OPSWAT Metadefender. Superior Malware Threat Prevention and Analysis

Transcription

1 OPSWAT Metadefender Superior Malware Threat Prevention and Analysis

2 OPSWAT Products Threat protection and security Threat prevention and analysis 30+ anti-malware engines 90+ data sanitization engines Vulnerability Engine 1,000+ direct customers Threat intelligence platform Over 1 billion hashes 1 patent pending SDK for endpoint posture Security, compliance and removal 50+ OEM customers 200M+ endpoints

3 Metadefender Product Family

4 Protecting Against Threats Types of threats Known threats Threats that are detected by at least one antivirus engine s signatures The largest majority of threats are known threats The more engines, the more known threats can be detected Unknown threats Threats that are not currently detected by any antivirus engine s signatures Use many engines to reduce exposure from weeks to hours Heuristics can detect malware variations and malicious code Remove embedded scripts & macros to reduce exposure

5 Metadefender 3 Distinct Technologies SIGNATURES & HEURISTICS DATA SANITIZATION VULNERABILITY ENGINE Signature and heuristic scanning with 30+ embedded anti-malware engines Removal of potentially harmful macros and scripts with 90+ data sanitization engines The Vulnerability Engine supports over a million binaries and 15,000 applications with support for version checks and reported known vulnerabilities and many more.

6 The Workflow Engine

7 The Workflow Engine

8 What is the Vulnerability Engine? Identifying application vulnerabilities Prevent threats Detect vulnerabilities before they are targeted by malware Scan any OS Scans many files from any operating system Big data Over 1M binaries, 15K vulnerabilities Unique Detect vulnerabilities in installers and offline machines Very fast Detection faster than some other 3 rd party methods * Patent Pending

9 How Does it Work? Assesses vulnerabilities on the system or in the data that is being brought to the network 250+ top vulnerable applications 15,000+ associated CVE with severity information 1,000,000+ identified vulnerable hashes 30+ times faster than existing solutions on the market

10 How Does it Work? Comparing Metadefender s Vulnerability Engine to Competitors Product name OPSWAT Competition 7-Zip v x ActivePerl v x Adobe AIR v v Adobe Flash Player v v Beyond Compare v x Cisco AnyConnect VPN Client v v ESET Endpoint Security v x FileZilla v x Google Chrome v v Internet Explorer v v Microsoft AutoRuns x v Microsoft Excel v v Microsoft Filemon x v Microsoft Lync v v Microsoft OneNote v v Microsoft Outlook v x Microsoft PowerPoint v v Microsoft Process Explorer x v Microsoft Publisher v v Microsoft Regmon x v Microsoft Visio v v Microsoft Word v v Microsoft XML Core Services (MSXML) x v Mozilla Firefox v v Notepad++ v x Oracle Java JRE v v Paint.NET v x PuTTY v v 30 times faster in reporting product version gaps, known vulnerabilities and severity level Significantly better on detection accuracy QQ v x Secunia PSI v v Silverlight v v Skype v x TeamViewer v x TortoiseGit v x TortoiseSVN v x VLC media player v v vsphere Client v x Windows Defender v x Windows Firewall v x Windows Media Player v x Windows Update Agent v v Windows VPN Client v x WinPcap v x WinRAR v v WinSCP v v Wireshark v v Zoom v x More product coverage and focus on real world target applications

11 Over 1,000,000 hashes!

12 Use Cases Hard drives can be removed and scanned by connected systems Systems can be scanned when they are offline Metadefender Client can be booted off of a USB to scan a system before it has been started

13 Use Cases Metadefender Core s archive handling extracts application installers and scans all files within Applications can be scanned before they are installed Vulnerabilities can be identified so that vulnerable versions of applications are not installed on systems

14 Use Cases Metadefender s Vulnerability Engine can be used in conjunction with a Metadefender Kiosk deployment Scan software updates on physical media before they are applied in a secure environment Application installers and operating system updates are often brought into secure networks on physical media, which can be scanned for vulnerabilities before they are applied

15 How to Use the Vulnerability Engine Licensed as additional engine in Metadefender Core

16 How to Use the Vulnerability Engine Scan result within Metadefender Core

17 How to Use the Vulnerability Engine Scan result on Metadefender.com

18 How to Use the Vulnerability Engine REST API (available both in Metadefender Core and Metadefender.com

19 Real Life Example Vulnerability in Firefox, one of the most common web browser applications

20

21 Data Sanitization Why you need data sanitization Altering the internal file structure Removing embedded objects (scripts, macros, etc.) Converting the file format 90+ Data Sanitization Engines 15+ Supported file types Did you know? Macro malware quadrupled in McAfee

22 Data Sanitization Supported File Types Original File Type doc xls ppt rtf docx xlsx pptx htm/html pdf jpg bmp png tiff svg gif Supported Conversion Types doc, pdf xls, pdf ppt, pdf rtf docx, txt, html, pdf, ps, jpg, bmp, png, tiff, svg xlsx, csv, html, tiff, pdf, ps, jpg, bmp, png, svg pptx, pdf pdf, ps, jpg, bmp, png, svg pdf, bmp, tiff, txt, html, svg, jpg, png Jpg, bmp, png, tiff, svg, gif, ps, eps, pdf bmp, jpg, png, tiff, svg, gif, ps, eps, pdf png, jpg, bmp, tiff, svg, gif, ps, eps, pdf tiff, jpg, bmp, png, tiff, svg, gif, ps, eps jpg, bmp, png, tiff, gif, ps, eps jpg, bmp, png, tiff, svg, ps, eps, pdf

23 Metadefender Data Sanitization How it works Assumes all files are bad Removes embedded scripts and macros Rebuilds files, retaining usability and formatting

24 Live Demo

25 Data Sanitization Example of document with malware A sample of: JS/IFrame Trojan:JS/BlacoRef...

26 Data Sanitization Before data sanitization, malware is found

27 Data Sanitization After data sanitization, file is clean

28 Data Sanitization Example of PDF > PDF sanitization Original File Sanitized File PDF PDF

29 Data Sanitization Example of DOC > DOCX sanitization Original File Sanitized File DOC DOCX

30 Metadefender Core On-Premises Up to 31 engines in different packages For Windows For Linux Windows Custom Engines

31 File Type Verification Preventing spoofed files Metadefender can block certain file types due to higher risk (e.g. exe) Attackers can rename file extensions and get past filters Metadefender uses file type verification to prevent spoofed files

32 Archive Extraction Deep archive scanning Extract archives Scan individual files of 31 supported archive formats Prevent hidden malware If not extracted, malware may be missed High performance Archive is extracted only once, for all engines Customizable Specify maximum recursion and extraction size

33 Archive Extraction

34 Metadefender Scan Speed Compare scanning speeds With Metadefender optimization, total scanning time of all 7 engines is greatly reduced Multi-scanning with 7 single AV engines

35 Metadefender Scan Speed What is our conclusion: < 2

36 Online Documentation

37 Metadefender APIs Easy integration with your applications APIs for Metadefender on-premises and endpoint REST APIs Robust & easy to use Well documented with sample code Fast performance

38 Thank You!