HIPS in V4?

[viruscraft]

"Host-based Intrusion Prevention System — Unauthorized attempts to modify your OS or applications are actively blocked through a combination of advanced behavioral analysis and network filtering that monitor your system processes, files, and registry keys. HIPS protects against modern blended threats that may have bypassed your network perimeter security."

Just noticed this description for ESET Smart Security 4 Business Edition on the official website.

Is that means ESET Smart Security 4 Business Edition contains a HIPS?

[funkydude]

It's in the changelog for normal edition, but I definitely don't see it in normal. Anyone have the business edition to try?

This comes as a real surprise to me, kinda shocked :o

[rolarocka]

Here its mentioned also:
http://www.eset.eu/support/changelog-eset-nod32-antivirus-4

[proactivelover]

this is what they call HIPS
not EAV v4 only in ESS V3 AND V4

[funkydude]

proactivelover, that was there in v3, this "HIPS" is newly advertised in v4, it may be a BE only feature.

[viruscraft]

ESET uses firewall to "monitor your system processes, files, and registry keys"?

If they call Intrusion Prevention as HIPS,that would be a misleading.

[viruscraft]

and here you can see
http://www.eset.eu/support/changelog-eset-nod32-antivirus-4

ESET NOD32 Antivirus 4 has a HIPS as well

I guess HIPS is not the Intrusion Prevention in the firewall?

[funkydude]

Wherever it is, they did a good job of hiding it. Either that or it's been pushed back to a later build.

[viruscraft]

-{ Quote: "Wherever it is, they did a good job of hiding it. Either that or it's been pushed back to a later build." }-

indeed!

the HIPS is not mentioned before even in the RC

[vijayind]

-{ Quote: "
ESET Smart Security 4 Business Edition

Additional Benefits

Supports Complex Compliance Requirements — ESET Smart Security adds critical features, such as external drive access control and scanning, Cisco Network Admission Control (NAC) compatibility, as well as enhanced logging and reporting functions to support your compliance initiatives.

Host-based Intrusion Prevention System — Unauthorized attempts to modify your OS or applications are actively blocked through a combination of advanced behavioral analysis and network filtering that monitor your system processes, files, and registry keys. HIPS protects against modern blended threats that may have bypassed your network perimeter security." }-

http://www.eset.com/smartsecurity/

[viruscraft]

-{ Quote: "http://www.eset.com/smartsecurity/" }-


yes,that's it
anyidea about that?

[funkydude]

Leave me wishing you could buy one license of a BE... Will this be added into the Home Edition at any point ESET?

[ASpace]

As it was already posted , it is available in the Changelog of all versions (not only only Business edition and not only ESS)
http://www.eset.eu/support/changelog-eset-nod32-antivirus-4

-{ Quote: "Wherever it is, they did a good job of hiding it" }-

:thumb:

Nothing was mentioned during the BETA and it is a bit strange for any company to integrate something without BETA test.

Perhaps they call something in the advanced heuristics HIPS ?

[funkydude]

The .com link clearly states it is a BE only feature.

[ASpace]

The .SK and .EU sites say it different

http://www.eset.sk/podpora/changelog-pre-eset-nod32-antivirus-4


ESET - Europe - Slovakia ... :)

Additionally , the current version 314 is the same size for HE and BE.

[NOD32 user]

-{ Quote: "and here you can see
http://www.eset.eu/support/changelog-eset-nod32-antivirus-4

ESET NOD32 Antivirus 4 has a HIPS as well

I guess HIPS is not the Intrusion Prevention in the firewall?" }-If you have ESS BE 4.0.314.0 or better installed, what happens if you try and delete the ESET folder in Program Files even when logged in with full Administrator permissions? Probably works for ESS/EAV etc. as well but I've only tested it with the one so far.

I laughed, it was great!

Cheers :)

[Don johnson]

After I install EAV business edition,I can't find hips module,indeed.

[NOD32 user]

-{ Quote: "As it was already posted , it is available in the Changelog of all versions (not only only Business edition and not only ESS)
http://www.eset.eu/support/changelog-eset-nod32-antivirus-4



:thumb:

Nothing was mentioned during the BETA and it is a bit strange for any company to integrate something without BETA test.

Perhaps they call something in the advanced heuristics HIPS ?" }-I think you'll find that it is this:

206812

-{ Quote: "
Enable ESET NOD32 Antivirus self-defense
Provides protection against unauthorized deleting or disabling of ESET Smart Security or its components.

Note
Host Intrusion Prevention System (HIPS) protects your system from malware or any unwanted activity attempting to negatively affect the security of your computer. It utilizes advanced behavioral analysis coupled with the detection capabilities of network filter to monitor running processes, files and registry keys, actively blocking and preventing any such attempts.

" }-

Cheers :)

[rolarocka]

Couldn´t the new SysInspector be considered an on-demand sort of HIPS?
You take a snapshot and after something unusual happens you take another snapshot and compare the two? The changes will then be visible. Of course its not realtime like traditional HIPS.

[Don johnson]

See it.

[funkydude]

The way that note is written it sounds like it is an "always on" thing running in the background :what:

[ASpace]

-{ Quote: "I think you'll find that it is this:

206812



Cheers :)" }-


Hi!

I just re-read this part of the Help file and I disagree with you . The way it is written (it is in the right size of the Antivirus and antispyware protection and covers all the descriptions) doesn't make sense to be the Self-Defense . Additionally , Self-Defense is the ESET product . It clearly states:

-{ Quote: "protects your system from malware or any unwanted activity attempting to negatively affect the security of your computer. It utilizes advanced behavioral analysis coupled with the detection capabilities of network filter to monitor running processes, files and registry keys, actively blocking and preventing any such attempts" }-

This way , if it was the Self-Defense , when I tried to do something to its folder , it should have detected it . Behaviour analysis ? Detection capabilities of network filter ? Monitor running processes ?

IMHO , ESET themselves should clear this statement and say what it is actually . I am sure you'll agree that no matter what it is , the way it is written now in misleading

[ASpace]

And one more thing that must be noted . On the site(s) we have both HIPS and Self-Defense presented as 2 different new things / improvements . They don't promote them as one thing . Check it here:
http://www.eset.eu/support/changelog-eset-nod32-antivirus-4

[NOD32 user]

-{ Quote: "And one more thing that must be noted . On the site(s) we have both HIPS and Self-Defense presented as 2 different new things / improvements . They don't promote them as one thing . Check it here:
http://www.eset.eu/support/changelog-eset-nod32-antivirus-4" }-Good point.

Cheers :)

[viruscraft]

Is there any ESET guys can clear this?

waiting for their reply

[funkydude]

Yes I didn't agree either that it had anything to do with Self-Defense, and yes, this needs cleared up by ESET. :)

[funkydude]

Back to the top.

[ESS3]

in the next version of 4.0.XXXX , wakes HIPS ?!!!!!!!:)

[nodyforever]

-{ Quote: "in the next version of 4.0.XXXX , wakes HIPS ?!!!!!!!:)" }-



Probablity...... next version implanted HIPS - suspicius feature ::) ;D

[Triple Helix]

Change log as of March 2nd 2009.

http://www.eset.com/joomla/index.php?option=com_content&task=view&id=4113&Itemid=5

TH

[ESS3]

-{ Quote: "Change log as of March 2nd 2009.

http://www.eset.com/joomla/index.php?option=com_content&task=view&id=4113&Itemid=5

TH" }-
http://www.eset.sk/podpora/changelog-pre-eset-smart-security-4


http://www.eset.eu/support/changelog-eset-smart-security-4

http://smages.com/i/d7/ac/d7acec831c9fc9dee68d03f993e3f86b.png

[Rmuffler]

Hello All,

I have asked Research and Development for a detailed explanation on this. I have also posted in the following thread: http://www.wilderssecurity.com/showthread.php?t=235280.

Thank you,
Richard

[funkydude]

Bump, I get the feeling one of two things will happen.

1. It will be in the next build

2. It will be removed from "help" in the next build and pushed back to v5.

[MasterTB]

One Thing seems to be clear:
"Host-based Intrusion Prevention System — Unauthorized attempts to modify your OS or applications are actively blocked through a combination of advanced behavioral analysis and network filtering that monitor your system processes, files, and registry keys. HIPS protects against modern blended threats that may have bypassed your network perimeter security." ... As it is written on this page: http://www.eset.com/smartsecurity/, and if it even exists, is clearly a function of the BE edition, as you read the files for both Home End user edition and Business Edition, HIPS is described only for the BE, or at least that is what Eset is telling its customers.

[ASpace]

@MasterTB
As with v3.0 , the BE installation file of both EAV and ESS is the same size like HE's . The onliest difference is that in BE one can place a LIC file and allow EAV/ESS start acting like a Mirror server thanks to ESET HTTP server . That is it.

[MasterTB]

-{ Quote: "@MasterTB
As with v3.0 , the BE installation file of both EAV and ESS is the same size like HE's . The onliest difference is that in BE one can place a LIC file and allow EAV/ESS start acting like a Mirror server thanks to ESET HTTP server . That is it." }-

Yes, I know, and you've said it before, that's why I'm so surprised -as is everybody else- to read about the inclusion of some sort of HIPS in ESS, ¡and maybe even limited to the BE edition! but specially more when no one seems to find it :)

[stimulator32]

back to the top ??? >:(

[funkydude]

New build (well old now .417) and HIPS is still in the help files but not in the program, bump.

[ASpace]

They (ESET) won't share any info - obvious and 100% guaranteed!

I am starting to think that it will be something like the Cisco plug-in . It was announced at the beginning (from the very first release) but appeared later . Perhaps ESET will integrate HIPS in future builds - one more reason to be so quiet.

[ESS3]

-{ Quote: "They (ESET) won't share any info - obvious and 100% guaranteed!

I am starting to think that it will be something like the Cisco plug-in . It was announced at the beginning (from the very first release) but appeared later . Perhaps ESET will integrate HIPS in future builds - one more reason to be so quiet." }-
HIPS even claimed in the documentation, section of the file protection. Fully integrated in the antivirus. Like checking e-mail.

Documentation: Home Computers
ESET Smart Security 4 - User Guide (Russian / EN)

In ESS4 many mistakes. Maybe with HIPS have any problems?!

Sorry I use the automatic translator.

[funkydude]

Another build another bump.

[Triple Helix]

-{ Quote: "Another build another bump." }-

Almost feels like they don't even want to address this Question ???

[viruscraft]

obviously,they dont want to answer this question.

[funkydude]

-{ Quote: "obviously,they dont want to answer this question." }-

I'm not denying that, but obviously, I'm not going to let it die ;)

[theseus47]

-{ Quote: "Almost feels like they don't even want to address this Question ???" }-

I laughed at the word "almost" :p

Still, silence is just as telling...especially with regards to customer perception.

[Rmuffler]

Hello,

Thank you for your questions and interests in this. I have collected all posts and asked for answers to these questions. The following is in response to these:

-{ Quote: "HIPS Information:

ESET Smart Security 4 and ESET NOD32 Antivirus 4 introduced basic Host-based Intrusion Prevention System (HIPS) functionality as an extra layer of protection to our security software. It is not intended nor designed to act as a replacement for standalone HIPS products.

ESET’s HIPS protects your system from malware and unauthorized attempts to impact the security of the software. In the current release, there are no dedicated HIPS controls in the user interface. ESET delivers host-based intrusion protection through a combination of capabilities including self-defense, advanced heuristics, web access protection and protocol filtering. In particular, advanced heuristics stops potentially malicious code by analyzing their behavior and disabling them before they can do damage. ESET’s self-defense prevents malware from disabling our software and weakening the security of the user’s system. Future releases of ESET Smart Security and ESET NOD32 Antivirus will have increased HIPS functionality.


Regarding questions about test performance on HIPS tests:

While current versions may not pass explicit tests designed for standalone HIPS products, ESET Smart Security/ESET NOD32 Antivirus are designed to accomplish the same tasks through other mechanisms (i.e., Advanced Heuristics, IDS, Self-Defense, etc.). That said, HIPS testing results for subsequent versions of ESET Smart Security and ESET NOD32 Antivirus will be markedly improved.

Regarding questions about HIPS in Home Editions of ESET software:

Although the same HIPS functionality is present in the Home Editions of our products, ESET has not actively marketed it to that customer segment.

-ESET Team" }-

Thank you,
Richard

[Najem1992]

-{ Quote: "Hello,

Thank you for your questions and interests in this. I have collected all posts and asked for answers to these questions. The following is in response to these:



Thank you,
Richard" }-
thank you very much Mr.Rmuffler for explaining this matter
and I hope next version will have better HIPS ;D

[MasterTB]

Thanks, good to hear, this is!


(something Yoda would say)

[viruscraft]

Thanks for the reply.

[funkydude]

Thanks for taking 2 months to tell us that, forgive me if I don't believe you, because saying "HIPS" is a mixture of current modules is a load of crap. I'll believe it when I see the controls in the menu, if they ever come.

[breadseed]

-{ Quote: "Thanks for taking 2 months to tell us that, forgive me if I don't believe you, because saying "HIPS" is a mixture of current modules is a load of crap. I'll believe it when I see the controls in the menu, if they ever come." }-

I agree, seems like Eset have contrived a "polititian's answer" to save their blushes.

[ESS3]

-{ Quote: "
Gartner включила ESET в «Магический Квадрант»

Москва, 7 мая 2009 года. Компания ESET впервые стала участником «Магического Квадранта», составленного исследователями Gartner. В отчете «Magic Quadrant for Endpoint Protection Platforms» (производители систем защиты конечных точек) специалисты Gartner отмечают быстрый рост доли ESET на мировом рынке, технологические преимущества нового поколения продуктов ESET NOD32. В частности, быструю реакцию разработчика на появление новых угроз, наличие технологии HIPS (Host Intrusion Prevention System), высокий уровень детектирования и обезвреживания вредоносного ПО с применением эвристических технологий.
" }-
http://www.esetnod32.ru/company/news.php?ELEMENT_ID=6597

:P ;)

[funkydude]

http://translate.google.com/translate?prev=hp&hl=en&js=n&u=http%3A%2F%2Fwww.esetnod32.ru%2Fcompany%2Fnews.php%3FELEMENT_ID%3D6597&sl=ru&tl=en

Not sure how it affect us at all.

[rony474]

-{ Quote: "Thanks for taking 2 months to tell us that, forgive me if I don't believe you, because saying "HIPS" is a mixture of current modules is a load of crap. I'll believe it when I see the controls in the menu, if they ever come." }-

did u get any problems (virus infections,malware) in that time u are using eset?..

[funkydude]

-{ Quote: "did u get any problems (virus infections,malware) in that time u are using eset?.." }-

No, but I wouldn't even if I wasn't using a security package simply because of my browsing habits. Please don't change the subject.

[Najem1992]

next version of Eset v4.x
must have HIPS !!
like other security programs and
when that happens ESS will absolutely be
the best !!!;D

[vizhip]

Curious as to why everyone thinks that the ESET version of HIPS must mirror other software company's HIPS solutions...

Seems to me that ESET has found ways to implement better security for our computers using their own methodology, so maybe we should just consider that their version of HIPS might be something that others look at in the future as a way to be more protective of our computers but less intrusive and less resource intensive...

Sure, it means that we can't measure their version of HIPS as compared to other companies, but does that really matter if the product works and stops our computers from being infected ???

Sorry, but I believe in thinking outside the box and providing new and unique solutions to issues that plague folks to resolve the issue rather than patch it... so I applaud changes in the way that security works in an effort to better protect our computers...

Regards -
-Bob

[Najem1992]

Eset must have HIPS very soon
in the next 4.x version :lurking:

[funkydude]

-{ Quote: "
Seems to me that ESET has found ways to implement better security for our computers using their own methodology" }-

I'm not discrediting that, ESET's out-the-box intuitive security methods are one of the reasons I'm still with them, I leave that expertise to them and I'm confident of it in their hands.

But this thread wasn't started as a request for HIPS in ESET products, to me I don't really care if they add HIPS or not.

This thread was started because HIPS is being used as a selling point for v4.

[vizhip]

-{ Quote: "But this thread wasn't started as a request for HIPS in ESET products, to me I don't really care if they add HIPS or not.

This thread was started because HIPS is being used as a selling point for v4." }-

My mistake... sorry... ignore my post then...

Regards -
-Bob

[larryb52]

hips in the traditional sense is not in there, they sorta danced around that with well the way we setup the firewall plus heuristics create a hips solution, I sorta have to feel that this is correct but for people who think of hips differently they will be disappoited...

[eezdva]

I have tried other software with HIPS and they slowed my PC down somwhow in someway.

If it's true ESS has HIPS they did a better job in keeping the product light but working?

[nodyforever]

probability next version number 5 :) news is good

[ESS_Lover]

-{ Quote: "probability next version number 5 :) news is good" }-
Yeah , I hope so ... ;D