ssta

PART 2

The goal here was to test the product’s protection against real malware that users are likely to encounter.

KAV 6.0 is classified as an antivirus product but testing it only with viruses is an out-of-date and obsolete approach. The malware circulating today cuts across the old classifications of viruses, trojans, adware and spyware and typically includes features of multiple malware products in a single bundle.

To meet this threat, modern security products need to provide broad spectrum protection against all kinds of malware regardless of whether the security product is itself classified as an anti-virus, anti-trojan or anti-spyware product. Since all these security products employ some form of signature based detection this approach can be employed effectively against virtually all malware products.

Given this fact we have rejected the idea of testing KAV against a standard set on "in-the-wild" most prevalent viruses. Instead we've used an broad set of malware that included old and recent versions of viruses, worms, trojans, backdoors, rootkits, R.A.Ts, keyloggers, spywares, adwares etc.
Also included were commercial spy and keylogging programs.

And to further replicate the real life situation, some of these samples were disguised as codecs, text files, pgp keys, images, self-extracting archives or screensavers Additionally some test were performed live via Instant Messaging (Yahoo, MSN) or by email.

This way, we take the side of a real life approach by covering many scenari.
This includes various aspects of computer's spying, and especially cases which require a physical access to the machine (keyloggers for instance).


Most antivirus editors provides an annual report about the most importants threats (malwares mostly).
We can mention:


-Microsoft Security Intelligence Report (1 and 2)

-Kaspersky

And here an excellent technical study of the keylogger threat.

-McAfee Virtual Criminology Report 2007 (direct download here)

-WebsenseSecurityLabs 2006 (pdf here)

-Symantec Threat report


For those who wish to be regularly aware about the recent threats, but with illustrations:

-McAfee Avert Labs (excellent),

-Sunbelt blog,



In most case, the malwares used as test files are named by using:

-Kaspersky lab classification,

-other antivirus classification (when not detected by Kaspersky antivirus),

-their original name,

-a "fake name" : in this case, they're renamed (R) for ethical or other reasons (some files are provided by people who do not wish to see these malwares catched by antivirus).

For more details and descriptions about the malwares test files, we highly suggest to use an online search tools which queries several antivirus editors database at the same time:

-Online Security Malware Research Tool

SPYING: not sufficient


The pros:

-good detection of usual keylogger behaviour (keyboard hooks),

-excellent prevention feature (invader alerts, often in relation with dll injection),

-one of the most reliable keylogger database (with Fortinet, BitDefender, Sunbelt and F-Secure)


The cons:

-Does not cover a large panel of keylogger behaviours,

-ineffective against stealth keyloggers,

-no task with trusted programs, that make the job of ill-intentioned person more easy (in public computer for instance).


And we have been very nice, not vicious at all.
We have not included tests about:

-hardware keyloggers (example here or here),

-jitter bugs (general info in this PCWorld article and more technical in this usenix article),

-sound of keyboard,

-Tempest,

-RFID ( few info here and here for privacy invasion)

-Smart Dust (nanotechnology): this technology and its privacy issue implications is not new (sites and articles warned about that since years).
For those interested in this subject, we can recommend this article and these two PDF papers ( summarize here).
More technology, more possibilities of spying: the combat for privacy rights is eternal (Eff, Protia and many more).



It's technically impossible for a security software to cover all possibility of Spying: the key here again is not a product (antivirus, anti-keylogger, HIPS), but more a security approach: white list (biometric authentication, applications, protocols etc) and encrypted communications (Tor, free or paid SSL VPN, or recent technology) should be enough to mitigate the risk of spying.

The next generation of computer will include touch smart screen for instance, virtual devices (here another example), or "the finger as a mouse" (here and here)...

But we hope that future generations of computers will include self defense against spy.

Ladies and gentlemen, after Bruce Lee, the son of Bruce Lee, the cow of Bruce lee, here's come the computer of Bruce Lee!