Category Archives: Avira

Avira

Avira

Avira: Best Antivirus for Windows

Leave a comment

AV-TEST certification earned with perfect score

Avira earned a perfect 18/18 score, topping all three major categories of testing:

  • To evaluate the protection against malware infections (such as viruses, worms or Trojan horses), the testers took into consideration the protection against 0-day malware attacks, inclusive of web and e-mail threats (Real-World Testing) but also the detection of widespread and prevalent malware discovered in the last 4 weeks.
  • Performance was under the scope as well with the average impact of the security product on the speed of the computer in daily use cases: visiting websites, downloading software, installing and running programs or copying data.
  • Finally, the testers focused on the usability of the products by counting disruptions caused by false positives and false warning messages (false warnings or blockages when visiting websites, false detections of legitimate software as malware during a system scan and false warnings or blockages of certain actions carried out whilst installing and using legitimate software).

AV-TEST results

The results show an increase of 1.5 points compared to the last round of testing, evolution observed by Journalists as well. Avira becomes the best antivirus for Windows, offering users protection, performance and usability at the highest level.

Great level of Self-Protection

This time, AV-Test experts ran also a test to evaluate the self-protection of 32 security solutions for both consumers and businesses. The goal was to establish if these applications are adopting protection technologies like DEP (Data Execution Prevention) and ASLR (Address Space Layout Randomization) for their own use and how well they perform from this point of view. Avira occupied a top position in this area as well, with an average use of 99.7% in 32 and 64 bit versions.

To understand the importance of the self-protection factor in Antivirus Software, it’s useful to know that DEP uses CPU features to mark certain areas of the device’s memory as not executable while ASLR randomly locates executable code at load time. DEP and ASLR can thus protect against buffer overflow exploits and attempts to execute privileged code at known locations in memory.

AV-TEST self-protection results

We recommend Larry Seltzer’s analysis for a more in-depth understanding of the AV-TEST Self-Protection Results.

Your security: a long term commitment for our experts

Every successful test and earned certification shows how our antivirus is continuously evolving to face the digital challenges of today. It is a proof of strength and commitment of our teams towards millions of customers who trust us to secure their devices. Our experts will keep applying the best methods to discover, classify and detect new malicious applications until online safety becomes the natural state of things.

The post Avira: Best Antivirus for Windows appeared first on Avira Blog.

Avira

What a great year for Avira Antivirus

Leave a comment

 

A new VB100 Award from Virus Bulletin

Avira AntiVir Personal and Avira AntiVir Professional have successfully obtained a new VB100 Award from Virus Bulletin contributing to an uninterrupted row of successes for both our paid and free solutions. The Avira Free Antivirus was complimented for being fast and reliable, offering great detection to its users. All of these features helped our free antivirus edition maintain an excellent record of passes with 0 fails registered by the Virus Bulletin testing. Our Professional Security Antivirus was also praised on its good scanning speeds, very little lag time and low resource consumption. One thing is for sure, we can all be proud of an impeccable track record.

Avira Antivirus for Android, another great score from AV-TEST

In 2014, our free Avira Antivirus for Android has also earned an awesome rating in the test conducted by the AV-TEST security institute. It was the fifth time in a row. This success was guaranteed by an amazing detection rate on the Android malware test set, not missing a single malicious app. Zero false positives and no hiccups in any of the benchmarks also granted us another perfect score of 6 out of 6 possible points for usability. Other product features like Anti-Theft and call blocking brought us some points as well.

Enhanced real-world protection according to AV-Comparatives

All throughout the year, we were also proud to announce outstanding scores received by our antivirus in AV-Comparatives tests (March-June, August, September, October). Check out the results from all of these dynamic tests.

We’re working really hard on getting excellent results also next year in all upcoming tests. We consider it part of our duty, as one of the pioneers for the most important innovations in the Antivirus industry.

The post What a great year for Avira Antivirus appeared first on Avira Blog.

Avira

AT&T Stops Attaching Tracking Files to Mobiles

Leave a comment

Wait… AT&T was tracking you with hidden codes?

The secret codes in tracking files, known as ‘header enrichment,’ consist of strings of numbers and letters that are appended to all data traffic that is transmitted from the phone. The header enrichment codes are used to track customers’ website visits and also which apps they use in order to provide advertisers with targeting information. The codes don’t contain personal identity information per se, but because they are unique to each customer and are transmitted along with any personal identity information that a customer voluntarily provides – such as name, address or phone number – together they create a sort of digital fingerprint that could be exploited.

AT&T said it ended the tracking files because its test project has ended. But competing mobile operator Verizon has a similar tracking number system in place, which Twitter’s mobile advertising division uses to target ads.

If you want to know if your mobile carrier is tracking your device, visit this page on ProPublica.org (go there from your mobile device) and click on the box that says ‘Does Your Phone Company Track You?’

Header enrichment technology was developed because traditional web cookies are a challenge for tracking apps on smartphones and tablets. The Open Mobile Alliance adopted an industry standard for injecting the codes in 2010. In response, Google has proposed an alternative Web protocol that prevents such header injections which, of course, the mobile industry is lobbying to defeat.

Avira’s security software for Android and iOS can scan your apps and emails for malware, and also block Trojans and stop Ransomware from restricting access to your data. Check out Avira Mobile Security for iOS or Avira Antivirus Security for Android for free protection.

 

The post AT&T Stops Attaching Tracking Files to Mobiles appeared first on Avira Blog.

Avira

How to cure Location Fatigue

Leave a comment

An overwhelming flood of apps that used location data became available, and down to this day, new ones are continuing to be launched all the time.

While there’s still interest in apps that use location data, some of that enthusiasm has started to die down. Quite frankly, many users are suffering from Location Fatigue. Since most users were once all too willing to share their location with anyone and anything, app developers have assumed that this is still the case and continue to use location data to the point that it feels like almost every app you download wants to access your location for some odd reason, even when it’s totally not required.

As you can imagine, this reality brings a host of privacy concerns with it. Not only might social apps share your location with your friends or possibly strangers, but other apps could even use that data for advertising purposes. When an app uses your location in a way that you understand and derive benefits from, then that can be a great experience, but having your location data observed and shared just because it can be done doesn’t always lead to a great user experience, especially when it’s being done in a way that’s not transparent.

If you look at the location settings in your smartphone right now, you’ll probably be shocked by how many apps have location functionality. Take a good look at your list of apps and decide which ones you actually want to be able to see where you are at any given moment. Additionally, whenever you download a new app, think for a moment about the location data that it might be accumulating and what the purpose of it is.

There are still plenty of smartphone users who don’t have a care in the world about the location data that their apps have access to, but if privacy is important to you, then you might want to make your location data available to apps on more of a need-to-know basis.

The post How to cure Location Fatigue appeared first on Avira Blog.

Avira

Cuckoo Sandbox vs. Reality

Leave a comment

Problem

We get several hundred thousand potential malware samples every day, a number that increased when we began to detect even more by developing our Avira Protection Cloud technology. In the Avira Protection Lab, one of our primary tasks is to classify the samples and analyse their behavior, either for inclusion in our virus database or for repair. With this incredible amount of samples, it is of course impossible to do it all manually.

Solution

cuckoo

Our solution was to build a scalable system with detailed information about sample behaviors and functionalities. This system needed to be fully automated and reliable. To achieve that, one of the tools we are now using is Cuckoo Sandbox.

About: Cuckoo Sandbox

Although different types of “Sandbox” tools exist, Cuckoo is uniquely an “analysis sandbox” or “automated malware analysis system” — i.e. a system built to analyse the behavior of malware by running it in a fake Windows OS and monitoring it. If you saw the film “The Matrix” you should have a pretty good idea of it: a fake reality where the protagonists interact with an environment — and each other — isolated from reality (or, in the case of the sandbox, the real computer).

This kind of sandbox is normally sold as an appliance for companies with enhanced security requirements. A local specialist then investigates the results and classifies the analysed samples.

I discovered Cuckoo Sandbox while looking for a tool to automate experiments for the ITES research project. Cuckoo Sandbox is Open Source: http://cuckoosandbox.org/

Cuckoo Features

The malware-monitoring results go into large log files (6 MB on average per sample, but not uncommon to reach 100 MB) containing detailed descriptions of the malware behaviors.

The data we collect using Cuckoo comes from the User Space monitor and includes:

  • API logs
  • Network logs
  • Static data for the sample and dropped files
  • Screenshots
  • System manipulation:  Files/Registry/Mutexes/Services
  • Started processes and their relationship to the sample

With this information, it’s possible to classify the samples by their behavior. It’s also enough information to create a malware description and repair most of the malware infections.

Cuckoo vs. AV reality

We started to interact with Cuckoo two years ago. Even back in the ‘old days’, it was a good tool for sporadic malware analysis. But when it comes to research projects and AV use we have some special needs. This is why I’ve enhanced the following:

  • Stability: We have several servers running 24 hours a day, crunching through about 200 samples per hour. If Cuckoo crashes once in 1000 samples, we would have lots of maintenance to do. So bug fixing was one of my main tasks.
  • Performance: Reducing the amount of servers needed is essential. Better performance means less hardware running. The more hardware you need, the more expensive it gets, but even worse: It can fail and require maintenance. Reducing servers is reducing failures. By improving the performance, I also reduced latency, which means we get our results faster.
  • Classification: The main task of our Virus Lab is to classify samples at least into the categories good/bad. To be able to have that done automatically by Cuckoo, I had do add some features to the signatures (detection rules). The most essential feature was “Meta Signatures” — i.e. signatures that run at the end and combine several “weaker” signatures into a classification.
  • Data collection: Cuckoo API logs have a specific view: The commands the sample sends to the Windows API. With some processing, it’s possible to get a new view that is more interesting for us: Which system objects have been manipulated… and how? That is the “enhanced behavior” part of the Cuckoo logs I created. It contains Registry keys, Services, Files, … and the way they got modified. That can be “deleted”, “read”, “stopped” (for services) and more. With that knowledge, repair and automated generation of a description is just one step away.
  • Other Monitor: An essential part of the ITES project was to test several different sensors. While Cuckoo normally monitors malware in the User Space, the open source tool Volatility is able to take a memory snapshot of the OS and scan for anomalies. Its speciallity is identifying DKOM (Direct Kernel Object Manipulation https://en.wikipedia.org/wiki/Direct_kernel_object_manipulation), which are normally performed by rootkits. Combining Cuckoo and Volatility adds a rootkit scanning feature to Cuckoo. 

Weaknesses

Malware can detect “Glitches in the Matrix”. When the malware detects it is running in a simulated environment, it can show non-suspicious behavior or just stop running. Detection of this simulated environment is called “Anti-VM” technology (VM = virtual machine) and it’s been common for a few years now (more on that in another post).

Hooking (and it’s weaknesses)

The core part of the Cuckoo system is to monitor the behavior of suspicious processes. To achieve that, a DLL is injected into the memory of the processes to monitor. The DLL changes the entry commands of selected APIs in DLLs called by the process to first log that they have been called and then continue to jump back to their original functionality.

For more information, see:

https://github.com/jbremer/monitor

Some weaknesses:

  • A program can inspect it’s own process space and overwrite the hooks with the original commands. Removing the logging and going stealth.
  • Or the program can use hooks itself, accidentially overwrite the Cuckoo hooks with own hooks and crash horribly.

Those are core weaknesses of the hooking method. To cover those scenarios, Cuckoo now supports a check if the hooking is still in place and untouched.

Results from the Weaknesses

The impact of these weaknesses can be reduced, but never to zero. So we have to accept:

  • It is not possible to flag a software as benign just because we did not see any malicious behavior
  • Always combine behavior classification with other classification technology

How we use it

Cuckoo Sandbox has officially been added to our toolset in the Virus Lab. Suspicious and unknown samples will be scanned by Cuckoo and the results used for classification. We also take the logs to create experimental repair routines or descriptions. We are just beginning to use it and find more use cases for it. For Avira engineers, there are interesting times ahead.

My first virus lab

On http://malwr.com you can find a live Cuckoo system. Sometimes it does not accept new samples for classification due to heavy load, but at least the historical reports will give you a good impression of the information Cuckoo provides. Cuckoosandbox being open source, you can install it at home. But my advice: Do not play with malware at home if you don’t know exactly what you’re doing.

And remember: Use the Avira Protection Cloud to benefit from Behavior Detection and other cool tools without needing to install them.

 
Sponsored_by_Federal_Ministry_of_Education_and_Research
 

And part of the ITES project:

iTES_farb

For Science !

Thorsten Sick

The post Cuckoo Sandbox vs. Reality appeared first on Avira Blog.

Avira

Evolutionary Antivirus

Leave a comment

First evolution

The technologies antivirus companies use to detect malware evolve over time to meet the ever-changing threat landscape. The first evolution was signature-based detection, which had a lot of good properties. Signature-based malware detection extracts common byte sequences — also called signatures — from multiple files of the same malware variant. If these sequences also match another file, it is detected as being malicious. One drawback of signatures is that often a small number of differing bytes leads to the signature not matching anymore. As a result, polymorphic malware was created, which always has completely different sequences of bytes, and therefore malicious sequences could not be found any more. In many cases signatures are still very useful and especially the time to release a signature is very short.

Second evolution

The second evolution was generic detection, which was able to easily handle most polymorphic files. By manually researching malicious files in depth, file properties could be identified, which then in combination could be used not only to detect polymorphic files but, in general, are so powerful as to detect whole families of files. Often, generic detection uses a rule-based system. An example of a generic rule with the capability to detect malicious files writing to the Windows folder could be very simplified:

file_size < 5kb & file_writes_to_windows_folder & file_not_signed

Generic detection is in general very powerful and can also incorporate the program’s behavior. While this kind of detection is also old, it is still widely used. The reason why generic detection loses its relevance is not a matter of quality but a matter of quantity. Avira receives hundreds of thousands of potentially malicious files every day. The time to create one rule manually takes from 5 minutes to two hours, and probably thousands of rules have to be created per day. While it was possible in the past to write generic rules for the malware files received each day, it is not possible anymore.

Third (current) evolution

Fully automated learning systems — the third (current) evolution — try to combine the good properties of the first two evolutions, while avoiding their drawbacks. Rather than creating rules, learning systems often learn the difference between good stuff and malware files based on distances. In simple words, this means that if the learning system learned that a specific region only consists of malicious files and an unknown file has a very small distance to the files within that region, it will output that the probability of the unknown file being malicious is very high. This is equal to a human saying: “This file looks very similar to something that I have seen before”.

Five years ago, Avira started more seriously investigating these systems. In March 2010, my colleague Matthias Ollig and I showed in our master’s thesis, with the title “Recognition of malware by applying techniques of machine learning using static and behavior-based features,” that such a system is not just possible but that it can also deliver a high degree of automatism.

In our fight against malware, only one thing really counts. Speed. If a new malicious file is inserted into the learning system and it is well designed, it does not just detect this one file but the whole malware family — within minutes.

Over the last four years, Avira management have made several big investments in the automated learning system with the internal name NightVision. NightVision has ~8TB of RAM, ~750 CPU cores and ~50 CUDA capable GPUs. Due to these investments, NightVision now not only protects our paying customers but also all of our free-version customers around the globe. By having NightVision in place, the antivirus researchers can now put their attention towards the most important thing: Analyzing the most current daily threats.

The post Evolutionary Antivirus appeared first on Avira Blog.

Avira

Shortcut Express to Infected & Phishing Websites

Leave a comment

URL shorteners are a relatively new Internet service. As many social services on the Internet impose character limitations (Twitter is a prime example), these URL are very practical…

For example, you’d spend 64 characters to point to Wiki’s article about URL shorteners: http://en.wikipedia.org/wiki/URL_shortening. With an URL shortener, you can cut that down to 16 characters: http://bit.ly/c1htE.

URL shorteners, however, can be used to hide the real target of a link. Cyber criminals appreciate this “feature” – and use it to hide links to phishing or infected websites. These services usually have terms and conditions comparable to TinyURL:

“TinyURL was created as a free service to make posting long URLs easier, and may only be used for actual URLs. Using it for spamming or illegal purposes is forbidden and any such use will result in the TinyURL being disabled and you may be reported to all ISPs involved and to the proper governmental agencies. This service is provided without warranty of any kind.”

Few seem to care about these terms, which are regularly flaunted in the pursuit of profit. Happily, however, certain services have started to filter shortened links through special services, even if this has so far failed to stem the flow of shortened SPAM URLs.

Below are statistics with the percentage of malicious links identified on 22 popular URL shortener services:

Phishing

Malware
# Shortener % Shortener %
1 tinyurl.com 41.30 k.im 27.87
2 bit.ly 15.29 notlong.com 27.05
3 r2me.com 12.04 tinyurl.com 18.85
4 snipurl.com 7.16 cli.gs 7.38
5 lu.mu 6.50 bit.ly 7.38
6 doiop.com 4.52 doiop.com 4.10
7 notlong.com 3.55 ad.ag 2.46
8 is.gd 1.93 is.gd 1.64
9 tiny.cc 1.81 tr.im 0.82
10 sn.im 1.69 snipurl.com 0.82
11 k.im 0.96 ow.ly 0.82
12 shorl.com 0.66 dwarfURL.com 0.82
13 tr.im 0.60 zi.ma 0.00
14 goo.gl 0.54 u.nu 0.00
15 ow.ly 0.48 tiny.cc 0.00
16 cli.gs 0.30 sn.im 0.00
17 u.nu 0.18 shorl.com 0.00
18 moourl.com 0.18 r2me.com 0.00
19 idek.net 0.12 moourl.com 0.00
20 dwarfURL.com 0.12 lu.mu 0.00
21 zi.ma 0.06 idek.net 0.00
22 ad.ag 0.00 goo.gl 0.00

Source: Avira Virus Lab, taken from the month of July, 2010.

Shortened Links Can Mask A Threat

To give you an example, would you click on the following link?

www.ssl-albion-netbank.com/143.027.902

Probably not… The bank’s made-up name and use of random numbers would rightly give you misgivings. However, under a shortened guise – http://goo.gl/mDNuMg – one would not know that it’s a phishing website (in this case, a dead link).

Recommendations:

The bottom line is that if you can, avoid clicking on shortened URL links. If you do need to click on shortened links, copy and paste the link into a link lengthener – such as http://longurl.org/, which displays the full version of the links without having to click on it (exists also as a browser extension for Chrome and Firefox).

Finally, we recommend you equip yourself with Avira’s free Browser Safety extension, also for Chrome and Firefox, which blocks infected websites before they load. To learn more about Browser Safety, visit Avira’s website here: https://www.avira.com/en/avira-browser-safety

The post Shortcut Express to Infected & Phishing Websites appeared first on Avira Blog.

Avira

Shortcut Express to Infected & Phishing Websites

Leave a comment

URL shorteners are a relatively new Internet service. As many social services on the Internet impose character limitations (Twitter is a prime example), these URL are very practical…

For example, you’d spend 64 characters to point to Wiki’s article about URL shorteners: http://en.wikipedia.org/wiki/URL_shortening. With an URL shortener, you can cut that down to 16 characters: http://bit.ly/c1htE.

URL shorteners, however, can be used to hide the real target of a link. Cyber criminals appreciate this “feature” – and use it to hide links to phishing or infected websites. These services usually have terms and conditions comparable to TinyURL:

“TinyURL was created as a free service to make posting long URLs easier, and may only be used for actual URLs. Using it for spamming or illegal purposes is forbidden and any such use will result in the TinyURL being disabled and you may be reported to all ISPs involved and to the proper governmental agencies. This service is provided without warranty of any kind.”

Few seem to care about these terms, which are regularly flaunted in the pursuit of profit. Happily, however, certain services have started to filter shortened links through special services, even if this has so far failed to stem the flow of shortened SPAM URLs.

Below are statistics with the percentage of malicious links identified on 22 popular URL shortener services:

Phishing

Malware
# Shortener % Shortener %
1 tinyurl.com 41.30 k.im 27.87
2 bit.ly 15.29 notlong.com 27.05
3 r2me.com 12.04 tinyurl.com 18.85
4 snipurl.com 7.16 cli.gs 7.38
5 lu.mu 6.50 bit.ly 7.38
6 doiop.com 4.52 doiop.com 4.10
7 notlong.com 3.55 ad.ag 2.46
8 is.gd 1.93 is.gd 1.64
9 tiny.cc 1.81 tr.im 0.82
10 sn.im 1.69 snipurl.com 0.82
11 k.im 0.96 ow.ly 0.82
12 shorl.com 0.66 dwarfURL.com 0.82
13 tr.im 0.60 zi.ma 0.00
14 goo.gl 0.54 u.nu 0.00
15 ow.ly 0.48 tiny.cc 0.00
16 cli.gs 0.30 sn.im 0.00
17 u.nu 0.18 shorl.com 0.00
18 moourl.com 0.18 r2me.com 0.00
19 idek.net 0.12 moourl.com 0.00
20 dwarfURL.com 0.12 lu.mu 0.00
21 zi.ma 0.06 idek.net 0.00
22 ad.ag 0.00 goo.gl 0.00

Source: Avira Virus Lab, taken from the month of July, 2010.

Shortened Links Can Mask A Threat

To give you an example, would you click on the following link?

www.ssl-albion-netbank.com/143.027.902

Probably not… The bank’s made-up name and use of random numbers would rightly give you misgivings. However, under a shortened guise – http://goo.gl/mDNuMg – one would not know that it’s a phishing website (in this case, a dead link).

Recommendations:

The bottom line is that if you can, avoid clicking on shortened URL links. If you do need to click on shortened links, copy and paste the link into a link lengthener – such as http://longurl.org/, which displays the full version of the links without having to click on it (exists also as a browser extension for Chrome and Firefox).

Finally, we recommend you equip yourself with Avira’s free Browser Safety extension, also for Chrome and Firefox, which blocks infected websites before they load. To learn more about Browser Safety, visit Avira’s website here: https://www.avira.com/en/avira-browser-safety

The post Shortcut Express to Infected & Phishing Websites appeared first on Avira Blog.