Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

2/26/2013
10:38 PM
Dark Reading
Dark Reading
Products and Releases
50%
50%

Stonesoft Releases Evader 2.01 Advanced Evasion Testing Tool

Free security software identifies weaknesses in company networks against advanced evasion techniques

SAN FRANCISCO--(BUSINESS WIRE)--Stonesoft today released Evader 2.01 an updated version of the world´s first advanced evasion software testing tool. Since its initial release at Black Hat in July, thousands of companies have downloaded the tool to identify potential security risks in their network.

Evader 2.01 provides organizations with a free tool that can be used to test their network's ability to withstand advanced evasion techniques (AETs). Evader 2.01 includes a new graphical user interface to improve usability and the tool supports multiple evasion techniques and can be used in any test environment.

AETs are used to attack networks by combining several known evasion methodologies to create a new, earlier unknown and dynamically changing technique that is delivered over several layers of a network simultaneously. This allows the attacker to successfully deliver any exploit, malicious payload or code to a target host without detection.

"Breaches continue to occur where corporations have invested heavily in security solutions. However, design flaws in existing firewalls and intrusting prevention systems are being exploited" said Ilkka Hiidenheimo, CEO of Stonesoft. "Attackers are more sophisticated today and employ evasive techniques to avoid detection. Organizations must be aware of these types of attacks and Evader can be used to help them find out whether they can resist the attacks."

Evader 2.01 is a ready-made test lab that includes a set of AETs. It enables an organization to run manually or automatically a variety of AET combinations that hide well-known MSRPC (vulnerability from 2008) and HTTP (2004) exploits, and then deliver them through the tested network security devices to a vulnerable target host image. Evader 2.01 includes a set of AETs that has gone through the CERT vulnerability coordination process, which began two years ago. The essence of Evader is to provide hard facts about AET readiness of an organization's own security devices, support decision making and raise an organization's security level.

Stonesoft is demonstrating Evader 2.01 in San Francisco during the annual RSA Conference at booth #1953, February 25 to March 1, 2013. During the demonstration, Stonesoft will test leading security products for their ability to protect against AETs, including HP/Tipping Point, McAfee, Palo Alto Networks and SourceFire.

To download Evader for free and learn more about the tool, please visit evader.stonesoft.com. For more information about advanced evasion techniques and Stonesoft's new Evasion Prevention System (EPS) please visit aet.stonesoft.com.

About Stonesoft

Stonesoft Corporation (NASDAQ OMX: SFT1V) delivers dynamic, software-based network security solutions that secure information flow for more than 6500 mid- and large-sized organizations across the globe. These include the industry's first transformable Security Engine as well as standalone next generation firewalls, intrusion prevention systems and SSL VPN solutions. At the core of these solutions is the Stonesoft Management Center, which unifies and simplifies the management of entire networks while reducing TCO. Stonesoft is a recognized researcher of advanced evasion techniques and has the highest customer retention rate in the industry. Founded in 1990, the company's corporate headquarters are based in Helsinki, Finland with North American headquarters in Atlanta, Georgia. For more information, please visit www.stonesoft.com or stoneblog.stonesoft.com. Follow Stonesoft at twitter.com/Stonesoft_US.

- See more at: http://www.rsaconference.com/events/2013/usa/for-media/sponsor-news.htm#sthash.x5KyYPIe.dpuf

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
I 'Hacked' My Accounts Using My Mobile Number: Here's What I Learned
Nicole Sette, Director in the Cyber Risk practice of Kroll, a division of Duff & Phelps,  11/19/2019
6 Top Nontechnical Degrees for Cybersecurity
Curtis Franklin Jr., Senior Editor at Dark Reading,  11/21/2019
TPM-Fail: What It Means & What to Do About It
Ari Singer, CTO at TrustPhi,  11/19/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-19013
PUBLISHED: 2019-11-22
A CSRF vulnerability in Pagekit 1.0.17 allows an attacker to upload an arbitrary file by removing the CSRF token from a request.
CVE-2019-3427
PUBLISHED: 2019-11-22
The version V6.01.03.01 of ZTE ZXCDN IAMWEB product is impacted by a code injection vulnerability. An attacker could exploit the vulnerability to inject malicious code into the management page, resulting in users� information leakage.
CVE-2019-3428
PUBLISHED: 2019-11-22
The version V6.01.03.01 of ZTE ZXCDN IAMWEB product is impacted by a configuration error vulnerability. An attacker could directly access the management portal in HTTP, resulting in users� information leakage.
CVE-2019-4214
PUBLISHED: 2019-11-22
IBM SmartCloud Analytics 1.3.1 through 1.3.5 does not set the secure attribute on authorization tokens or session cookies. This could allow an attacker to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 159185.
CVE-2019-4215
PUBLISHED: 2019-11-22
IBM SmartCloud Analytics 1.3.1 through 1.3.5 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks ag...