FYI: Emsisoft Failed to Make it to "The List."

[HAWKI 7]

"Most Major Antivirus Programs Bypassed By The CIA, Shows WikiLeaks Document

WikiLeaks recently published thousands of documents that the organization said belongs to the CIA. Among them, there was a document that showed a list of antivirus and other security products that have been exploited and bypassed by the CIA...."

Emsisoft is not among the 21 security vendors on the list of security vendors whose products have been exploited and bypassed by the CIA. :-)

http://www.tomshardware.com/news/antivirus-programs-bypassed-cia-wikileaks,33845.html

 

[malik4477 0]

That is good to know

[GT500 531]

We did publish an article about the Vault 7 leaks, and we also noticed that we weren't mentioned anywhere. That being said, it sounds like Wikileaks may have only begun to publish the leaked info (at least I saw an article by someone saying Wikileaks has said they had only published 10% of the data they had thus far), so we don't yet know what's in the unreleased information. Obviously, due to the history of such leaks, we don't expect to see any bypasses for our software in the leaked data, however this is the CIA and we'd be foolish to assume that it isn't possible for them to have found some way to bypass our protection if they really wanted to.

As a side note, while I didn't go through the data thoroughly enough to be 100% certain, some of the information about bypasses did seem like they were for old versions of the anti-virus software they targeted. I got a good laugh out of the one for CIS 6 though. 

I can only hope that COMODO has fixed that issue by now. I wasn't able to find anything relevant in a quick search, and I am seeing nothing on their forums about it, so I can't verify it without personally testing it.

[Peter2150 45]

Sorry, no pity here for the Comodo folks

[GT500 531]

According to Wikipedia version 6 of CIS was released in February of 2013, and version 7 of CIS was released in April of 2014. The current major version of CIS, released December 22nd, 2016 is version 10. Clearly the information provided in the Vault 7 leaks thus far is very out of date, so I doubt any of the vulnerabilities that were disclosed are still valid.

WikiLeaks has been cautious about releasing things in this leaked CIA data that could be dangerous, so it might be possible that future leaks will contain newer information.

[Durew 0]

But Emsisoft is on the list, via the bitdefender engine.
According to a presentation (https://wikileaks.org/ciav7p1/cms/files/2014_EN_BreakingAVSoftware_JoxeanKoret.pdf) the bitdefender engine is both vulnerable and makes vendors who use it vulnerable. That the CIA found at least one of the vulnerabilities for Bitdefender puts EAM at risk.

 

[GT500 531]

Those vulnerabilities were old. Also note that there's a difference between the scanning engine and the part of the software that monitors files and such. We use our own technology to monitor files and running processes, and then simply pass them to the BitDefender engine for scanning (in addition to our own engine). Our Behavior Blocker is also completely independent, and uses no BitDefender code.