What to look for in social malware defense

A study by cybersecurity research firm NSS Labs found little difference in the overall performance of five popular products that promise protection against socially engineered malware (SEM), such as fake system upgrades as well as fake anti-virus and trojanized applications. So how can agencies choose the best protection?

“Socially engineered malware is one of the biggest threats today – people getting tricked into going to sites and downloading,” said Randy Abrams, research director at NSS Labs. “There’s a variety of social engineering techniques and payloads, and so we’re testing how well the products protect against social engineering.”

Although significant improvements have been made in endpoint protection, NSS recommends organizations look for products that provide consistent protection and rapid response to socially engineered malware threats.

How NSS tested

Between Dec. 15, 2013, and Jan. 19, Abrams and his team continuously tested anti-SEM tools, including Bitdefender’s Endpoint Security, Fortinet’s FortiClient Endpoint Protection, McAfee’s VirusScan Enterprise and AntiSpyware Enterprise, Symantec’s Endpoint Protection and Trend Micro’s Office Scan. The tests were conducted on Microsoft Windows 7 Enterprise Service Pack 1 32-bit with Windows Defender disabled and Internet Explorer with smart screen filter disabled.

NSS looked at the products’ ability to stop malware at two points: on download and on execution. The team also compared how the products performed against the most common threats: SEM, exploit and phishing.

“We use a variety of Web crawlers so we’re getting live, socially engineered malware on an ongoing, real-time basis. We’ll find something and continue testing as long as it’s reachable on the Internet,” Abrams said.

“This is not a single-point-in-time test. This is an ongoing test for a few weeks, so we’re able to see what the real-world performance is over time instead of a single snapshot,” he said.

At the end of the first seven days, the average  rate of SEM blocking ranged from 92 percent by Fortinet to 100 percent by McAfee. After seven days, the combined block-on-download protection rates grew closer:

• Trend Micro stopped 98 percent of SEM.
• Symantec came in at 98.80 percent.
• Fortinet bumped up to 99.40 percent.
• Bitdefender went to 99.60 percent.
• McAfee held steady at 100 percent.

Differentiators

Testing at the zero hour revealed combined download- and execution-block rates of 88.5 percent for Bitdefender and Fortinet on the low side and 99.8 percent for McAfee, according to the report. Zero-hour refers to the time at which a new vulnerability is made known for the first time.

“All of them at zero hour had measurably less protection than they did after a day, but after one day, they were doing pretty well,” Abrams said. “The lowest-performing products had significantly improved, and by two days, they were actually offering pretty high levels of protection. When you’ve got products doing as well as they did, that zero-hour protection starts to become the differentiator.”

Because a SEM moves quickly among URLs as affected ones are discovered and blocked, the faster an end-point product can protect against SEM, the faster protection can be provided against all malicious URLs containing the SEM, the report said.

McAfee’s product won the race with an average time of 31 seconds to add protection, but Symantec’s solution was also notable, with an average time of 15 minutes and a 100 percent average SEM protection rate.

“It was really surprising to see how well these products are doing,” Abrams said. “When you compare them to past performance, they’ve really brought the performance up a notch.”

NSS typically chooses products to test based on market share and what NSS subscribers are interested in, although it also looks at technology that it thinks holds promise, Abrams said. In this case, McAfee, Symantec and Trend Micro were the big players, at least in the United States, while Bitdefender is gaining traction in Europe, and Fortinet is branching out from its networks focus to include end point protection.

The test also provides a good baseline for enterprise endpoint protection needed by organizations, Abrams said, but it would be inaccurate to say the results showed total protection.

“These were real-world samples. However, we don’t know what we don’t know,” Abrams said. “McAfee came out with 100 percent block-on-download, and we know that none of the products are perfect, but we don’t know how imperfect they are.”

Some researchers have estimated that products detect less than 70 percent of what’s out there, but they’re often referring only to new threats without saying that they work against thousands of old ones that are still being used, Abrams added.