Really McAfee??? / Mar 13th

As noted many times previously, it is ESPO's recommendation that you call the sales rep of your "premium AV" company and demand a price reduction.  Today's Dridex Attack will enable us to dig a little deeper into McAfee to determine if their Mergers & Acquisition (M&A) strategy over the last decade was intended to improve their client's security posture or the executive's personal income statement.  The evidence:

1. Spam Bots in APAC have started a new malware campaign.  Per the 2 screen shots directly below, Websense is blocking the email msgs/attachments while McAfee's Reputation System, TrustedSource, thinks the sender is fine:

2. Per this link to our Websense File Sandbox Report, the M$ Word attachment to the aforementioned malware campaign is dropping executables, attempting to inject itself into explorer and modifying Registry Settings.  Seems malicous doesn't it?  Not according to McAfee or any other AV Company currently:

3. Per the final 2 screen shots directly below, the dropper attempts to pull bin.exe via HTTP from a site in the Czech Republic.  Websense not only had the site classified as malicious but the Real-Time Analytics of ACE would have detected/blocked the download while TrustedSource again thinks the site is just fine.

In summary, McAfee failed to stop the initial email connection, failed to detect the malicious macro in the Word attachment, and finally, failed to detect the phone home.  Final Verdict - McAfee Executives made serious money with the acquisition by Intel while your security posture has declined.  Time to call Websense???   :-)