{"id":13918,"date":"2018-11-27T15:10:04","date_gmt":"2018-11-27T23:10:04","guid":{"rendered":"https:\/\/www.palada.net\/index.php\/2018\/11\/27\/news-7685\/"},"modified":"2018-11-27T15:10:04","modified_gmt":"2018-11-27T23:10:04","slug":"news-7685","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2018\/11\/27\/news-7685\/","title":{"rendered":"Why Malwarebytes decided to participate in AV testing"},"content":{"rendered":"

Credit to Author: Malwarebytes Labs| Date: Tue, 27 Nov 2018 22:44:00 +0000<\/strong><\/p>\n

Starting this month, Malwarebytes began participating in the antivirus software for Windows comparison test<\/a> performed by AV-test.org. This is uncharted territory for us, as we have refrained from participating in these types of tests since our inception. Although recent testing results show Malwarebytes protecting against more than 97 percent of web vector threats and detecting and removing 99.5 percent of malware during a scan on any machine, we still maintain reservations about the entire testing process.<\/p>\n

Why participate now?<\/h3>\n

In the past, we\u2019ve avoided AV comparison tests because we felt their methods did not allow us to demonstrate how our product works in a real environment. By testing only a small portion of our product\u2019s technologies, AV comparison tests are often unable to replicate Malwarebytes\u2019 overall effectiveness. However, we understand the importance of independent reviews for those considering a Malwarebytes purchase, so we decided to participate.<\/p>\n

Malwarebytes is not a traditional antivirus<\/a>, and detecting files based on signatures\u2014which is what the testing companies review\u2014is only one of the methods we use to protect our customers from threats. We probably never will be the best performer in this category; it simply isn\u2019t our focus. We mostly rely on other methods, such as hardening, application behavior, and vector blocking defenses that disrupt malware earlier in the attack chain.<\/p>\n

What did the test miss?<\/h3>\n

Some of our best technologies block malware before it has the chance to execute. Our application behavior and web protection modules, for example, stop threats earlier in the attack\u2014at the point of delivery instead of the point of execution. However, the URLs tested only represent the final stage of an attack (i.e. the URL pointing to the final payload EXE).<\/p>\n

In addition, testers often do not replicate the original infection vector used by malware campaigns, such as malspam, exploits, or redirects. Instead, they download the malware directly, bypassing typical delivery methods. By doing this, they\u00b4re controlling the environment, but also missing out on the trigger for many of our detections.<\/p>\n

What exactly is checked in these monthly AV-Test.org tests?<\/h3>\n