CyberCapture

[Be Secure]

@Vlk

I have one more concern or question about CyberCapture, regarding AV-C and AV-TEST. Will their testing methodologies adapt to how your product works? I mean, if results are sometimes returned in 2 hours time, will they wait for a verdict and flag it as miss or hit based on that or how will they operate with it now? I mean, before it was very clear verdict with NG since it took just few seconds and tester could instantly see what happened. With CyberCapture, that changes drastically. And it would be nice to see realistic scores in tests based on how it actually operates.

2 hour is too much for them and for us also.If it is between 15-20 minutes(Max 25) then it will be more realistic.For solution you can make more NG system environment in your lab it will divide the workload.

[TrueIndian]

Well I am sure in time this feature will be a big part of avast! because of their huge user base it will be easy to detect new threats quickly. 

I want to see this feature applied to all infection vectors especially to usb,p2p,mail and unkown files resident on user machine if there are any.

[REDACTED]

@Vlk

I have one more concern or question about CyberCapture, regarding AV-C and AV-TEST. Will their testing methodologies adapt to how your product works? I mean, if results are sometimes returned in 2 hours time, will they wait for a verdict and flag it as miss or hit based on that or how will they operate with it now? I mean, before it was very clear verdict with NG since it took just few seconds and tester could instantly see what happened. With CyberCapture, that changes drastically. And it would be nice to see realistic scores in tests based on how it actually operates.

2 hour is too much for them and for us also.If it is between 15-20 minutes(Max 25) then it will be more realistic.For solution you can make more NG system environment in your lab it will divide the workload.

+1

[Para-Noid]

CyberCapture vs. Free Business Edition...

If the free business edition provides USB protection then why can't CyberCapture do the same thing?"
Assuming the free business edition uses cloud technology to protect against USB infections.
Also, doesn't the free business edition use the cloud to scan individual files?

[Be Secure]

CyberCapture was bypassed by Ransomware. :(Is there any info about Ransomware protection? I thought it(Ransomware) block by CyberCapture but wrong.

[Lisandro]

CyberCapture was bypassed by Ransomware.

Evidence (link) please

[Lisandro]

And it would be nice to see realistic scores in tests based on how it actually operates.

+1 I would love to see results being published.

avast! has once again proven it has one of the best communities in the world.

And it's one of our major power. And we know that we need to change somehow "faster", "drastically".
We're listen to this need and will do our best to recover and keep this perception of "best community".

[Andrey,pro]

Seems to me there is no need to upload every file.
Get the hash from a file.
Upload it to the avast server.
If it is unknown upload the file.
If it is known, there is no need to upload the file.
Seems to me much better for people with a low bandwidth and especially for those who have a data limit.

Hello,
yes, if we don't have the file (prevalence = 0) then we upload it to our servers. Other users with same hash don't upload the file.

Milos

Hello Milos,

One user from Russia reported it isn't the truth. After checking the file it was checked again the next time. For more inforrmation, please read this topic (in Russian): https://forum.avast.com/index.php?topic=187696.0

Update: I found that the first picture was from a FileRep and the Second - from CyberCapture.

[Be Secure]

CyberCapture was bypassed by Ransomware.

Evidence (link) please

Ok.I have some screenshot of that Ransomware that was block by ZAM.After that i send it to Viruslab.And now it is blocked as a malware-gen.

VT: https://www.virustotal.com/en/file/5a7fa97c7450e7404abc8fb910f99019193e30cf2c7303996c7d19efebfc650b/analysis/

[Lisandro]

After that i send it to Viruslab. And now it is blocked as a malware-gen.

So, it did not pass CyberCapture.
Of course, CyberCapture needs to get the malware (file) to analyze it.
Having 230 million sensors spread all over the world, zero-second protection will be achieved when a file with prevalence 0 (unknown) reaches CyberCapture.

[RejZoR]

It did fail. He sent it manually to virus lab. CyberCapture is suppose to lock the file from execution, send the sample to cloud, analyze it there and return the verdict. And verdict in this case was apparently "not malware". Or it didn't even trigger CyberCapture because it was executed from local drive and not as download, which ENTIRELY bypasses CyberCapture...

[Be Secure]

It did fail. He sent it manually to virus lab. CyberCapture is suppose to lock the file from execution, send the sample to cloud, analyze it there and return the verdict. And verdict in this case was apparently "not malware". Or it didn't even trigger CyberCapture because it was executed from local drive and not as download, which ENTIRELY bypasses CyberCapture...

+1.Got my point.

[Lisandro]

CyberCapture is suppose to lock the file from execution, send the sample to cloud, analyze it there and return the verdict.

Which is the origin of the file? HTTPS scanning?

And verdict in this case was apparently "not malware".

The verdict is not instantaneous.

Or it didn't even trigger CyberCapture because it was executed from local drive and not as download, which ENTIRELY bypasses CyberCapture...

No, I really disagree technically. This is not bypass. The technology was not bypassed. It is just, by now, limited. Not every file triggers CyberCapture. And not triggering is NOT, technically, bypassing.
CyberCapture will evolve in next months and its limitations (the origin of the file) will be narrowed.

[RejZoR]

Bypass, evasion, not being detected, same thing, end result is user being infected. At the end of the day, I frankly don't care how you call it.

I'd need Be Secure to confirm whether it triggered CyberCapture and the verdict was "CLEAN" or it didn't even trigger it...

[Dwarden]

please also remember shared infections of LAN and similar it's not just removal drives, USBs, optical media and web urls and email

seen some randomware latterly going thru LAN attack vectors