Quote from one of the e-mails I got: "After the beta testing process, we will also provide you 1 year small business license for free! Who knows ,...
Sorry, can't give you an explanation for that one. Although there are more companies that only develop anti-exploit toolkits for businesses. But I...
https://twitter.com/Trapmine/status/589158994436038656 I will try to run some test in the coming week. If I find something interesting I will...
You can get quite far with having SYSTEM rights...
Although I am still pretty sure that no rule based IDS is going to pick-up a zero-day exploit... You'll have to rely on Endpoint Protection / a...
Nope, two are enough. 1 initial vulnerability (v8 engine, Flash, etc) and 1 EoP (Can be sandbox escape, can be kernel exploit)
IDS/AV is not going to stop a VUPEN grade zero-day. Their pwn2own 2014 Chrome exploit has a detection rate of 0/57 on VirusTotal. Furthermore, are...
Testing malware on a production machine. o_O Luckily we have HMP and HMP.Alert.
Every system can be penetrated with half a dozen zero-days, it just depend whether you are valuable enough to target.
If you've not added protection manually, then that's still I thing that you should do. MBAE does not recognise the HMP Test Tool of the shelf for...
What is are you exactly trying to tell by posting results of the HMP Test Tool?
Did you try to restart HMPA or was it still running? (Although the service might be killed)
Well, I am pretty sure that no test organisation would falsify results in favor of one specific vendor. Looking at the results of HMPA and MBAE I...
I have experienced the same issue myself, it seems like the HMPA service is no longer running. (There doesn't seem to be a way to restart the...
I would like to remind you that exploiting 64-bit processes is quite different than exploiting 32-bit processes. For example: This talk contains...
You can click on "Exploit mitigation" and select "Disabled".
First of all: Sorry for my bad English. NB: This post is not meant to bash on any tool, person or company, just to indicate that bypassing...
I have experienced EMET as being too slow when EAF+ is enabled. Without EAF+ EMET is not causing any major slowdowns. Although EAF+ is a key...
Not full disclosure, just a screen capture. (It also impacts EMET and MBAE)
Thank you for the response. That's understandable.
I am currently preparing a demo of a HMPA bypass as a reaction to the report, stay tuned...
@markloman btw, why are you also comparing Alert with Palo Alto Traps even though exploit prevention is just one of the things offered by Traps?...
Or it is just a false positive ;) Trust me, finding a zero-day that is being exploited in the wild is not very good for your heart :/
1. Determining offsets can all be done dynamically, as long as you have RW access to memory on a 32 bit browser. 2. I agree with you on that part....
Although I do not know if this is the result of very good proactive defenses, good script blocking or both.
Separate names with a comma.