St. Petersburg, Russia — May 15, 2012. The dismal Proactive Security Challenge results turned in by the big AV (Anti-Virus) players in the most recent Matousec.com 64-bit Windows 7 tests are making us wonder whether security companies are really catering to the needs of 64-bit PC/OS users. Are traditional AV vendors even capable of delivering reliable and robust protection to these users?
 |
I. 64-bit OS security landscape
With the increase of processing power and rapidly dropping memory prices,64-bit systems are firmly in the mainstream (check the latest Steam statistics for gamer-oriented PCs — click OS Version to see the statistics breakdown — x64 systems are used on more than 60% of the modern PCs). Pretty much any computer manufactured in the last three years is capable of running 64-bit Windows, and all high-end systems are 64-bit; the majority of computers today are equipped with hardware that’s best suited and performs best under 64-bit. "Native" 64-bit software makes a full use of the processing power and memory management capabilities in today’s hardware, enabling additional features.
Security-wise, 64-bit systems benefit from the improved native protection implemented in Windows Vista and Windows 7; this improved protection comes from such security mechanisms as mandatory driver signing, kernel patch protection and hardware-based DEP (Data Execution Prevention). These tools are designed to minimize the incidence of rootkits and other powerful and sophisticated malware. Thanks to these and other tools, 64-bit systems are, at least on the surface, much more solid and secure than their32-bit cousins.
To complement native security protection for 64-bit systems, security vendors have, of course, rushed in to save the 64-bit user from malware enslavement with tools that claim to protect against any and all types of infections. If the results of the 64-bit Matousec.com tests are anything to go by, most of them have failed miserably. The reality is that, far from being more secure than 32-bit users, owners of 64-bit Windows systems are actually lagging in available flexibility and strength of protection.
II. Proactive security test results
| Product, participants for Proactive Security Challenges at Matousec.com | 64-bit score (% in 110 tests for Windows 7), April 2012 | 32-bit score (% in 148 tests for Windows XP), before 2012 | 64-bit score 32-bit score — average, % |
| Outpost Security Suite Pro 7.5 | 86 | 97 | 92% |
| ZoneAlarm Extreme Security 2012 | 43 | 72 | 58% |
| ESET Smart Security 5.0 | 33 | 6 | 20% |
| Kaspersky Internet Security 2012 | 28 | 93 | 61% |
| Norton Internet Security 2012 | 10 | 20 | 15% |
| Bitdefender Total Security 2012 | 9 | 97 | 54% |
| PC Tools Internet Security 2012 | 6 | 90 | 48% |
| AVG Internet Security 2012 | 3 | 3 | 3% |
| McAfee Total Protection 2012 | 3 | 2 | 3% |
By comparing the results of the 64-bit tests (conducted in winter 2011–2012 and spring 2012) with the results of the most recent 32-bit tests (roundup test finished in October 2011), it becomes clear that the majority of vendors are falling short when it comes to 64-bit protection. We have to ask ourselves whether it’s a lack of expertise in 64-bit architecture or just laziness on the part of these developers, but either way, users are losing out. And we don’t think that’s fair on anyone.
III. Vendors’ interpretations
It’s even more disheartening to read recent response following the publication of the results (comments are provided in the Latest News for Proactive Security Challenge 64-bit at Matousec.com). Reading between the lines, it seems what they are saying is "give us more time and we’ll come up with a better solution that will be able to pass your tests". Considering that 64-bit Windows systems have been around for more than five years, and Windows 7, the platform adopted for the current test, is a good two and a half years old, it begs the question: how are users supposed to protect themselves in the meantime? And sadly it is not the only vendor taking this position.
All too often, it seems that big security players disregard the need to address penetration and leak tests for 64-bit Windows, which constitute the lion’s share of the tools used in the Matousec studies. These tools simulate typical intrusions by using the attack vectors and breach techniques used by real malware and 0-day threats, unearthing the shortcomings of systems that allow unknown viruses to penetrate current defenses and wreak havoc.
Most security vendors present in the table have historically shied away from putting their products through such tests because they say the additional protections required would sacrifice product usability. In the tradeoff between this kind of usability and increased security, they favor the former.
IV. Agnitum’s view
As a smaller player, we see the situation a little differently. To overcome the potential problems of more user prompts and alerts triggered by the introduction of system integrity controls, we have developed a mechanism of automated response to such events. It enables us to enhance security without getting in the user’s way all the time and asking questions most users have no hope of being able to answer. This has resulted in a formidable 86% pass rate in Matousec.com tests, and we are working on improving this result by analyzing bypass techniques even further.
Looking at the broader picture, the major takeaway from the current Matousec.com report is that the majority of 64-bit systems are vulnerable and exploitable even with a "big-name" security product in place. Only a fraction of the available products deliver acceptable levels of protection. Agnitum, on the other hand, provides high levels of protection for both 32 and 64-bit systems, does so reliably, and doesn’t distinguish between architectures.
Our products are not tweaked to recognize and block simulated attacks; we just monitor the integrity of the environment and stop attacks at their source, whatever techniques they employ. By embracing this kind of proactive approach to combating threats, Outpost delivers more robust and reliable protection against unknown threats than those competing solutions that address predefined malware samples or only adapt to known techniques once they are fully researched.
x86 or x64, Outpost knows its job and makes no lame excuses, no matter what system or testing tool is involved. No false modesty here, we’ve accomplished native protection for both environments and we are sure to keep it up-to-date and proactive.
For more information and to request review copies of Outpost Pro 7.5, please contact: AVG Security (Asia-Pacific)
