DennisLabs Test results corroborated by AV-Test.org & Av-Comparatives

If you follow reviews of Internet Security products, you have no doubt heard about the backlash following the recent Dennis Labs test. Dennis Labs, an up and coming testing housing in the UK did a real-world test of internet security products which Symantec sponsored and they found Norton Internet Security 2010 to detect 100% of all attacks they threw at it. Needless to say, the community was outraged, claiming that Symantec influenced the test by paying for it, and that Dennis Labs was not skilled enough to do such a test. This was despite the fact that Simon Edwards has long been recognized by industry insiders as an accomplished security expert. See his blog here http://simonedwards.blogspot.com/2009/10/inside-dennis-virus-lab.html. I think its safe to say that the review was summarily dismissed by everyone that either competes with or has a bone to pick with Symantec.

However, as I expected, a few months later, we see an identical test result from two of the premier test houses in the world: AV-Test.org and AV-Comparatives.

http://av-comparatives.org/images/stories/test/dyn/dynamic2009.pdf

http://blogs.pcmag.com/securitywatch/2009/12/av-testorg_releases_real-world.php

Norton won both those tests!!

That should serve as a good kick in the nads for all the Norton naysayers and especially is a slap in the face for Avast whose CEO posted this blog http://blog.avast.com/2009/10/30/dennis-technology-labs-vs-vince-technology-labs-can-testing-paid-for-by-an-av-company-be-trusted/ dismissing the Dennis Labs test on grounds of trivialities like poor website design! Hey Avast, when is your next milestone False Positive - 100 million FPs for 100 million customers.

PrevX cries Wolf, aims its guns at Wolf and then shoots itself in the foot

PrevX recently released a press release blaming Microsoft for a black screen that its customers were seen after an update for Microsoft Windows. The original blog article is here.

http://www.prevx.com/blog/140/Black-Screen-woes-could-affect-millions-on-Windows--Vista-and-XP.html

PrevX here is a tip. Learn from Norton and the other big boys. You never throw shit up in the air without doing your homework. Because if you dont, it going to come right back down and hit you smack in the face. And most of all, you dont mess with a company like Microsoft that probably spends more on quality assurance on a single patch than PrevX spends in 2 years.

I wondered at the time as other did why PrevX customers were the only ones seeing this problem. Did anyone smell a rat. And then PrevX releases a patch that "fixes the problem", not "works around Microsoft's bug". By then, we should have realized that the cat was out of the bag. That PrevX had screwed something up.

And sure enough, a few days later, PrevX recanted and posted this on their blog.

http://www.prevx.com/blog/141/Windows-Black-Screen-Root-Cause.html

PrevX, you may want to grow up so that some day you will at least 10% of great companies like Norton

100% detection for 100 million users

AVAST recently announced (ahem bragged) about how they were about to hit a major milestone - 100 million registered users. Personally I think that is bullcrap because even Norton doesn't claim that many users and they are the market leader by a wide margin. Anyway, I digress.

To commemorate this major milestone (ahem lie), they decide to give all their 100 million customers a little gift. The gift that every Antivirus customer dreams of..

No silly, we are not talking about a 25% discount. We are talking about something far more valuable, the holy grail of antivirus - 100% detection. Detection of all threats, no exceptions, nothing gets through.

The catch ?? just a little extra gift of appreciation - 100% False Positives.

Yes, my friends, AVAST released an update today that was generating false alerts on every executable on your hard-drive including Windows Signed executables. Here is a sample of the alert.



What a bunch of jokers. This false positive has completely trashed millions of computers and flooded security newsgroups with postings from frustrated users trying to fix the mess that Avast created. Ofcourse, none of them can go crying to Avast because they dont have a leg to stand on since they didn't pay for Avast, Avast being a free product. You can see a sampling of the outcry here http://www.dslreports.com/forum/r23428578-False-positive-in-Avast-or-is-it-real

These Free AV outfits seems to have a history of large scale mayhem. Right after their acquisition of LinkScanner, AVG was caught artificially generating tons of internet visits to websites you haven't even visited. That was eventually fixed through a design change in LinkScanner. You can read all about that fiasco here http://www.theregister.co.uk/2008/06/13/avg_scanner_skews_web_traffic_numbers/

Just another reason for why you should stay away from Free AV products.

NAV2010 comes in 2nd on PCWorld's Standalone AV Test

Right off the bat I'd like to say that I disagre with the methodology of this test even though Norton came in 2nd (which is a pretty good place). It is your traditional on-demand retrospective test, which is to say, dump a bunch of malware in a directory and run the on-demand scanner against it. This type of test does not test your URL blocking capabilities (called SafeWeb in Norton), your vulnerability or drive-by download protection (called IPS and Browser Protection) in Norton, and your behavioral capabilities (called SONAR2 in Norton). Also reputation as well (called Quorum in Norton). Ok, so they tested 1 out of 10 features thereby relegating this test to the ever increasing dump heap of shitty tests. But what really irked me about this test was when PC World commented on G-Data's win and I quote "GData.. but using it means having to make more decisions than you do with other apps."

Hello! PC World are you forgetting you are a home user magazine. Home users dont want to make decisions ! They dont know how to make decisions. How in the world did you give GData the crown if they have a product that keeps forcing the user to make a decisions.

Is it just me or are these magazine tests getting worse by the year even though they were useless to begin with.

You can read all about the test here

Immunet - Better than the best ?

I think not.

I did some testing with exes found at malwaredomainlist.com. The results were as expected very dissapointing. Here is a screenshot of the results on an unpatched XP SP2 box. Can you spot the Rogue Antivirus. Lol! Anyway, the screenshot shows that even with 3 fakeAvs running, Immunet doesn't have a clue... not a peep.

Immunet - Parasitic Products

This blog is about a new startup based out of Calgary called Immunet. How is this related to Norton you might ask. Well, a few of the top executives (that shall remain unnamed) are ex-Symantec employees. Hmm.. I am always suspicious when I see a defection from well-known brand to an upstart company that lo and behold happens to be working on something identical. See this thread for names and places http://www.wilderssecurity.com/showthread.php?t=251402

They have also been busy astro-turfing, flooding the internet with good news about their crappy product. See http://www.dslreports.com/forum/r23305665-Anyone-else-using-Immunet-Protect

Their idea is nothing new, signatures in the cloud, correlation across other users, collective intelligence, same ol, same ol. This area has probably been patented to death.

This product is whats called a PARASITIC product. They monitor detections of other products that may be running on the machine, and claim those very same detections as their own. Nasty!!

The implications of this are interesting to say the least.

1. Immunet can never detect anything that is not detected by at least one other product. That is, it doesn't bring anything new to the table. So why would you need it ?

2. Because it in essence siphons of detections from other product, it always runs the risk of not seeing the detections if it can't hook into the events that a product like Norton generates when it detects a threat. In fact, I hope Symantec, McAfee, Kaspersky, AVIRA and others see this posting and lock down their event/alert interfaces so they can't be read by Immunet. Lets get rid of the parasite.

I predict that in about 3 years at most, Immunet will be relegated to the ever increasing pile of failed security-wannabe startups... that is, unless they get bought out by some clueless company like IBM with deep pockets. I have a feeling that Symantec will not be one of contenders for a buyout :-)

There is an interesting blurb at the very bottom of their website site and it reads

" Dont wait for other vendors to re-architect their products when you can use Immunet Protect today. "

Wow, if there is one skill startups have, its FUD. I suspect that comment is targeted at Symantec given the pedigree of the company. However, I am sure that by now the defectors know that Norton has successfully ships their "re-architected" products with Quorum technology to millions of customers. No need to wait, get the best, get Norton.

Something smells funny

After posting the last blog I started thinking about the 100% detection test results by Norton on the Dennis Labs test. While I agree they are unbelievable, they are not impossible specially when you consider that only 40 samples were tested.

But whats impossible is the test results from Av-Comparatives, one of the two premier testing houses in the world. In there most recent test in August 2009, with 1.56 million samples (http://www.av-comparatives.org/images/stories/test/ondret/avc_report23.pdf) , the top two spots were

GData - 99.8% detection
Avira - 99.4% detection

Seriously, 99.8% detection on such a large sample set. Thats what I call Impossible. Something smells funny. Specially considering that every day there are 30,000 new pieces of malware how in the world is GData and Avira able to detect such a high percentage.

I think this whole arrangement between AV-Test, Av-Comparatives and these AV Companies needs to be investigated. I for one do not trust them.