Image
 
Latest Additions
 
EH-Net Login
Welcome Guest.






Lost Password?
No account yet? Register
Who's Online
We have 16 guests and 1 member online
EH-Net Donations

Enter Amount:
$

Google Ads
ChicagoCon 2008f
chicagocon2008f_125x200banner.jpg
ChicagoCon 2008f
EH-Net News Feeds
Latest Additions
Book Recommendations





 
Advertisement

You are here: Home arrow Forum arrow Ethical Hacking Discussions and Related Certificationsarrow Otherarrow Free Firewall Aces PC Magazine Tests
Ethical Hacker Community Forums
August 30, 2008, 07:05:18 AM *
Welcome, Guest. Please login or register.
Did you miss your activation email?

Login with username, password and session length
News: Registration Now Open for ChicagoCon 2008f Oct 27 - Nov 2! Visit www.chicagocon.com.
 
   Home   Help Calendar Login Register  
Pages: [1]   Go Down
  Print  
Author Topic: Free Firewall Aces PC Magazine Tests  (Read 2450 times)
0 Members and 1 Guest are viewing this topic.
don
Editor-In-Chief
Administrator
Hero Member
*****
Offline Offline

Posts: 2229


Editor-In-Chief


View Profile WWW
« on: May 11, 2008, 01:16:41 PM »

PC Mag Editors'Choice makes worth a look. It also made PC World's Fantastic Freebie list.

PC Mag Review:

Quote
Last year PC Tools acquired Novatix's Cyberhawk, a behavior-based anti-malware utility, and rereleased it under the name ThreatFire 3. The free edition offered only real-time protection; the paid Pro version added on-demand scanning. With the release of ThreatFire 3.5, however, just about every aspect of the program is now free for personal, noncommercial use. The new version adds a few brand-new features and is more effective than ever at protecting your system from known and unknown threats.

Bootom Line
Standard signature-based antivirus/antispyware programs can't recognize a threat that's too new to have a signature. ThreatFire 3.5 relies strictly on advanced behavior analysis to identify and remove both known and unknown threats. This free utility will be an excellent complement to your existing protection.

Pros
Extremely effective blocking of known and unknown malware based on behavior analysis. Identifies known threats by name. Reports suspicious actions, risk level, and threat type for unknowns.

Cons
On-demand scanner is not as accurate as that of signature-based products.

Read the full review here:
http://www.pcmag.com/article2/0,2817,2301045,00.asp

Don
Logged

CISSP, MCSE, CEH, Security+ SME
blackazarro
Full Member
***
Offline Offline

Posts: 217



View Profile
« Reply #1 on: May 11, 2008, 07:05:31 PM »


Hey, thanks Don for this info. This tool is exactly what I was looking for to accompany with my anti-virus.
Logged

Security+, OSCP, CEH
don
Editor-In-Chief
Administrator
Hero Member
*****
Offline Offline

Posts: 2229


Editor-In-Chief


View Profile WWW
« Reply #2 on: May 11, 2008, 08:19:28 PM »

I have no practical experience with it, so be sure to report back.

Don
Logged

CISSP, MCSE, CEH, Security+ SME
RoleReversal
Sr. Member
****
Offline Offline

Posts: 389


View Profile WWW
« Reply #3 on: May 12, 2008, 07:03:28 AM »

Don,

thanks for the link I've just taken a look and run a scan of my system and it looks promising. As Blackazarro said, could be a good addition to AV.

After install I performed a full scan of my system, whilst this did take a while (~3hrs for ~80GB) it found several potential threats on my system. Whilst everything it found I knew about (components from Metasploit and archived binaries from previous incident handling) if I was unaware of the files on my systems I would definately want to know about them. At the same time the files were ignored by recent AV scans on my machine (using Sophos and AVG free).

The aspect that could really be of interest is the behaviour based detection. I tested this with using netcat to set up a port listener, ThreatFire both closed the port and quarantined the nc.exe binary. My only complaint is that I did not recieve an alert starting that the quarentine had taken placing, leaving me to search for a few minutes to figure out why an executable I had just used had vanished  Embarrassed

Overall I'll keep it around and will install it in my malware analysis environment to see how well it performs with behaviour from the 'wild'. Thanks for the heads up.
Logged

A little bit of sanity:
http://www.infosanity.co.uk
blackazarro
Full Member
***
Offline Offline

Posts: 217



View Profile
« Reply #4 on: May 12, 2008, 11:14:44 PM »

Quote
The aspect that could really be of interest is the behaviour based detection. I tested this with using netcat to set up a port listener, ThreatFire both closed the port and quarantined the nc.exe binary. My only complaint is that I did not recieve an alert starting that the quarentine had taken placing, leaving me to search for a few minutes to figure out why an executable I had just used had vanished

Make sure in >Settings>Default Actions> that you configure it to prompt you or  to alert you when something is detected.
Logged

Security+, OSCP, CEH
RoleReversal
Sr. Member
****
Offline Offline

Posts: 389


View Profile WWW
« Reply #5 on: May 13, 2008, 07:11:17 AM »

Make sure in >Settings>Default Actions> that you configure it to prompt you or  to alert you when something is detected.

Checked that section afterwards as I hadn't changed the defaults. Suspected and potentially unwanted detects were set to 'prompt me' and know malicious threats were set to 'quarantine and alert me'. Either the alert wasn't generated or I missed it, something to bear in mind either way

From further testing I've installed this app on an XP machine I've got lying around (hasn't been rebuilt in years) and threatfire gave it a clean bill of health. Either I know how to keep a machine in good health or it missed something. (I hate when AV-type programs find nothing, no machine can be that clean Wink )

I've also noticed a few stability/performance issues with my machines whilst threatfire has been running, but this could just be the usual Windows flakiness. If anyone else has had similiar issues can you let me know?

Finally after more playing I've seen that threatfire has a real-time report on the number of global events it has scanned an threats found globally. I haven't had time to investigate this myself yet, does anyone know how this information is reported back and/or what information is included?
Logged

A little bit of sanity:
http://www.infosanity.co.uk
g00d_4sh
Sr. Member
****
Offline Offline

Posts: 279



View Profile
« Reply #6 on: May 13, 2008, 02:14:19 PM »

A slightly related, though not totally related question.  What firewalls do you all suggest?  I used the free Zonealarm for years.. but I've began tossing on Comodo on some new boxes I've been setting up.  I like the interface fairly well, although I was having an issue with Comodo freezing up my machine it was just put on, which bothered me.
Logged

"Bad.. Good?  I'm the guy with the gun"
blackazarro
Full Member
***
Offline Offline

Posts: 217



View Profile
« Reply #7 on: May 14, 2008, 12:33:45 AM »

Quote
I've also noticed a few stability/performance issues with my machines whilst threatfire has been running, but this could just be the usual Windows flakiness. If anyone else has had similiar issues can you let me know?

Well, it ran smoothly on my Vista laptop. I have a Dell XPS 1330, 2.0GHz Core 2 Duo T7300 processor, Santa Rosa chipset, and a 2GB DDR2-667 SDRAM. Ran good with those specs.

Quote
Finally after more playing I've seen that threatfire has a real-time report on the number of global events it has scanned an threats found globally. I haven't had time to investigate this myself yet, does anyone know how this information is reported back and/or what information is included?

Some info I found from ThreatFire's User Guide:

Quote
The Worldwide Detection tab displays a sampling of some of the most recent threats that
ThreatFire has detected within the ThreatFire Community. These are active threats that
we are protecting our users from. Click the Malware tab to display recently caught
malware and the Adware tab to display recently caught adware samples. As you click on
each threat in the list the map to the right will display the threat’s recent geographic
distribution in red. It is interesting to see how different threats are active in different
parts of the world.

Please note: if you disable Community Protection then ALL internet communication on ThreatFire's part will be disabled. This can affect other areas of the program including program notices and receiving updated Worldwide Detection data for the list of threats and the map on ThreatFire's Security Status tab. If you do turn Community Protection OFF, then you will only see a cached version (or older data, in other words) of this report.

Additional info from their FAQ mentioning what kind of info is sent to PC Tools if the Community Protection is enable:

Quote
The ThreatFire Secure Community is a worldwide network of active users who volunteer to aid in identifying new threats. Any time a suspect alert is triggered in ThreatFire, information related to this event is automatically back reported to PC Tools for analysis through a secure connection. Any information collected is held completely confidential and is used solely for the purposes of researching new or previously unknown threats, gaining an understanding of their behaviors, and developing new protection against them. Information collected may include the ThreatFire alert that fired, the history of relevant events leading to that alert, the decision taken, and a copy of the file that triggered the alert. This immediate confidential feedback on potentially dangerous new threats allows PC Tools to advance its ActiveDefense technology to block these threats. So as threat strategies evolve and new security penetration tactics emerge, ThreatFire technology will remain at the forefront of the solutions that defeat those threats. Participation in the Secure Community is voluntary and even if you elect not to participate, you'll still receive full protection from ThreatFire.

As for g00d_4sh question:

Quote
A slightly related, though not totally related question.  What firewalls do you all suggest?

For firewall personal apps, I refer to www.matousec.com for their recommendations. Check out the following link:

Matousec 's Firewall Ratings

As you will see, Comodo Firewall Pro 3.0.21.329 and Online Armor Personal Firewall 2.1.0.119 are Free apps leading with a perfect score. Based on the results, these what they recommend and they are absolutely free, beating out the commercial firewalls.

« Last Edit: May 14, 2008, 12:35:52 AM by blackazarro » Logged

Security+, OSCP, CEH
RoleReversal
Sr. Member
****
Offline Offline

Posts: 389


View Profile WWW
« Reply #8 on: May 14, 2008, 03:10:49 AM »

Blackazarro,

thanks for the info man. Guess I should have rtfm  Embarrassed
Logged

A little bit of sanity:
http://www.infosanity.co.uk
Fathercat
Newbie
*
Offline Offline

Posts: 11


View Profile
« Reply #9 on: May 14, 2008, 07:07:43 AM »

This is pretty cool, going to turn this over to our engineers to play with.
Logged


CISSP
RoleReversal
Sr. Member
****
Offline Offline

Posts: 389


View Profile WWW
« Reply #10 on: May 20, 2008, 05:16:17 AM »

Looks like PC Tools have already started using/releasing some of the statistics that they are gathering through the ThreatFire tool. ComputerWorld has an article analysing some of their statistics, with Vista taking the full force of analysis.

One of the claims is that 27% of Vista machines running ThreatFire were infected with 'malware' that bypassed Vista's in-built protection that ThreatFire detected/removed.

An ommision from the article however is a definition of 'malware', ThreatFire includes the likes of tracking cookies as malware whilst Vista doesn't, potentially explaining part of the results (I fell into this category during my first system scan despite clearing all cookies on browser closing as I was browsing at the same time as the scan). A more useful figure in my opinion would be the number of machines infected with executable binaries.

The article seems to be more PR-spin than useful technical information, but it is always good to get extra and/or corroborating(sp?) from multiple sources.
Logged

A little bit of sanity:
http://www.infosanity.co.uk
Pages: [1]   Go Up
  Print  
 
Jump to:  

Powered by MySQL Powered by PHP Powered by SMF 1.1.5 | SMF © 2006-2008, Simple Machines LLC
Joomla Bridge by JoomlaHacks.com
Valid XHTML 1.0! Valid CSS!
Page created in 0.056 seconds with 24 queries.
 
Polls
Best for daily desktop use:
 
Support EH-Net
chicagocon2008f_125x200banner.jpg
ChicagoCon 2008f


Support EH-Net by
Buying all of your
Amazon items using
the search bar above.

cbtnuggets_logo_125.jpg
Try CBT Nuggets Free!
Recent Forum Topics
Vote For EH-Net

progenic.com
Click here to Vote!

Sadikhov.com
Top IT Cert Sites

binarica.com
Binarica Logo

Add to Technorati Favorites
technorati fave

chicagocon2008f_125x200banner.jpg
ChicagoCon 2008f
 
         
Advertisement

© 2008 The Ethical Hacker Network
Joomla! is Free Software released under the GNU/GPL License.