Jump to content

peteyt

Most Valued Members
  • Posts

    2,147
  • Joined

  • Last visited

  • Days Won

    41

Posts posted by peteyt

  1. Microsoft has recently fixed a bug apparently discovered by a division inside the UK British Intellegence organisation GCHQ.

    The bug was in the Malware Protection Engine which is used in products such as Windows Defender, Microsoft Security Essentials, Microsoft Endpoint Protection, and Windows Intune Endpoint Protection. It was found on all currently supported Windows versions, which are Windows 7 and later.

    What is interesting is a that a file designed to abuse the bug apparently just needed to be scanned to be able to possibly take control of the system. The issue being by default programs such as Windows Defender would have to scan the file trying to identify if it was a virus. This normal and important procedure would actually appear to do more harm than good in this case.

    The bug is apparently a remote control execution vulnerability. The products do not scan a specially crafted file properly leading to memory corruption. This could allow an attacker to execute arbitrary code to gain control of the system

    https://www.bleepingcomputer.com/news/security/microsoft-fixes-malware-protection-engine-bug-discovered-by-british-intelligence/

  2. 1 hour ago, Marcos said:

    The years in the version number were just for the marketing purposes in some countries. In Slovakia we never named them version 2015, 2016, etc. but we've always used the internal number (v9, v10, v11,...) for reference.  Consumer products are now provided more like as a service than a product with a new version released each year. It's similar to Windows OS; in the past Microsoft had Windows 95, 98, Windows XP, etc. and now has Windows 10 with regular updates and bigger OS updates at times, such as the last Falls Creator Update.

    Does that mean there wont be a 12 and like windows it will be like 11.1, 11.2 etc. Also if your trying to now avoid a version number could this be harder when identifying the users version as i noticed it isnt displayed at the top in the homepage now (obiously its in the update area just isnt as clear now)

  3. 1 hour ago, Wolf Igmc4 said:

    Add a behavior blocker, based on the reputation system of Eset. Yes, I said this some time ago, but if Eset don't add it, in the future, this will be a big problem. 

    It has been asked a lot but I don't think we will see it. The issue eset has is choice e.g. what should happen if something new and unknown turns up, could simply be an update e.g. a windows update, but if eset doesn't have any reputation for the files it will have to ask the user and it seems like they want to avoid this in case the user clicks the wrong thing e.g. allows or blocks

  4. 9 hours ago, BobU said:

    How very intersting. Why will it not update from my version of 10.1.235.0??? It tells me it is up to date!

    While the newer versions are generally safe and also go through beta testing in case something is discovered later on newer updates are slowly rolled out. Generally the auto update tool start to show the update a few months after release. You can always download the new version manually though.

    There is a newsletter you can sign up to on here https://support.eset.com/news/ this will email you when any product is updated

  5. 1 hour ago, itman said:

    The solution to this issue is easy - just don't use Chrome. If you were to tally up the browser with the most issues to date for Eset users, Chrome wins hands down.

    The solution to Google's baloney is for people to stop using Chrome. They will get the message loud and clear.

    A lot of people use it though. As i have an android phone using chrome is handy for its easy sync.

  6. 2 hours ago, Marcos said:

    You are talking about the Application control feature. The role of a firewall is to monitor network traffic and block the malicious or unwanted communication. It's not a role of the firewall to prevent applications from running as it's HIPS which does that.

    Blocking any application that is not popular and is new could be disastrous because if a popular application updates, we would block it for several hours until it becomes widespread and popular. Also by default users should not be prompted for an action and all decisions would need to be made automatically in a smart way. Although we currently don't support Application control (except blocking apps via HIPS rules), we use an advanced firewall with IDS support and Network protection integrated which enabled us to prevent the infamous Wannacry from exploiting SMB1 vulnerabilities on unpatched systems. ESET was the only one or one of 2 vendors to have protected against it proactively. The same also goes for HIPS. It's a module that interacts with real-time protection, Advanced Memory Scanner, Exploit Blocker and Anti-ransomware protection to ensure maximum protection against new borne threats.

    For more information about ESET technology, please refer to https://www.eset.com/int/about/technology/.

    Is it true eset are thinking of adding an application control module and if so when is this planned for?

  7. On 19/05/2017 at 4:30 PM, itman said:

    It seems this is going ahead https://blog.chromium.org/2017/11/reducing-chrome-crashes-caused-by-third.html 

    Apparently third-party  applications that inject code into chrome are 15% more likely to cause crashes and there are modern more safer ways this can be achieved e.g. via Chrome extensions and Native Messaging. 

    This is being introduced in three stages:

    April 2018 - Chrome version 66 will start alerting users if a third-party application causes a crash with Chrome apparently  guiding the user to either update or remove the application

    July 2018 - Chrome version 68 will begin blocking third-party applications from injecting into chrome processes. If this blocking prevents chrome from starting, Chrome will restart and allow the injection, but show a warning guiding the user to remove the application.

    January  2019 - Chrome version 72 will remove the warnings and always block code injection.

    Not sure if or how it will effect Eset? Not sure if @Marcos can answer this e.g. will work need done on the stuff that blocks scripts?

    I should add that Microsoft-signed code, accessibility software, and IME software will not be affected by these changes

  8. 7 hours ago, SeasonPast said:

    these companies must think better about their security

    Response time is also crucial as I mentioned briefly a bit back. Many companies believe they are protected enough so when a cyber attack happens they are not ready. No security solution is ever 100 percent so companies need to think of not if they will get attacked but when and be ready for it.

  9. 23 minutes ago, foneil said:

    Yeah, I should also point out that there IS a difference between the contact forms US and INT (the location where the emails go to):

    https://www.eset.com/us/support/contact/
    https://www.eset.com/int/support/contact/

    Those go to different places depending on your location -- usually, I am speaking about US support because that's where I am based and what I have any influence over. We (ESET as a whole) are working to align the global partner support better. 

    For FPs, the "send a reply notification" is something we've been talking about as well. 

    I'm UK based so not sure what the support is like but I think the false positive email is the standard US one. I've noticed people on here also posting samples on the forum asking if eset should or shouldn't detect as they have received nothing from the false positive team.

    What about having an online ticket system for everything where people can login with their account and see replies, add more details updates etc. With the option to allow email alerts for updates to the tickets? 

  10. 2 hours ago, foneil said:

    We (the ESET Knowledgebase team) work with Technical Support and our Web Team on issues like this, but don't have final authority about what content goes where. 

    We are also trying new things and evaluating how we can best support our users. I can tell you that there is a change in deliberation now related to the Live Chat link and it's location/prominence on the main eset.com website. 

    For what we can control (the KB), if you search "Contact" on support.eset.com, the options for the phone numbers and the live chat will display. 

    2017-11-29_9-32-47.png

    To be transparent, we prefer that users contact us using the email contact form because it's easier to track issues and follow-up with content to help other users, and the turnaround time for emails is usually less than an hour, and if more f2f help is needed, the Tech Support Agent will send a link to the helpus Live Chat anyway. 

    Long story short (too late!), we are always thinking about this and working to implement and test new ways of delivering this information--we will discuss the info from this thread right now too. 

    It is rare that i have to email eset but i have found on a couple of occasions I have received no replies. I know one was for a few suggestions and the other was for a false positive web certificate block a few months back on a website I visit. I got it fixed via the forum in the end even though we are always recommended to email for false positives. Just would be good to recieve a reply even if it is just to confirm it is being investigated with replies with any updates later

  11. 10 hours ago, Jack's_Son said:

    At this point, Techs should be stepping in. You're implying that neither the Mac and Windows versions are blocking Phishing sites right now. That's red alarms.

     

    On 23/11/2017 at 6:07 AM, senna said:

    Hi,

     

    I am testing ESET Cyber Security Pro (6.5.x) on MacOS 13.1 (High Sierra) for now. I tried all of the AMTSO Feature setting checks but the 'Phishing Page Check' states that my Anti-Phishing features are not working. ESET 'Phishing-Protection' is of course enabled. Any ideas why AMTSO Phishing Test ist not working properly?

     

    Cheers, senna.

    Best thing to do is sometimes to open a support ticket. While mods are on here, the recommended support method is always via email as they may not always check all posts on here.

  12. As you may have heard, the FCC in the US is trying to get rid of the net neutrality law. What do people on here think of this?

    To me, this law is important, as it means currently all data is treated the same. I do not think any ISP should be able to give better service to specific sites. In the past apparently they have tried to do this e.g. slowing down netflix while making sure their own streaming services load much quicker. This feels very anti-competitive. 

    It seems that some want a normal and fast lane. However if it was cheap enough and everyone paid to be on the fast lane would it be worth it, as they wouldn't get any advantages. I can imagine it wouldn't be that cheap, and small companies who can't afford it would be hit badly. Also the extra costs sites had to pay would have to come from somewhere, so in the end the customer would end up having to pay more. 

    While some people are against regulations in general, net neutrality is there to help the average person. To me the only people who will gain an advantage are the cable companies. There's also worries that without net neutrality, ISPs could even slow down political websites.

  13. Read about a bunch of intel vulnerabilities the other day. These affected a variety of PCs, Servers and IoT devices. One of these vulnerabilities could allow a hacker to launch commands and possibly gain access remotely. Intel has released a tool allowing users to scan and see if they are affected while manufacturers are trying to release patches. 

     

    https://arstechnica.com/information-technology/2017/11/intel-warns-of-widespread-vulnerability-in-pc-server-device-firmware/

  14. 2 minutes ago, raisya said:

    Thanks for your time peteyt :)

    As I mentioned above, the issues on Wanny Cry happen at UK hospital that leads to an operation being cancelled, ambulance being diverted and documents such as patient records made unavailable to access and have been stolen.

    So, I agree your point that every company should have expertise in IT and do backup plan. 

     

    The problem is often security is left to the it department but really everyone should play a part

×
×
  • Create New...