Wednesday, July 22, 2015

Magic Quadrant for AV?

No disrespect to the team at Gartner, they are top notch people, but, is there really any value in creating a Magic Quadrant for AntiVirus?  The folks at Intel/McAfee were certainly proud of their 7th consecutive year of placement in it, as seen here... even though we've demonstrated their poor catch rate many times in past blog posts.  Another example from this morning:

- Emails are traversing the internet this morning with various email subjects that generally refer to international money transfers.  Most importantly, a ~160k M$ Word doc is attached that leverages a malicious macro.  Details regarding the registry modifications and associated phone home can be found in this Websense File Sandbox Report.

-  Importantly, within the report, you will find a link to upload the file to VirusTotal in realtime.  Hopefully we will see Symantec and McAfee update their signatures by end-of-business (West Coast Time of course ;-) and detect the file's malicious intent.  However, as is all too often the case, you are left to rely upon your antispam sigs/reputation scores (which are 100% accurate right?) to stop these email msgs as the AV vendors are mostly blind to it now:

No comments:

Post a Comment