KAV/KIS 2013 Beta - Final

Discussion in 'other anti-virus software' started by 3x0gR13N, Mar 5, 2012.

Thread Status:
Not open for further replies.
Page 3 of 15
  1. ReverseGear

    ReverseGear Guest

    Re: KAV/KIS 2013 Beta

    2012 and 2013 both are light for me
     
    ReverseGear, Jun 8, 2012
    #51
  2. Norton360

    Norton360 Registered Member

    Joined:
    Nov 28, 2007
    Posts:
    71
    Re: KAV/KIS 2013 Beta

    Thanks Champ:)
     
    Norton360, Jun 8, 2012
    #52
  3. BoerenkoolMetWorst

    BoerenkoolMetWorst Registered Member

    Joined:
    Dec 22, 2009
    Posts:
    4,873
    Location:
    Outer space
    Re: KAV/KIS 2013 Beta

    Some more info on the new exploit protection module, seems largely based on forcing ASLR: http://securitywatch.pcmag.com/secu...aspersky-2013-products-will-expand-protection

    I just compared the rights/rules list from the HIPS with 2012 and the only thing they added is "Modifying memory of other process" Among other things, with the loss of Proactive defense protection from suspicious driver installation is lost. The 32 bit version's HIPS has "Start driver" so not much is lost there, but the 64 bit version HIPS does not have this protection, I'd say protection from driver installation is one of the more important functions of any HIPS.

    Does System watcher give pop-ups with options to block the behaviour or is it more of a passive thing?

    That's quite dissappointing :thumbd: BTW, they did finally fix 'breaking' ASLR protection by loading their DLL's without ASLR support into explorer.exe and others and they added DEP and ASLR on their own processes as well.
     
    BoerenkoolMetWorst, Jun 8, 2012
    #53
  4. 3x0gR13N

    3x0gR13N Registered Member

    Joined:
    May 1, 2008
    Posts:
    850
    Re: KAV/KIS 2013 Beta

    System Watcher inherited PDM's suspicious driver installation from what I can see: -http://s7.postimage.org/vnapsgo3f/swdrvinstall.png
    I believe manipulating of services (create/read/modify/start) is monitored on 64bit in HIPS, which provides protection against driver installs.
    And there's the classic modifying registry entry/creating .sys in driver dir, as any classical HIPS has.

    It does give popups (Interactive mode).
    -Old Zbot sample: -http://s18.postimage.org/a0iu9fomh/swscar.png and rollback -http://s18.postimage.org/wqhz2f7u1/swscarrollback.png Items that will be rolled back -http://s18.postimage.org/66pe0a7ah/swscarrollback2.png

    -TDL4/Pihar rootkit: -http://s18.postimage.org/q50nox2ll/swtdl.png -http://s18.postimage.org/us6pqopyh/swtdl2.png

    -Boot.Cidox: -http://s18.postimage.org/gbo1pupux/swcidox.png

    etc. etc.

    You should have in mind that it is compensated a bit with the Exploit prevention feature in SW. :)

    I'm on XP so I don't know about ASLR. Someone else could check.
     
    Last edited: Jun 8, 2012
    3x0gR13N, Jun 8, 2012
    #54
  5. BoerenkoolMetWorst

    BoerenkoolMetWorst Registered Member

    Joined:
    Dec 22, 2009
    Posts:
    4,873
    Location:
    Outer space
    Re: KAV/KIS 2013 Beta

    Thanks for the reply :)
    About the ASLR issue, it wasn't a question, I meant to say they did fix it for v2013.
     
    BoerenkoolMetWorst, Jun 8, 2012
    #55
  6. 3x0gR13N

    3x0gR13N Registered Member

    Joined:
    May 1, 2008
    Posts:
    850
    Re: KAV/KIS 2013 Beta

    Ah, sorry, read that wrong ("...did they finally fix..."). :)

    Here's an official changelog included in the RC distributive:
     
    3x0gR13N, Jun 8, 2012
    #56
  7. BoerenkoolMetWorst

    BoerenkoolMetWorst Registered Member

    Joined:
    Dec 22, 2009
    Posts:
    4,873
    Location:
    Outer space
    Re: KAV/KIS 2013 Beta

    Do you know how System watcher handles files with digital signature? Proactive defense trusted them with default settings, but there was an option to disable that, I can't find one in System watcher settings.
     
    BoerenkoolMetWorst, Jun 14, 2012
    #57
  8. Tomwa

    Tomwa Registered Member

    Joined:
    Feb 3, 2010
    Posts:
    165
    Re: KAV/KIS 2013 Beta

    ^ I would also like to know.
     
    Tomwa, Jun 14, 2012
    #58
  9. toxinon12345

    toxinon12345 Registered Member

    Joined:
    Sep 8, 2010
    Posts:
    1,200
    Location:
    Managua, Nicaragua
    Re: KAV/KIS 2013 Beta

    Is blocked | logged using Kaspersky Endpoint Security 8? :doubt:
     
    toxinon12345, Jun 14, 2012
    #59
  10. 3x0gR13N

    3x0gR13N Registered Member

    Joined:
    May 1, 2008
    Posts:
    850
    Re: KAV/KIS 2013 Beta

    The option is removed for System Watcher, it automatically trusts files with valid digital signatures and with Trusted status in KSN.

    Sorry, I don't use KES 8 so don't really know.
     
    3x0gR13N, Jun 15, 2012
    #60
  11. Tomwa

    Tomwa Registered Member

    Joined:
    Feb 3, 2010
    Posts:
    165
    Re: KAV/KIS 2013 Beta

    A wise man once said:
    "That's ~ Snipped as per TOS ~ garbage"

    Kaspersky should listen to their elders or I'll be finding a different security solution. Off to their forums to complain!
     
    Last edited by a moderator: Jun 15, 2012
    Tomwa, Jun 15, 2012
    #61
  12. toxinon12345

    toxinon12345 Registered Member

    Joined:
    Sep 8, 2010
    Posts:
    1,200
    Location:
    Managua, Nicaragua
    Re: KAV/KIS 2013 Beta

    The Kaspersky Whitelisting program seems to be a good idea for developers
    http://whitelist.kaspersky.com/
     
    toxinon12345, Jun 15, 2012
    #62
  13. xxJackxx

    xxJackxx Registered Member

    Joined:
    Oct 23, 2008
    Posts:
    8,644
    Location:
    USA
    Re: KAV/KIS 2013 Beta

    Interesting. I'll be curious to see how it works out.

    Have fun getting banned. :ouch:
     
    xxJackxx, Jun 15, 2012
    #63
  14. 3x0gR13N

    3x0gR13N Registered Member

    Joined:
    May 1, 2008
    Posts:
    850
    Re: KAV/KIS 2013 Beta

    You still have the option to not trust digitally signed/KSN trusted files in Application Control.
     
    3x0gR13N, Jun 16, 2012
    #64
  15. test

    test Registered Member

    Joined:
    Feb 15, 2010
    Posts:
    499
    Location:
    italy
    test, Jun 16, 2012
    #65
  16. Blackcat

    Blackcat Registered Member

    Joined:
    Nov 22, 2002
    Posts:
    4,024
    Location:
    Christchurch, UK
    Re: KAV/KIS 2013 Beta

    Or at least getting roasted/posts removed by richbuff :p :D :D :cautious:
     
    Blackcat, Jun 16, 2012
    #66
  17. xxJackxx

    xxJackxx Registered Member

    Joined:
    Oct 23, 2008
    Posts:
    8,644
    Location:
    USA
    xxJackxx, Jun 16, 2012
    #67
  18. Tomwa

    Tomwa Registered Member

    Joined:
    Feb 3, 2010
    Posts:
    165
    Re: KAV/KIS 2013 Beta

    Nah, all he did was move my post into the correct section of the forum ;)

    Never said I was gonna be a jerk about it.
     
    Tomwa, Jun 23, 2012
    #68
  19. xxJackxx

    xxJackxx Registered Member

    Joined:
    Oct 23, 2008
    Posts:
    8,644
    Location:
    USA
    Re: KAV/KIS 2013 Beta

    I see they are saying beta testing is over. I hope nobody is looking for any major changes at this point.
     
    xxJackxx, Jun 23, 2012
    #69
  20. qakbot

    qakbot Registered Member

    Joined:
    Aug 25, 2010
    Posts:
    380
    Re: KAV/KIS 2013 Beta

    Wow.. Kaspersky sure does spend a lot of money on marketing these days and copying their other larger competitors.

    Been using the Symantec Whitelisting program for years https://submit.symantec.com/whitelist/isv/

    Why is Kaspersky's different?

    Its funny, that as soon as Symantec introduced Reputation/Whitelisting in their 2009 (2010 ?) products, the very next year Kaspersky had Reputation in their product :) Coincidence. Even their user-interface on the reputation page, the green/red/grey looked ripped off from Symantec's

    I am beginning to think that as far as intellectual property goes, Kaspersky is to Symantec, as Samsung is to Apple.
     
    qakbot, Jun 23, 2012
    #70
  21. 3x0gR13N

    3x0gR13N Registered Member

    Joined:
    May 1, 2008
    Posts:
    850
    Re: KAV/KIS 2013 Beta

    @qakbot
    Do you have any idea what you're talking about? Why are you even comparing the two?
    Every company has their white list so 3rd party applications don't have trouble working in an environment with said security solution installed.
    Since Symantec != Kaspersky the answer is obvious.

    Kaspersky Security Network (i.e white list) has been present since mid 2008, when v8 (aka v2009) was released.
     
    3x0gR13N, Jun 23, 2012
    #71
  22. Sir Percy

    Sir Percy Registered Member

    Joined:
    Apr 22, 2010
    Posts:
    289
    Re: KAV/KIS 2013 Beta

    Spoken like true Norton "qakpot" :p ;)

    Every big AV has had these kind of measures for some years now, the "Samsung is to Apple" got me laughing quite hard though as it is a bad comparison, i have both and Samsung is quite a lot better than Iphone right now.

    What you did yesterday somebody will improve and do better today. :)
     
    Sir Percy, Jun 23, 2012
    #72
  23. qakbot

    qakbot Registered Member

    Joined:
    Aug 25, 2010
    Posts:
    380
    Re: KAV/KIS 2013 Beta

    Prove to me that Kaspersky's whitelist is better than its competitors. If not, then I'd assert that they are just playing catch-up, as always.
     
    qakbot, Jun 24, 2012
    #73
  24. ZeroDay

    ZeroDay Registered Member

    Joined:
    Jul 9, 2011
    Posts:
    716
    Location:
    UK
    Re: KAV/KIS 2013 Beta

    Kaspersky playing catch up to Symentec? LOL!!
     
    ZeroDay, Jun 24, 2012
    #74
  25. Sir Percy

    Sir Percy Registered Member

    Joined:
    Apr 22, 2010
    Posts:
    289
    Re: KAV/KIS 2013 Beta

    I have nothing to prove, you were the one who had to derail a thread with statements that seemed based on nothing more than fanboy rhetoric.

    Perhaps time to get back on topic = a beta of Kaspersky and not the Symantec Whitelisting program?
     
    Sir Percy, Jun 24, 2012
    #75
Page 3 of 15
Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...