CyberCapture

[RejZoR]

@Vlk I have one more idea. Currently, when CyberCapture locks the file into custody, you can opt to run it without waiting for verdict. You could add "Run in Sandbox" as an option for Pro, Internet Security and Premier editions since they already employ sandbox tech. This way users can run the suspicious stuff risk free in an isolated environment (if the app will work in it of course since not all do) even before they get definitive answer from CyberCapture servers. This way you add additional layer of security when users decide to run it anyway.

[Vlk]

@Vlk I have one more idea. Currently, when CyberCapture locks the file into custody, you can opt to run it without waiting for verdict. You could add "Run in Sandbox" as an option for Pro, Internet Security and Premier editions since they already employ sandbox tech. This way users can run the suspicious stuff risk free in an isolated environment (if the app will work in it of course since not all do) even before they get definitive answer from CyberCapture servers. This way you add additional layer of security when users decide to run it anyway.

Thanks, that sounds like something that could be implemented very easily.

Vlk

[Vlk]

Btw, you can read more about CyberCapture here: https://blog.avast.com/cybercapture-protection-against-zero-second-attacks

[RejZoR]

You're mentioning server side polymorphic malware, since you guys often mention contextual detections, is your system designed to combat this in such a way that if CyberCapture spots several different malicious samples on a same domain, that it blacklists that domain (or IP) automatically and feeds it into Web Shield URL blocker? Because once you block a fixed URL address, they can spawn trillions of new malware samples and they'd all get blocked by URL:Mal part of the Web Shield proactively.

[Be Secure]

@Vlk I have one more idea. Currently, when CyberCapture locks the file into custody, you can opt to run it without waiting for verdict. You could add "Run in Sandbox" as an option for Pro, Internet Security and Premier editions since they already employ sandbox tech. This way users can run the suspicious stuff risk free in an isolated environment (if the app will work in it of course since not all do) even before they get definitive answer from CyberCapture servers. This way you add additional layer of security when users decide to run it anyway.

Why leftout Free?

[Asyn]

@Vlk I have one more idea. Currently, when CyberCapture locks the file into custody, you can opt to run it without waiting for verdict. You could add "Run in Sandbox" as an option for Pro, Internet Security and Premier editions since they already employ sandbox tech. This way users can run the suspicious stuff risk free in an isolated environment (if the app will work in it of course since not all do) even before they get definitive answer from CyberCapture servers. This way you add additional layer of security when users decide to run it anyway.

Why leftout Free?

Because, there is no sandbox.

[Alikhan]

@Vlk I have one more idea. Currently, when CyberCapture locks the file into custody, you can opt to run it without waiting for verdict. You could add "Run in Sandbox" as an option for Pro, Internet Security and Premier editions since they already employ sandbox tech. This way users can run the suspicious stuff risk free in an isolated environment (if the app will work in it of course since not all do) even before they get definitive answer from CyberCapture servers. This way you add additional layer of security when users decide to run it anyway.

+1.

This is a great idea.

[Be Secure]

@Vlk I have one more idea. Currently, when CyberCapture locks the file into custody, you can opt to run it without waiting for verdict. You could add "Run in Sandbox" as an option for Pro, Internet Security and Premier editions since they already employ sandbox tech. This way users can run the suspicious stuff risk free in an isolated environment (if the app will work in it of course since not all do) even before they get definitive answer from CyberCapture servers. This way you add additional layer of security when users decide to run it anyway.

Why leftout Free?

Because, there is no sandbox.

But many users used this and avast! send the basic product to testing companies..so why not avast! implement somthing that good for all.

[bob3160]

Here is an explanation of CyberCapture directly from Ondrej:
https://blog.avast.com/cybercapture-protection-against-zero-second-attacks
Hopefully this will be a better answer than NG in defending against the latest and as yet unknown threats.

[Milos]

You're mentioning server side polymorphic malware, since you guys often mention contextual detections, is your system designed to combat this in such a way that if CyberCapture spots several different malicious samples on a same domain, that it blacklists that domain (or IP) automatically and feeds it into Web Shield URL blocker? Because once you block a fixed URL address, they can spawn trillions of new malware samples and they'd all get blocked by URL:Mal part of the Web Shield proactively.

Yes, we have already implemented this.

Milos

[RejZoR]

@Vlk I have one more idea. Currently, when CyberCapture locks the file into custody, you can opt to run it without waiting for verdict. You could add "Run in Sandbox" as an option for Pro, Internet Security and Premier editions since they already employ sandbox tech. This way users can run the suspicious stuff risk free in an isolated environment (if the app will work in it of course since not all do) even before they get definitive answer from CyberCapture servers. This way you add additional layer of security when users decide to run it anyway.

Why leftout Free?

Because, there is no sandbox.

But many users used this and avast! send the basic product to testing companies..so why not avast! implement somthing that good for all.

Because:
a) Free version doesn't have sandbox component, at least not one that allows execution of files like paid versions do
b) In the end, they need paying customers and this tiny feature separates Free from paid versions without really affecting user security (if you just wait for the verdict to arrive back).

[TrueIndian]

Interesting stuff would love to see this feature cover all the entry points.Yep would definately like this.

Right i will try to get this thing triggered

Have been too hard coming down on avast!.Can't blame anyone because this program is very reputated and so if it fails its a big no no  for its fanbase.Keep up the good work!

[RejZoR]

Don't feel bad for giving honest criticism. Constructive criticism, even if it looks harsh at first, only makes things better. Pretending everything is fine and praising things to death leads to stagnation. avast! has once again proven it has one of the best communities in the world. Not like for example product which starts with C and ends with O, where I got banned like 3 times on their forums because I was just concerned and honest about the issues it had. Fine, then have your broken crap and praise it to death even though it's broken like a llama which fell off Mount Everest... But fanboys will be fanboys. I used to be avast! fanboy so to speak in the past, but no more. I am a fan, but not a fanboy. Because being fanboy is harmful, not productive.

[RejZoR]

@Vlk

I have one more concern or question about CyberCapture, regarding AV-C and AV-TEST. Will their testing methodologies adapt to how your product works? I mean, if results are sometimes returned in 2 hours time, will they wait for a verdict and flag it as miss or hit based on that or how will they operate with it now? I mean, before it was very clear verdict with NG since it took just few seconds and tester could instantly see what happened. With CyberCapture, that changes drastically. And it would be nice to see realistic scores in tests based on how it actually operates.

[Be Secure]

Don't feel bad for giving honest criticism. Constructive criticism, even if it looks harsh at first, only makes things better. Pretending everything is fine and praising things to death leads to stagnation. avast! has once again proven it has one of the best communities in the world. Not like for example product which starts with C and ends with O, where I got banned like 3 times on their forums because I was just concerned and honest about the issues it had. Fine, then have your broken crap and praise it to death even though it's broken like a llama which fell off Mount Everest... But fanboys will be fanboys. I used to be avast! fanboy so to speak in the past, but no more. I am a fan, but not a fanboy. Because being fanboy is harmful, not productive.

+100.