they will know you are doing your job well. When NED is unhappy and your packets begin to show signs of sadness, they can quickly and easily purchase additional “emotional credits” through the handy interface. These emotional credits (ie: money) make your packets happy and joyous as they traverse the Intertubes.

If that were all NED did, it would still be the most powerful network emotional monitoring tool on the market, but we even take it one step further! Using NED’s soon to be copylefted capabilities, we create emotional tunnels for your packets to move back and forth with your peers. These “Virtual Private Hugs” (VPH) allow you and your business partners to mutually enjoy all the power of NED and emotional credits together. You can easily monitor the happiness of your partner’s packets and those that show emotional disparity, making VPH even more important for those folks. Lastly, NED features a peer-to-peer network monitoring mechanism that allows you to closely monitor the overall happiness level around the Cloud. That’s right, MSI is the first in the world to create Happiness as a Service (HaaS)(TM)!

Act now and you can get your own copy of NED for Windows FREE for a limited time. Download from here and start enjoying the ease and joy of NED from MSI. We hope you enjoy NED, “because packets need love too…”

Happy April Fools Day from your security partners at MicroSolved, Inc. We hope it made you smile. BTW – The download really runs. Windows only, for now…. :p

Thanks to the folks who joined us for this afternoon’s PHP security talk about modern RFI attacks, how they work and what attackers are up to. If you are interested in the new slide deck, you can find them here: http://bit.ly/bT2TF7

If you would like to attend a virtual presentation or book one of our engineers to give the talk for your development team (either virtually or face to face), drop me a line and let me know. The talk is very strong and lends itself well to understanding how PHP RFI has become one of the most common attack vectors in use to spread malware, bots and other illicit activity.

In the last few days, the folks that make sub7, a pretty common and well known Windows back door/remote access tool, released a new version. You can find more about the capabilities of this application here.

Since I have been doing a bit of research lately that has included anti-virus and their often abysmal detection rates, I decided to test this new version of Sub7 against the VirusTotal scanning base. You can find the results here.

As you can see, the detection rates for this “remote access tool” is just under 55%. This time, all three of the major enterprise vendor products catch the malware nature, but the most common free tool, AVG, misses it entirely. As such, organizations are likely protected, but a vast many home user and consumer machines will be unable to detect the install of this very common attacker tool.

As with many of the posts about this in the past, I simply point this out to folks to help them come to an understanding of the true levels of protection that AV offers. Many people see it as a panacea, but clearly, it is not. AV is a needed part of defense in depth, but additional controls and security tools are required to create effective detection for malware infections.

I just posted this on Twitter:

The #HITME caught 1,684 new unique probes last week. That’s about 10 unique probes per hour or one unique probe every 6 minutes on avg.

Interesting idea that some sort of entropy in attacker signatures happens that often on average. Every 6 minutes some nuance of an attack pattern changes and we see it in the HITME data. Sure, some of these are encoding changes, slight modifications, but some are new scanning targets, new payloads and entirely new strains of attack and probe activity.

With attack patterns changing so rapidly, are you really sure your heuristics-based tools and approaches are able to keep up? Remember, too, this is just server/application viewpoint data. It has nothing to do with the threat entropy that a client application like a browser encounters. Those metrics, in my opinion, are likely to be exponentially higher if we could ever find a way to measure them in a meaningful way.

I just completed the slides for my new presentation on application security. It is focused on understanding Remote File Include attacks against PHP implementations.