AV-Comparatives Firewall Test 03/2014

arran · May 5, 2014

Cabville said: ↑

But it will prevent them from executing before they can inject themselves into other processes. He also mentions DLL control, which is also helpful. So yes, an anti-executable will in fact help defend against piggybacking.
Click to expand...

Yes but I am talking about controlling the behaviour of programs that you use that are allowed to execute and run. How can you use software if you don't allow it to execute and run? So going back to my original question given the fact that windows firewall doesn't have a decent HIPS how does all the windows firewall lovers prevent programs from piggy backing on other programs to connect out?

IBK · May 5, 2014

Reminder: magazine wanted products tested with default settings. All products were tested with default settings, as described in the report (the report also contains some hint what happens when you block NetBios in Outpost). The test is easy to verify and retest: just disable the learn mode and try it out to see if it makes a difference...

act8192 · May 5, 2014

@IBK, Permanent Auto-Learn is NOT a default setting in Outpost. Please see posts 47-49 on page 2 of this thread.

IBK · May 5, 2014

I just downloaded and installed it again - it is default setting. It even goes to permanent Auto-Learn if you click to reset the settings to default.

act8192 · May 5, 2014

Thank you, IBK. While it has not been my experience as it's normally rules wizard, I do believe you.
It's just for the first reboot so those booting related rules can be made by Outpost.
Aha, the plot thickens, see post #77 - it's an option.

Outpost Firewall & Security Suite:
on installation, for the people who do not want to spend time setting up rules or answering the rules wizard prompts, it asks if you want to run in autolearn mode for a week to build up a rule set to cover you commonly used apps. you also have the option NOT to do this. i do not like that as if you do not read the instructions and turn off the autrolearn, it will stay in that mode too long. agnitum apparently bowed to pressure from the install it and forget it crowd who complained about having to train outpost by answering a lot of rules prompts & made it a default. hopefully this so-called 'test' will prompt them to clarify any auto-learn attempts initiated by the end user. with just a modicum of configuration, outpost should pass all these tests (to be fair, so should comodo).
Click to expand...

IBK · May 5, 2014

Unfortunately we had to test using only default settings. I guess several products (which offer many settings) can be hardened by experienced users - but that was not the scope of the test, and in some cases (please try yourself as I will not name them), some products would anyway not pass those simple tests even if you play with the settings. Some vendors identified already their bugs and will release fixes, some vendors are still investigating and some will always deny any faults [and eventually fix it silently if bothered to do so] (so it would be good if users would try those simple tests and report them to the vendors too if the products do not behave as expected).

Malware fighter · May 8, 2014

Fabian Wosar said: ↑
To give a quick update: I tried to replicate their results but was unable to. Online Armor behaved the way I expected it to which is:

Block access to all file sharing ports unless it the access originates from a trusted network/computer.

Block ping requests unless the requests originates from a trusted network/computer.

Allow access to the RDP port, no matter which network, as the RDP port is not a restricted port by default.

I contacted AVC. Unfortunately they no longer had the original test systems, but they kindly agreed to replicate the test and collect some additional logs for us. The problem we are facing at the moment is that at least according to the logs Online Armor performed exactly as it should be, blocking all the access attempts from the untrusted network:
Code:
[02/04/14 10:17:34]  2068/814  UDP <- 192.168.20.100:137, 192.168.20.133:137, System(4/0)
[02/04/14 10:17:34]  2068/814  Blocked by restricted port list

[02/04/14 10:17:37]  2068/814  TCP <- 192.168.20.100:139, 192.168.20.133:49822, System(4/0)
[02/04/14 10:17:37]  2068/814  Blocked by restricted port list
However, even though the network connection attempts were blocked according to the logs, AVC was still able to create/edit files remotely. At this point it is clear that somehow Online Armor messes up on their test system, but we don't know why yet. AVC offered remote access to their test setup and we will surely take advantage of that offer, but it will take a bit longer until we know exactly what is causing it.

Thanks, that is exactly the look I was going for . To make sure I haunt you in your dreams, I set my Wilders avatar to the very same avatar I use in our forums. You are welcome.
Click to expand...
well, almost a month passed - so what's the conclusion ?

Cutting_Edgetech · May 9, 2014

Fabian Wosar said: ↑

To quote the Online Armor manual: The columns in the Interfaces list are also color coded for convenience. The "Trusted" and "Description" columns show whether the interface is either using default trust settings that were originally applied when the network was first detected (yellow), has been manually Trusted (green), or has been manually Not Trusted (red). The "Active" and "Address, Mask" columns indicate whether the interface is Active (green) or disabled/not applicable (grey).
Click to expand...

I do not like this because I did not tick the box that said, "Trust Network" when my network was detected, but since I had previously trusted the network at some point in the past OA trusted the network anyways highlighting the network in Yellow. I have been using OA for months now thinking the network was not trusted as it should not have been trusted because I did not tick the box labeled, "Trust Network". This is a real problem. You should give 2 boxes. I think the boxes should be as the following: Home Network (Trusted), and Public Network (Not Trusted). If Online Armor prompts the user again saying their network has been detected, and the user chooses not to trust the network then the network should not be trusted regardless if the user trusted the network at some point in the past. If you don't want to give the 2 box options I have recommended then OA should at least not trust the network if the user does not tick the box to trust it when prompted. I can reproduce this behavior 100% of the time. I have tried this over, and over with the same result. I hope you will make the changes I have recommended because I really do feel they are needed. If OA should not have trusted the network in the circumstances I have just described then OA has a pretty significant bug from a security stand point of view. If it is a bug then let me know, and I will start a tracker (bug report) on it. Also, if you need a tracker for the changes that I have recommended then let me know, and I will do that as well.

Shiri · Jun 3, 2014

FleischmannTV said: ↑

Report:

-http://www.av-comparatives.org/wp-content/uploads/2014/03/avc_fw_201403_en.pdf
Click to expand...

Glad the Win 7 firewall did good ....

http://www.av-comparatives.org/wp-content/uploads/2014/03/avc_fw_201403_en.pdf

Stregobor · Jun 16, 2014

Can anyone tell me what about Comodo? Did it failed completely or was not in test. And if it failed what was the reason? Default settings or it is just not so good as everyone thinks?

Log in or Sign up

AV-Comparatives Firewall Test 03/2014

arran Registered Member

IBK AV Expert

act8192 Registered Member

IBK AV Expert

act8192 Registered Member

IBK AV Expert

Malware fighter Registered Member

Cutting_Edgetech Registered Member

Shiri Registered Member

Stregobor Registered Member

Log in or Sign up

AV-Comparatives Firewall Test 03/2014

arran Registered Member

IBK AV Expert

act8192 Registered Member

IBK AV Expert

act8192 Registered Member

IBK AV Expert

Malware fighter Registered Member

Cutting_Edgetech Registered Member

Shiri Registered Member

Stregobor Registered Member

Useful Searches