Agnitum: PC Security Test shows Antivirus Products Being Left Behind

PRESS RELEASE

St. Petersburg, Russia — May 15, 2012. The dismal Proactive Security Challenge results turned in by the big AV (Anti-Virus) players in the most recent Matousec.com 64-bit Windows 7 tests are making us wonder whether security companies are really catering to the needs of 64-bit PC/OS users. Are traditional AV vendors even capable of delivering reliable and robust protection to these users?

I. 64-bit OS security landscape

With the increase of processing power and rapidly dropping memory prices, 64-bit systems are firmly in the mainstream (check the latest Steam statistics — x64 systems are used on more than 60% of the modern gamer-oriented PCs).

Security-wise, 64-bit systems benefit from the improved native protection implemented in Windows Vista and Windows 7; this improved protection comes from such security mechanisms as mandatory driver signing, kernel patch protection and hardware-based DEP (Data Execution Prevention). These tools are designed to minimize the incidence of rootkits and other powerful and sophisticated malware. Thanks to these and other tools, 64-bit systems are, at least on the surface, much more solid and secure than their 32-bit cousins.

To complement native security protection for 64-bit systems, Anti-Virus vendors have, of course, rushed in to save the 64-bit user from malware enslavement with tools that claim to protect against any and all types of infections. If the results of the 64-bit Matousec.com tests are anything to go by, most of them have failed miserably. The reality is that, far from being more secure than 32-bit users, owners of 64-bit Windows systems are actually lagging in available flexibility and strength of protection.

II. Proactive security test results

The table below aggregates the results of 32-bit and 64-bit system testing for selected products.

Product, participants for Proactive Security Challenges at Matousec.com (version for x64 test ) 64-bit score

(% in 110 tests for Windows 7), early 2012 32-bit score

(% in 148 tests for Windows XP), before 2012 64-bit score

32-bit score

— average, %

Outpost Security Suite Pro 7.5 86 97 92%

ZoneAlarm Extreme Security 2012 43 72 58%

ESET Smart Security 5.0 33 6 20%

Kaspersky Internet Security 2012 28 93 61%

Norton Internet Security 2012 10 20 15%

Bitdefender Total Security 2012 9 97 54%

PC Tools Internet Security 2012 6 90 48%

AVG Internet Security 2012 3 3 3%

McAfee Total Protection 2012 3 2 3%

By comparing the results of the recent 64-bit tests with the results of the most recent 32-bit tests (roundup test finished in October 2011), it becomes clear that the majority of vendors are falling short when it comes to 64-bit protection. We have to ask ourselves whether it’s a lack of expertise in 64-bit architecture or just laziness on the part of these developers, but either way, users are losing out. And we don’t think that’s fair on anyone.

III. Vendors interpretations

It’s even more disheartening to read recent response following the publication of the results (comments are provided in the Latest News for Proactive Security Challenge 64-bit at Matousec.com). Reading between the lines, it seems what they are saying is "give us more time and we’ll come up with a better solution that will be able to pass your tests". Considering that 64-bit Windows systems have been around for more than five years, and Windows 7, the platform adopted for the current test, is a good two and a half years old, it begs the question: how are users supposed to protect themselves in the meantime? And sadly it is not the only vendor taking this position.

All too often, it seems that big security players disregard the need to address penetration and leak tests for 64-bit Windows, which constitute the lion’s share of the tools used in the Matousec studies. These tools simulate typical intrusions by using the attack vectors and breach techniques used by real malware and 0-day threats, unearthing the shortcomings of systems that allow unknown viruses to penetrate current defenses and wreak havoc.

Most security vendors present in the table have historically shied away from putting their products through such tests because they say the additional protections required would sacrifice product usability. In the tradeoff between this kind of usability and increased security, they favor the former.

IV. Agnitum’s view

As a smaller player, we see the situation a little differently. To overcome the potential problems of more user prompts and alerts triggered by the introduction of system integrity controls, we have developed a mechanism of automated response to such events. It enables Agnitum to enhance security without getting in the user’s way all the time and asking questions most users have no hope of being able to answer. This has resulted in a formidable 86% pass rate in 64-bit Proactive Security Challenge tests, and we are working on improving this result by analyzing bypass techniques even further.

Looking at the broader picture, the major takeaway from the current Matousec.com report is that the majority of 64-bit systems are vulnerable and exploitable even with a "big-name" security product in place. Only a fraction of the available products deliver acceptable levels of protection. Agnitum, on the other hand, provides protection for both 32-bit and 64-bit systems with products that are not tweaked to recognize and block simulated attacks, and doesn’t distinguish between architectures.

We just monitor the integrity of the environment and stop attacks at their source, whatever techniques they employ. By embracing this kind of proactive approach to combating threats, any product should deliver more robust and reliable protection against unknown threats than those competing solutions that address predefined malware samples or only adapt to known techniques once they are fully researched.

For more information and to request review copies of Outpost Pro 7.5, please contact:

Vitaliy Yanko,

Director for Marketing and Sales, Agnitum Ltd.

[email protected], Skype: yan.vit,

office: +7 (812) 3365245, ext. 105 (10 AM – 7 PM, Moscow time, +4 GMT)

mobile: +7 (911) 9612835 (8 AM – 2 AM, Moscow time, +4 GMT)