New SMB Worm Uses Seven NSA Hacking Tools. WannaCry Used Just Two

In ver. 10, Eset dropped the use of its network adapter mini-port filter and is now using the Windows Filtering Platform; something I am not currently 100% onboard with. Appears it was to take advantage of the new Win 10 security features such as AMSI that monitors script execution.

 

A few more details on EternalRocks:

http://www.securityweek.com/eternalrocks-network-worm-leverages-7-nsa-hacking-tools

Also, this puppy exploits SMBv1 but also legitimately uses SMBv2 in the attack:

http://www.securityweek.com/nsas-eternalblue-exploit-fully-ported-metasploit

 

Thank you for letting me know! Now I know why I did not see the mini-port filter listed on my network adapter the last time I looked.

I may have to compare some other firewalls like Windows Firewall Controller, etc.. because the developer dedicates a lot of time to the firewall. It seems most developers are switching to Windows Filtering Platform so I think I should use which ever product is taking advantage of all the options Windows Filtering Platform has to offer. I'm not really sure how much time Eset puts into their firewall.

 

Security wise it is tops in protection especially with the IDS and botnet components.

Main criticism of the firewall is it is fairly low level as far as user features go. For example if outbound monitoring is enabled, you're going to get an alert on every connection attempt. This contrasts with for example, Symantec Norton's firewall that will auto create outbound rules for system and known safe processes.