StumbleUpon | Luketan's blog posts

http://Luketan.stumbleupon.com/review/23137834/

Sun, 06 Jul 2008 02:07:24 -0700

This stumbleupon blog is discontinued.

The new blog will be at http://freewaresecurity.blogspot.com/

http://Luketan.stumbleupon.com/review/21719722/

Sat, 24 May 2008 04:08:28 -0700

Matousec firewall testing news.

"We have tested the latest versions of Comodo Firewall Pro and Online Armor Personal Firewall Free. These products had a perfect score after the last testing. We have implemented several new tests to differentiate between them. CFP passed almost all the new tests while OA had problems with keyloggers. Oddly, the new version of CFP did not pass some of the tests that its older version passed, but CFP's results are still excellent and enough for the first place in our challenge.

We have also tested some new products. These are, sorted by their final score: Lavasoft Personal Firewall, Webroot Desktop Firewall, Trend Micro Internet Security 2008, F-Secure Internet Security 2008 and Panda Internet Security 2008. Visit Firewall Challenge for the complete results.

"

Do note that they have started testing keyloggers, and they test the free verson of Online armor, which provides only minimal anti-keylogging functions, hence the fall in the online armor free results.

As expected the ultra-paranoid (expect lots of popups) Comodo firewall with Defense+ does the best , followed by the equally paranoid ProSecurity (HIPS more than firewall).

Also the complexity of these products (needed to pass such tests) has resulted in many bugs , as noted many of them (OA and comodo pro firewall 3) fail tests that they used to pass.�

http://Luketan.stumbleupon.com/review/21670767/

Fri, 23 May 2008 08:11:19 -0700

Comodo firewall 3 updates again to 3.0.23.364

"I would like to announce the availability of COMODO Firewall Pro 3.0.23.364. Previous versions should be able to update themselves through automatic updates.

Download locations:
----------------------------

32-bit Setup(Available in English language only)
http://download.comodo.com/cfp/downl..._Vista_x32.exe
Size: 18.0 MB (18,932,992 bytes)
MD5: 1413477dd271f5992c8546b0495e36e4
SHA1: 95993ab27b62a9eb7f74004e8f6a3ae128578332

64-bit Setup (Available in English language only)
http://download.comodo.com/cfp/downl..._Vista_x64.exe
Size: 28.2 MB (29,597,440 bytes)
MD5: ddf3fe70c9f0f172fbdbd5ab44297295
SHA1: 3de3ca51348ca3ec8614aa17a3785b49e8c658e7

Whats New in 3.0.23.364?
--------------------------------------
NEW! COMODO SafeSurf Toolbar built on COMODO Memory Firewall technology
FIXED! COMODO Firewall does not add files from network shares to pending list
FIXED! COMODO Firewall does not log incoming ICMP packets properly
FIXED! COMODO Firewall blocks everything when password protection is OFF and suppress options are ON
FIXED! COMODO Firewall does not terminate active connections properly
FIXED! COMODO Firewall firewall driver can not be installed properly in Vista operating systems
FIXED! COMODO Firewall can be terminated when Windows XP is being shutdown
FIXED! COMODO Firewall GUI does not appear properly on Windows Vista operating systems
FIXED! COMODO Firewall GUI can truncate texts in 120 DPI
FIXED! COMODO Firewall does not handle long filename properly
FIXED! COMODO Firewall does not update the version correctly after being updated
FIXED! COMODO Firewall crashes on exit
FIXED! COMODO Firewall can cause BSODs when gameprotect rootkit triggers its self defense
FIXED! COMODO Firewall can not verify digital signatures
FIXED! Small problems in GUI
IMPROVED! Clean PC Mode and Safe Mode: Improvements that lead to small number of alerts and pending files
IMPROVED! Default Security policy so that Windows Updates do not lead to significant alerts"

Possibly most alarming is the inclusion of a "Comodo SafeSurf Browser Toolbar" only available with a new complete install (users who upgrade from comodo firewall 3 already installed don't get this)

"The Comodo SafeSurf Toolbar protects against data theft, computer crashes and system damage by preventing most types of Buffer Overflow attacks. This type of attack occurs when a malicious program or script deliberately sends more data to a target applications memory buffer than the buffer can handle - which can be exploited to create a back door to the system though which a hacker can gain access. Comodo developed the SafeSurf Toolbar explicitly to protect end-users from these kinds of attacks whilst they browse the Internet. After installation, the program will monitor and protect the memory space of all applications that are running on your system and immediately block any buffer overflow attacks. Apart from providing another essential layer of protection, the toolbar also provides one-click access to news, search, shopping; a built in pop-up blocker; is compatible with all major browsers and can be separately uninstalled or disabled at any time after installation."

Most security savy users are obviously wary of toolbars so this caused a big fuss until it was clarified that you can still to opt out during installation.

Personally I think this toolbar which seems to be built on similar technology as the almost equally new
Comodo Memory Firewall , might be pretty useful since there are few free products that provide buffer overflow protection.

http://Luketan.stumbleupon.com/review/21668845/

Fri, 23 May 2008 07:39:18 -0700

Several new security software updates

1) SUPERAntiSpyware 4.1 Final was released - This top notch on demand free antispyware adds the following

"The changes are:

Interface and Functionality Changes

* Vista UAC Issues Resolved - You should not be prompted by UAC on Admin or Limited user account under Vista. You cannot install program updates on a Limited Account as this breaks the Admin/Limited paradigm.
* Windows "No Disk" issues resolved - this a Windows error due to it's caching of disk volumes - this no longer should show up for empty CD/DVD driver, flash drives, etc.
* Splash screen can be turned off in Free Edition

Technology Changes

* Resolved rare issues with DDA (Direct Disk Access) and improved compatibility with various NTFS formats
* Resolved rare crash issues with improperly written drivers (mainly spyware) that caused Kernel Direct to fault
* Enhanced detection of rootkits
* Firefox cookie scanning and removal"

2)Artificial Dynamics SafeSpace - a very promising and full featured sandbox is updated to 2.0.41.

"New features

* New engine including virtual services capabilities.

Bug Fixes

* Virtual executables no longer crash if they are run from a folder that only exists virtually
* Fixed a bug in registry merging which caused a CPU intensive loop
* Internet Explorer default search options are now honored in SafeSpace
* Secured 'Disable SafeSpace' function to ensure processes cannot respawn
* Vista Parental Controls are now supported
* Firefox now launches in SafeSpace when hyperlinks are clicked in Microsoft Office documents and Outlook emails.
* Fixed an environment block bug which caused OperaTor and XeroBank browsers to crash
* Improved support for Removable Media folder exclusions
* Improved support for tagged internet files on Vista"

http://Luketan.stumbleupon.com/review/21429995/

Sun, 18 May 2008 04:00:05 -0700

Not many new updates this week.

Mostly updates to sysinternal tools like

1) AutoRuns for Windows v9.21

2)Sysinternals Suite

http://Luketan.stumbleupon.com/review/21096374/

Sun, 11 May 2008 00:31:43 -0700

[App Update] Malwarebytes' Anti-Malware 1.12 Released

"Malwarebytes' Anti-Malware is a full-blown anti-malware program that has recently left our labs and can be considered the next step in the detection and removal of malware. We put together a host of new technologies that were especially designed to quickly detect, deter and destroy any malware that could reside in your computer.

Version 1.12 (May 5th, 2008)

1. (FIXED) Improved detection of new malware.
2. (FIXED) Minor changes to help file.
3. (FIXED) Dramatically improved Protection Module loading speed.
4. (FIXED) Minor improvements to scanning speed.
5. (FIXED) Moved drivers to proper locations.
6. (ADDED) Support for Danish language.
7. (ADDED) Registry permission fixing code."

Malwarebytes' Anti-Malware and Superantispyware are two of the leading cutting edge antispyware products right now. They (in particular Superantispyware which has being around longer) have being gaining a reputation among techs as being top-notch in removal of tough to kill malware strains.

They incorporate advanced "direct disk access" methods that enable them to bypass rootkit protected spyware. Like most products in their class, the free version offers on-demand scans and removal only. There is no real-time protection.

Of course, most of the masses are still not clued in yet, and still rely on Spybot - Search & Destroy and Ad-Aware for their malware removing.. Unfortunately these two well-known products have not kept up with the latest technological changes and are slowly becoming useless.

http://Luketan.stumbleupon.com/review/21095614/

Sun, 11 May 2008 00:04:24 -0700

Further updates from Matoseuc firewall challenge project probably the most comprehensive publicly available test of HIPS/firewalls.

"Latest news

* 2008-05-06: Three new tests have been added to Firewall Challenge. Two performance tests, PerfTCP and PerfUDP, have been added to Level 1. A spying test called SockSnif has been added to Level 8.

* 2008-05-02: We have joined Tall Emu's affiliate program and so you can now buy commercial versions of Online Armor Personal Firewall through our pages and thus support this project.

* 2008-04-25: Results for these products and versions were published:
o Avira Premium Security Suite 8.1.00.206
o BitDefender Internet Security 2008 11.0.16
o BullGuard Internet Security 8.0.0.13
o Filseclab Personal Firewall 3.0.0.8686
o McAfee Internet Security Suite 2008 9.1.108
o Steganos Internet Security 2008 7.5.509

All these products scored very badly. Filseclab Personal Firewall is a very old product and so its protection against today's malware techniques is naturally insufficient. Other products tested today are anti-virus solutions with very weak personal firewall components.
* 2008-04-24: Eight new tests have been added to Firewall Challenge, these are Keylog1, Keylog2, Keylog3, Keylog4, Keylog5, Keylog6, Keylog7 and ShadowHook. We have 70 tests in the system now, new products and new versions of already tested products are always tested against all the tests in the system on levels that they reach."

http://Luketan.stumbleupon.com/review/20811098/

Sun, 04 May 2008 04:55:41 -0700

Winpatrol updates to V15.0.2008.0

I personally don't use Winpatrol but this is one of the more popular and perhaps well established tools used by users to monitor and stop changes to system states (autostarts etc).

This new version adds the ability to monitor ActiveX components.

Though there are far more sophisticated, powerful and customizable HIPS that do what Winpatrol does and more, Winpatrol remains popular among users who don't like to get their hands dirty.

http://Luketan.stumbleupon.com/review/20810800/

Sun, 04 May 2008 04:38:37 -0700

Threatfire updates to 3.5

Most of the additional new features like worldwide detection map and to some extent system activity monitor is just fluff. But a major change is the inclusion of an on-demand AV in the free edition.

This is not a full-fledged antivirus solution (see this ), you can only use it on demand, and it will be used automatically together with the behavior blocker as well when needed.

The configuration options have improved so you can for example just TF to automatically quarantine known malware (known by the AV?) , and power users using custom rules can now terminate processes as an option.

What's new in this release

* Worldwide Detection Map
The Security Status area on the main interface now includes a tabbed section displaying new Worldwide Detection and Protection Statistics. The new Worldwide Detection map shows lists of recent malware and adware detected within the ThreatFire User Community. Clicking on a threat in these lists will display red dots on the map to display the threat's recent geographical distribution (see screenshot below).

* On-demand antivirus scanner now available in ThreatFire free edition
An on-demand antivirus scanner is now available in both ThreatFire Free as well as ThreatFire Pro. The main differences now between the Free and Pro versions surround licensing and support options, as well as the configuration options. ThreatFire Pro allows automatic updates even when opted out of Community Protection participation in ThreatFire Pro. See the comparison chart for further details.

* System Activity Monitor
The Advanced Tools area includes a new System Activity Monitor for viewing detailed process information about applications currently running on your computer. This area is particularly useful for advanced users who wish to have a detailed view and useful information on their active processes. Users can also easily kill a process or retrieve further information simply by right-clicking on a process in this window (see screenshot below).

* Default alert handling
A new area that provides default alert handling is located in the Settings area. The default actions allow users to specify certain actions such as automatically and silently quarantining "all known malware", for example. Or, users can choose to "always allow any adware", also known as potentially unwanted applications. This new setting is useful for advanced users who can setup ThreatFire to handle all actions automatically and never bother them with any questions.

* Technical enhancements
Other technical improvements to ThreatFire's technology have been made which include the following:
o Alert dialogs have been slightly reworked and include a new link to get additional technical details.
o Custom Rule alerts now include the additional option "Kill this process." These special alerts also now appear with a blue banner to help further differentiate them from other unknown threats.
o Improved malware detection, including improved MBR infection detection.
o Fewer false positives.
o Other miscellaneous program fixes.

http://Luketan.stumbleupon.com/review/20547948/

Sun, 27 Apr 2008 06:03:03 -0700

Sandboxie , the popular freeware sandbox is updated to 3.26.

This adds a few important security fixes including the much demanded "Sandboxed programs cannot change the system date/time.".

"Version 3.26

Released on 27 April 2008.

These are the changes to Sandboxie since version 3.24.

This version is primarily a bug-fix release, fixing major and minor problems, including some security problems.

* Network shares are accessible even if not mapped to a drive letter.

* Fewer temporary files are kept in the sandbox.

* Sandboxed programs cannot change the system date/time.

* Translation to Japanese, contributed by v2y

* Translation to Polish, contributed by Barnaba.

* Resolved conflicts with third-party software Avira Anti-Virus. "