Virus Bulletin VB100 Awards – December 2012

Virus Bulletin has released  the results of  their latest VB100 testing.  Many, but not all of the products tested were 2013 versions.    Symantec, Avira, Webroot (this makes one year) and Trend Micro (several years for Trend) were not part of the test.  Sophos, Kaspersky, Avast, AVG Technologies, and ESET were.

About a third of the products tested failed to receive a VB100 award this time.  A cone of shame to the following –  BeyondTrust, Commtouch, ESTsoft, FileMedic (formerly MKS) Filseclab, K7 Computing, Norman, Roboscan, Total Defense Consumer, VIRUSfighter Pro, and Zeobit.

A summary of the full  results is at the link below. Congratulations to those receiving the VB100.   You can  buy the full test results or subscribe to Virus Bulletin to obtain them. 

 https://www.virusbtn.com/vb100/archive/test?recent=1

Results from this should be looked at in conjunction with tests from other test groups such as www.av-test.org    and www.av-comparatives.org .  In addition,   it’s not how the company has performed on the VB100 test over years.  It’s only the last couple of years that are relevant.   When looking at a company’s award page, verify which product was tested.

VB100 Test Methodology

The purpose of the VB100 comparative is to provide insight into the relative performance of the solutions taking part in the tests, covering as wide a range of areas as possible within the limitations of time and available resources.  More details are available at

http://www.virusbtn.com/vb100/about/methodology.xml

UK based Virus Bulletin started in 1989.  They provide PC users with a regular source of intelligence about computer viruses, their prevention, detection, and removal, and how to recover programs and data following an attack.  The Virus Bulletin website is at www.virusbtn.com 

NSS Releases AV/EPP Comparative Analysis Report

NSS Labs  has released an AV/EPP Comparative Analysis of thirteen vendors products (Endpoint Protection Product).  The vendors in the analysis include Avast, AVG Technologies, Avira, ESET, F-Secure, Kaspersky, McAfee, Microsoft, Norman, Norton, Panda, Total Defense, and Trend Micro.  

This is an interesting report.  The only downside is that many of the products  are 2012 releases.  The goal of this eleven-page report was to test these vendors endpoint security suites (no free products other than Microsoft’s) effectiveness in protecting Windows computers against exploits. 

According  to  NSS, all the vulnerabilities exploited during the test have been publicly available for months (and years, even).  Tests included:

• HTTP Evasion & Compression
• HTML Obfuscation
• Payload Encoding
• File Compressors (download)
• Executable Packers (download)
• Executable Packers (execute)
• Layered Evasions

 Only three companies had an overall score of over 90% with Microsoft scoring the only 100%. The others over 90% were ESET and Kaspersky.  The highest score from a “free” vendor was Avira with 89%.  Again, this was their Internet Security suite.  Hall of Shame vendors trailing the others with 71%;  F-Secure, Total Defense, and Trend Micro. 

Eight vendors had a File Compression Block Rate of 0%.  Ouch.  NSS felt that the issue had to do with products allowing the download of compressed payloads without checking the content.  The other problem was with Executable Packers (download) with only five vendors scoring 100%.  NSS pointed out in the report  that most current browsers help block some malicious downloads.  Also, a default configuration that doesn’t inspect compressed downloads is one of those tradeoff things between performance and security.  Companies would never choose the default to be in favor of performance, though ;).

This report is well worth downloading.  People may also want to look at the NSS 2012 Exploit Protection Comparative Analysis Report.

As always, you can’t judge the quality of an internet security suite by the number of Facebook fans the vendor has nor by the number of likes on the vendor’s Facebook fan page. 

To learn more about NSS Labs, go to www.nsslabs.com