Cum Ar Reactiona Bitdefender Internet Security V10

Salut Claudiu,

BitDefender Firewall nu are (cel putin deocamdata) protectie la Code Injection. Sugestia a mai fost facuta in trecut, insa nu a fost implementata. Nu pot sa-ti spun daca exista asa ceva in plan, dar daca ar fi, pana la urmatoarea versiune (BitDefender 2009) oricum nu va aparea.

In principiu, ar putea totusi reactiona motorul euristic (B-HAVE), si sa blocheze fisierul ca fiind suspect. Dar aici sunt foarte multe variabile si, din pacate, nu prea pot sa-ti dau detalii. Poate un Virus Analyst (care stie mai bine cum functioneaza B-HAVE) ar putea sa-ti dea mai multe detalii.

Cris.

Buna Cris,

Multumesc pentru raspuns; uite o situatie concreta: AdobeAcrobat 5.1 are in Help "Adobe Acrobat Online";daca click pe acest buton, AdobeAcrobat 5.1 va deschide IE si va merge pe propriul site, fara nici o reactie de la Firewall sau din alta parte.

Claudiu

Eu personal nu-ti recomand ca firewall modulul din BD,mi se pare extrem de slab(cand faceam server pentru un joc online se umplea calculatoru de wormi pe care ii detecta saracu').Foloseste un firewall 3d party cu un control bun al activitatii din calculator ,cu un modul antileak bun,o sugestie ar fi Comodo 3 vesiunile mai jos de 3.0.15(ca sa poti folosi Defence+).BD 10/2008+Comodo Memory Firewall(antibuffer overflow)+Comodo Firewall 3.0.14 sunt o combinatie excelenta, aproape impenetrabila daca ai si un router "in fata".BD isi face f. bine traba ca antivirus.

Un firewall ce se descurca bine si in leaktests :Click

E interesant si Online Armor dar in versiunea free nu prea poti seta nimic.

Cat despre teste antileak putine reusesc sa treaca de antivirus.Oricum un malware real necunoscut face varza orice sistem.Outpost 2008 e pe primul loc si are grave probleme la filtarea traficului de internet (scopul pt care un firewall a fost inventat)am prieteni care trec prin Outpost 2008 ca prin paine.Cat despre Online armor e posibil sa foloseasca "cheaturi" pentru a trece de teste.

Singurul firewall care reuseste sa detecteze keylogeri finuti si necunoscuti e Comodo 3 versiunile 3.0.14/3.0.15.

Site-ul pe care l-ai pus in link e un site pro NOD 32,antivirus pe care-l urasc din toata inima pentru ca e fake.

BD nu a zis nimic in situatia descrisa de tine deoarece vedea aplicatia ca fiind legitima. In mod normal, in aceeasi situatie descrisa de tine, daca in spate se afla o aplicatie nerecunoscuta, cel mai probabil ai fi atentionat.

Cat despre scannerul B-HAVE, analizatorul euristic verifica cum se comporta un fisier intr-un calucator virtual. In functie de comportament, trage semnalul de alarma.

Cheers!

Am folosit si eu in trecut Outpost,Comodo,Jetico, ZoneAlarm si foarte putin OA.

Am incetat sa folosesc Outpost datorita nenumaratelor BSOD. Comodo e un firewall bun dar destul de limitat, cei drept nu am incercar Comodo v.3. Un singur firewall m-a determinat sa-l folosesc mai mult timp si anume ZoneAlarm dar asta pana sa apara problemele cu start up delay si vsmon crash (v6.5 daca nu ma insel).

Sincer nu prea ma omor dupa un firewall ce trece toate leaktest-urile si nu face ceea ce ar trebui sa faca un firewall: inbound si outbound protection, SPI dar din pacate putine fac asta si un bun control al aplicatiilor. In plus ar trebui sa fie flexibil, sa poata fi configurat cat mai usor (port, protocol, trusted zone, baned zone etc.)

Despre Jetico click, citesc destul de des ceea ce posteaza acest user, pe care-l respect pentru ca nu vorbeste pentru a se afla in treaba .

Am folosit Jetico v.1 dar foarte putin si nu mi-a placut pt ca nu avea "boot up protection" si avea un GUI destul de ciudat.

Eu prefer un firewall fara HIPS, pentru leaktest poti folosi SSM sau PrevX.

In prezent folosesc BDTS si nu am avut probleme, cei drept sunt in spatele unui NAT.

We have revealed that Online Armor passed some of leak-tests only because of user mode hooks that were not unhooked by FPR. In the most of cases, FPR would identify and remove the hooks but in case of Online Armor, FPR faced a code that protected these hooks against unhooking in very unusual way. Although the vendor of Online Armor assured us that the protection was not implemented with an intention to pass FPR tests, the protection has no real effect on the security of Online Armor and can be bypassed easily. We have removed the latests results of Online Armor from our tables and we will modify FPR such that it will be able to bypass the protection of user mode hooks of Online Armor. We will retest Online Armor and publish its real leak-testing results as soon as possible. We apologize to all our visitors and to all competitive vendors for publishing incorrect results of Online Armor."

Ceva asemanator despre Outpost: "On 28th November 2006, we have published a new leak-testing tool called Fake Protection Revealer (FPR). We have tested several personal firewalls including Outpost Firewall PRO 4.0 with this tool. These tests were made as a part of firewall leak-testing. FPR proved that some security features in Outpost Firewall PRO 4.0 were implemented using user mode (ring3) hooks. These hooks were used improperly and FPR was able to bypass them easily. We have discussed this issue with Agnitum representatives and tried to explain them that there is no way how to implement ring3 hooks properly and safely for this purpose.

As a result, a new version Outpost Firewall PRO 4.0 was released on 11th January 2007. As you can read in its history of changes, Outpost Firewall PRO 4.0 (1005.590.123) and later implement a new feature called Fake Protection Revealer leaktest interception. The reality is that the new versions are no more secure than previous versions, they just intercept FPR test such that it is not able to bypass the protection. However, user mode hooks are still used improperly and it is still possible to unhook them and/or bypass them. This also means that the new feature was implemented only to pass the test, only to cheat on end-users, only to show them that Outpost passes all leak-tests. This is a bad and dangerous approach. Let's have a look on some technical details of user mode hooking. "

O sa incerc si Jetico, sper ca au mai lucrat la GUI

Catalin