blackdove83 Posted March 10, 2014 ID:801486 Share Posted March 10, 2014 http://labs.bromium.com/2014/02/21/the-wild-wild-web-youtube-ads-serving-malware/Been using mbae 0.9.5.1000 and i was wondering if it covered the specific exploit used there.It lists the CVE in that article. Thank you for mbae and any assistance in advance.I guess youtube is no longer safe P.S. im also using EMET 4.1 with maximim security and deep hooks enabled. Link to post Share on other sites More sharing options...
blackdove83 Posted March 10, 2014 Author ID:801498 Share Posted March 10, 2014 Edit. Since that was discovered in february i might have had a previous version but im not positive when the campaign was started. Link to post Share on other sites More sharing options...
Staff pbust Posted March 11, 2014 Staff ID:801560 Share Posted March 11, 2014 Yes, MBAE would stop this. Also MBAE is vulnerability-agnostic as well as payload-agnostic, so it really doesn't matter to us which CVE it is and whether it's a known or unknown CVE. We look at the exploit techniques used and block based on that (i.e. no signatures). Link to post Share on other sites More sharing options...
David H. Lipman Posted March 11, 2014 ID:801575 Share Posted March 11, 2014 MBAE is vulnerability-agnostic as well as payload-agnostic,Love the verbiage ! I'll have to remember it. Link to post Share on other sites More sharing options...
Staff pbust Posted March 11, 2014 Staff ID:801580 Share Posted March 11, 2014 As an example MBAE would stop the calculator from executing via an exploit technique whereas a traditional AV/AM security product would consider that an FP because the calculator is not malicious. But to MBAE what matters is HOW it is being delivered rather than WHAT is being delivered. Link to post Share on other sites More sharing options...
John L. Galt Posted March 11, 2014 ID:801610 Share Posted March 11, 2014 Agreed with David - excellent verbiage, and a great explanation in layman's terms after that. I'm bookmarking this post. Link to post Share on other sites More sharing options...
blackdove83 Posted March 13, 2014 Author ID:802826 Share Posted March 13, 2014 Thank you for the information pbust. Link to post Share on other sites More sharing options...
ritchie58 Posted March 14, 2014 ID:803230 Share Posted March 14, 2014 I agree! Very good explanation, without all the technical jargon, on how A-E is doing it's job protecting us! This would be a great link to show someone that might be interested in also testing A-E. On that subject, I posted a topic in our forum about the pending non-support issue for XP users and the conversation led to Anti-Exploit and how that could very useful for folks that want to continue using this platform after April. http://forum.immunet.com/index.php?/topic/2525-do-you-use-windows-x-p-read-this/ Link to post Share on other sites More sharing options...
Staff pbust Posted March 14, 2014 Staff ID:803252 Share Posted March 14, 2014 Nice post, thanks ritchie!! Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now