The future of avast protection

[bob3160]

We can't only rely on reactive policy of signatures (even they're generic ones).

There is still one problem that's being overlooked.
The disease (virus, trojan worm etc) always comes first and it's discovery is always delayed.
The cure is even further behind and there's no way around that simple, nasty fact.

[Lisandro]

There is still one problem that's being overlooked.
The disease (virus, trojan worm etc) always comes first and it's discovery is always delayed.
The cure is even further behind and there's no way around that simple, nasty fact.

We don't need the disease (virus, infection) to have the cure (protection, cleaning).
For that we can think on behavior blockers, HIPS and sandboxing.

[DavidR]

Does anyone?
I think not...we will always be playing catch up...

Precisely. We need something more to protect us nowadays... We can't only rely on reactive policy of signatures (even they're generic ones).

Do you really think that a sandbox will protect us any better, I don't. Why, because on its own a sandbox doesn't improve detections and if something isn't detected within the sandbox, what is to say if nothing is detected and it is run outside the sandbox. Most of you want a sandbox, but then you want it to be able to have your cake and eat it too.

By allowing various things to be able to have access to the system and not remain inside the sandbox and save files, add-on updates, etc. etc. all of which weakens any point in having a sandbox in the first place.

We already have emulation which in a way is trying to emulate what the file would do and if that behaviour would be considered suspect. These areas are what I would consider to be of far more importance than sandboxing.

I just don't see sandboxing as the be all and end all in security.

[Lisandro]

Do you really think that a sandbox will protect us any better, I don't. Why, because on its own a sandbox doesn't improve detections and if something isn't detected within the sandbox, what is to say if nothing is detected and it is run outside the sandbox. Most of you want a sandbox, but then you want it to be able to have your cake and eat it too.

On demand sandbox, ok, it will depend the user and the detection.
On access sandboxing no.

By allowing various things to be able to have access to the system and not remain inside the sandbox and save files, add-on updates, etc. etc. all of which weakens any point in having a sandbox in the first place.

Better than nothing. You can think in a balance between protection and usability of the browser in this case.

We already have emulation which in a way is trying to emulate what the file would do and if that behaviour would be considered suspect. These areas are what I would consider to be of far more importance than sandboxing.

On demand emulation. No on access.

[Lisandro]

Now, with Avast 6.0 (which is coming sooner than you may think), it's a different story. Avast 6.0 will feature the in-the-cloud heuristics based on the age/prevalence data (as suggested above by sded) as well as new stuff related to the use of our sandbox.

Vlk, will it be on the free version also, I mean, the cloud features of avast?

[GloobyGoob]

We already have emulation which in a way is trying to emulate what the file would do and if that behaviour would be considered suspect. These areas are what I would consider to be of far more importance than sandboxing.

On demand emulation. No on access.

Tech, I think DavidR meant code emulation. (Not virtualization)

[RejZoR]

I think avast! will be able to make good cloud tech since the userbase is so big. You can get good results back if you have large user base, meaning you also get access to loads of data regarding file age and prevalence and other stats...

[Lisandro]

since the userbase is so big.

Another reason to build the cloud with the free version.

[Lisandro]

Avast 6.0 will feature the in-the-cloud heuristics based on the age/prevalence data

Worth a reading about false positives & age/prevalence of files/samples.
http://www.pcmag.com/article2/0,2817,2371197,00.asp

By the way, avast is an AMTSO member (Anti-Malware Testing Standards Organization).
http://www.amtso.org/members.html

[robinb]

all i know is AVAST take your time with version 6 and constantly test it prior to coming out to the general public.  and i am so glad you listen to those here in the forum and your beta testers.  After having so many problems with AVG 2011 on my computers and so many of my clients computers I am a true AVAST converter and hope to stay!

robin

[clocks]

all i know is AVAST take your time with version 6 and constantly test it prior to coming out to the general public.  and i am so glad you listen to those here in the forum and your beta testers.  After having so many problems with AVG 2011 on my computers and so many of my clients computers I am a true AVAST converter and hope to stay!

robin

I think the Avast 5 beta program was very well done, and I suspect they will follow a similar path with v6.

[Lisandro]

I think the Avast 5 beta program was very well done, and I suspect they will follow a similar path with v6.

avast beta programs are very well conducted in my opinion: speed and stability, moving forward all the time.

[Diddy]

HI can someone please explain to me what vik is talking about when he is talking about sandboxing and how the sandboxing feature will be in the free avast version is this like a safe place to put files is it just like using virus chest in avast?  please explain in detail please.

I am only an intermediate computer user and I do not understand what vik is talking about when he is talking about sandboxing in avast free.

thanks a lot have a great day

[medway01]

HI can someone please explain to me what vik is talking about when he is talking about sandboxing and how the sandboxing feature will be in the free avast version is this like a safe place to put files is it just like using virus chest in avast?  please explain in detail please.

I am only an intermediate computer user and I do not understand what vik is talking about when he is talking about sandboxing in avast free.

thanks a lot have a great day

I'm not quite sure about sandboxing myself, there are many ways to implement it:

http://en.wikipedia.org/wiki/Sandbox_%28computer_security%29

The idea is to isolate things like browsers from your main system so anything nasty coming in through a browser does not have any way to gain access to your computer and alter files and infect. Everything inside the sand box is in theory isolated from the Operating system and the files on your computer.

I beleive it works by running browsers and other programs you choose in 'virtual enviroment' I think !

This is about the best I can do, hopefully someone with more experiance will be along :-)

[Lisandro]

The idea is to isolate things like browsers from your main system so anything nasty coming in through a browser does not have any way to gain access to your computer and alter files and infect. Everything inside the sand box is in theory isolated from the Operating system and the files on your computer.

Vlk is saying that according to the executable behavior, it could be isolated in the sandbox automatically, preventing it to do any harm to your computer.