12 suites get 'F'; Only Symantec's detects more than 3% of real attacks
(Computerworld) Security software suites don't protect users from real-world exploits, a bug-tracking company charged today after launching 300 test attacks against a dozen programs, including popular software from McAfee Inc., Symantec Corp. and Trend Micro Inc.
"The Internet security suites are marketing themselves as the one solution users need to be safe online," said Thomas Kristensen, chief technology officer at Secunia Inc., which ran the tests. "In our opinion, that's just not true."
Secunia sicced hundreds of vulnerability exploits -- some proof-of-concept code that triggered a vulnerability, others that included payloads -- on 12 suites, including Symantec's Norton Internet Security 2009, Microsoft Corp.'s Windows Live OneCare, AVG Technologies' Internet Security 8.0 and McAfee's Internet Security Suite 2009. The attack code was delivered by files of various formats, including Office documents and malformed images, and by malicious Web sites that triggered browser and ActiveX bugs. The target was a Windows XP SP2 machine missing "certain patches and with a number of vulnerable programs," according to Secunia.
While Symantec's Norton Internet Security 2009 took top honors, it detected only 64 out of 300 exploits, or just 21% of the total. Even so, that beat most rivals by substantial margins. Trend Micro's Internet Security 2008, for example, detected only 2.3% of the exploits, while McAfee's Internet Security Suite 2009 identified 2% and Microsoft's OneCare spotted just 1.8% of the exploits.
More: http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9117042&source=NLT_VVR&nlid=37
(Computerworld) Security software suites don't protect users from real-world exploits, a bug-tracking company charged today after launching 300 test attacks against a dozen programs, including popular software from McAfee Inc., Symantec Corp. and Trend Micro Inc.
"The Internet security suites are marketing themselves as the one solution users need to be safe online," said Thomas Kristensen, chief technology officer at Secunia Inc., which ran the tests. "In our opinion, that's just not true."
Secunia sicced hundreds of vulnerability exploits -- some proof-of-concept code that triggered a vulnerability, others that included payloads -- on 12 suites, including Symantec's Norton Internet Security 2009, Microsoft Corp.'s Windows Live OneCare, AVG Technologies' Internet Security 8.0 and McAfee's Internet Security Suite 2009. The attack code was delivered by files of various formats, including Office documents and malformed images, and by malicious Web sites that triggered browser and ActiveX bugs. The target was a Windows XP SP2 machine missing "certain patches and with a number of vulnerable programs," according to Secunia.
While Symantec's Norton Internet Security 2009 took top honors, it detected only 64 out of 300 exploits, or just 21% of the total. Even so, that beat most rivals by substantial margins. Trend Micro's Internet Security 2008, for example, detected only 2.3% of the exploits, while McAfee's Internet Security Suite 2009 identified 2% and Microsoft's OneCare spotted just 1.8% of the exploits.
More: http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9117042&source=NLT_VVR&nlid=37
