Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

Antivirus Tool Fail: Blocking Success Varies By 58%

Only two of 13 endpoint security software scanners blocked more than 80% of known exploits, NSS Labs study reports.

Who Is Hacking U.S. Banks? 8 Facts
Who Is Hacking U.S. Banks? 8 Facts
(click image for larger view and for slideshow)
In a test of 13 top endpoint security suites, only two blocked known exploits more than 80% of the time.

That finding comes via a new report from independent testing firm NSS Labs, which studied the effectiveness of leading Windows endpoint--often referred to as antivirus--security suites.

In terms of their overall ability to block known exploits, NSS found that Kaspersky Internet Security 2012 stopped 92.2% of threats, while Alwil Avast Pro Antivirus 7 blocked 81.9%. Next in line were Symantec's Norton Internet Security version 19 (74.1%), AVG Internet Security 2012 (73.3%), ESET Smart Security 5 (70.7%), Trend Micro Titanium Maximum Security version 6 (69.8%), McAfee Internet Security 11 (65.5%), and Avira Internet Security 2012 (64.7%).

Meanwhile, Microsoft Security Essentials only blocked about half of the exploits it encountered, followed by F-Secure Agent version 1.57 (44.8%), Norman Security Suite 9.00 (42.2%), Panda Internet Security 2012 (38.8%), and Total Defense Internet Security Suite version 8 (34.5%).

According to a September 2012 antivirus market-share report from research firm OPSWAT, in North America, Microsoft controls 27% of the market, followed by Symantec (16%), Avast (11%), and AVG (10%).

[ Defense isn't enough to protect your systems. See Play Offense On Security In 2013: Gartner. ]

In today's era of advanced persistent threats, spear-phishing attacks, social engineering campaigns, and drive-by attacks, are endpoint security solutions performing well enough? The NSS Labs report suggests not. "Most vendors lack adequate protection against exploits," according to the report. As a result, "based on market share, between 65% and 75% of the world is poorly protected, and 75% to 85% in North America is poorly protected."

For its tests, NSS Labs used a Web server to attempt to infect its test PCs, but only using known exploits which have been seen on the Internet and in circulation for months, if not years. In other words, testers employed no zero-day vulnerabilities. In addition, the firm studied how different browsers reacted to the various exploits, using all versions of Internet Explorer since IE6, multiple versions of Firefox, as well as Apple Safari, and Google Chrome.

On that front, researchers issued a stark security warning--to consumers, but also applicable to businesses--that anyone still using IE6 "must be technically knowledgeable enough to employ other defenses, or will almost certainly be compromised." That's because when using IE6, only the McAfee endpoint security product blocked 100% of drive-by-download attacks, delivered via either HTTP or HTTPS. While four other products also performed well, Microsoft's wasn't one of them. "Ironically, Microsoft Security Essentials was one of the poorest performers at protecting users of IE6, and failed to block any of the Office 2003 exploits when delivered via Internet Explorer 6," according to the report.

Of course, security experts always recommend that businesses employ layered information security defenses, and not rely solely on antivirus software to block threats. According to NSS Labs, those extra layers of business defense should include, at a minimum, a robust patch management program, including rapid upgrading to the latest browser versions and browser plug-ins, as well as the use of an intrusion prevention system (IPS), especially in businesses that allow--explicitly or otherwise--employees to connect their own devices to the corporate network, per the bring-your-own-device (BYOD) movement.

While the report focuses on consumer-grade antivirus software, it's important to note that most endpoint security vendors' consumer-grade suites include a more sophisticated array of exploit-blocking tools than their enterprise-grade software. That's due in part to the industry assumption that for many consumers, the only defense standing between their PC and a malware infection is the antivirus software. Furthermore, those defenses are facing an ever-increasing number of threats, as the reported number of new vulnerabilities has been increasing by about 30% per year. Even one exploit that slips past the security defenses could result in an infection, allowing attackers to install additional malware onto the PC, or add the PC to their botnet.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Leo Regulus
50%
50%
Leo Regulus,
User Rank: Apprentice
11/4/2012 | 4:08:31 PM
re: Antivirus Tool Fail: Blocking Success Varies By 58%
I am a user / reseller of GFI Vipre which is not listed. I occasionally service infected units. The most frequently used of the AV products on infected units are listed in the higher area of your effectiveness list. Go figure...
PJS880
50%
50%
PJS880,
User Rank: Ninja
10/30/2012 | 5:22:48 PM
re: Antivirus Tool Fail: Blocking Success Varies By 58%
Those percentages do not seem good at all, and actually this very alarming considering how many people use end point as protection tool. What I think is even more alarming than the actual high percentages is that these are known exploits! If I was a a Antivirus company at the very least I would be able to block and catch the known exploits!

Paul Sprague
InformationWeek Contributor
AustinIT
50%
50%
AustinIT,
User Rank: Apprentice
10/26/2012 | 2:42:22 PM
re: Antivirus Tool Fail: Blocking Success Varies By 58%
Pretty alarming when you thing about it. Endpoint suites should be expected to block all known vulnerabilities.

Points out the critical need to patch your OS and Apps on a regular basis.
Stus
50%
50%
Stus,
User Rank: Apprentice
10/25/2012 | 9:48:48 PM
re: Antivirus Tool Fail: Blocking Success Varies By 58%
Having built an antivirus product from scratch, I am not surprised. That is why the new company I started specializes in end-user security awareness training, because the bad guys bypass the antivirus and social engineer the user to click on a link or open a malicious attachment.
http://www.knowbe4.com/

Warm regards,
Stu
News
FluBot Malware's Rapid Spread May Soon Hit US Phones
Kelly Sheridan, Staff Editor, Dark Reading,  4/28/2021
Slideshows
7 Modern-Day Cybersecurity Realities
Steve Zurier, Contributing Writer,  4/30/2021
Commentary
How to Secure Employees' Home Wi-Fi Networks
Bert Kashyap, CEO and Co-Founder at SecureW2,  4/28/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-31755
PUBLISHED: 2021-05-07
An issue was discovered on Tenda AC11 devices with firmware through 02.03.01.104_CN. A stack buffer overflow vulnerability in /goform/setmac allows attackers to execute arbitrary code on the system via a crafted post request.
CVE-2021-31756
PUBLISHED: 2021-05-07
An issue was discovered on Tenda AC11 devices with firmware through 02.03.01.104_CN. A stack buffer overflow vulnerability in /gofrom/setwanType allows attackers to execute arbitrary code on the system via a crafted post request. This occurs when input vector controlled by malicious attack get copie...
CVE-2021-31757
PUBLISHED: 2021-05-07
An issue was discovered on Tenda AC11 devices with firmware through 02.03.01.104_CN. A stack buffer overflow vulnerability in /goform/setVLAN allows attackers to execute arbitrary code on the system via a crafted post request.
CVE-2021-31758
PUBLISHED: 2021-05-07
An issue was discovered on Tenda AC11 devices with firmware through 02.03.01.104_CN. A stack buffer overflow vulnerability in /goform/setportList allows attackers to execute arbitrary code on the system via a crafted post request.
CVE-2021-31458
PUBLISHED: 2021-05-07
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.1.1.37576. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handlin...