Comments on Infosec Potpourri: Comparing Automated Malware Analysis Services

A few more:

http://camas.comodo.com/
htt...

2009-01-14T01:06:00.000-05:00

A few more:

http://camas.comodo.com/
http://anubis.iseclab.org/
http://www.joebox.org/

And here you can get Web-based results for CWSandbox: http://www.cwsandbox.org/

It's too bad I didn't see this post earlier! Thank...

2007-04-03T19:38:00.000-04:00

It's too bad I didn't see this post earlier! Thank you for the kudos on our product. A couple clarifications on the post and comments:
- 'Sandbox' is a generic term, used by Norman, Sunbelt and others to describe the process of 'sandboxing' an app, malware or otherwise. Our product is hence, CWSandbox.
- The Sunbelt CWSandbox is based on Carsten Willems' CWSandbox project and we collaborate closely with his team.
- With respect to the reporting, that's more or less correct, the publicly accessible version isn't always in sync with the latest, nor is all the detailed exposed in the HTML report.
- Chad, Sunbelt-Software.

David,

I did some research on the companies...

2006-11-10T17:24:00.000-05:00

David,

I did some research on the companies mentioned in this posting and I came across a couple of news announcements that sounded confusingly similar. Perhaps you could shed some light here. One was from Sunbelt Software titled: Sunbelt Software Introduces Automated Sandbox Technology to Enable Rapid, Safe and Accurate Analysis of Malware (see: http://www.sunbelt-software.com/Press.cfm?id=164)

The other one was from Norman titled: Norman's Sandbox Analysis Tools Enable UK Organizations To Deal with Unknown Malware and Targeted Security Threats (see: http://sourcewire.com/releases/rel_display.php?relid=27810&hilite=)

The content of the press releases is eerily similar (is one ripping off the other?). One thing that did interest me was the following statement by Norman's CEO, Trygve Aasland in the Norman press release:

“The corporate information security market is seeing a shift away from mass attacks towards numerous individual, sophisticated attacks – often mounted by criminal gangs - that as a result pass “under the radar” of heuristic and signature-based technologies. Our new SandBox tools will help organizations take action against specific attacks by allowing the nature of the threat launched against them to be understood.”

“In particular, users urgently require analytical technologies which detect and categorize sophisticated targeted attacks, based on new forms of malicious code which are only detectable by their abnormal behavior. Used alongside other techniques in a multi-level security hierarchy, SandBox tools empower organizations to defend against targeted attacks and organized online criminal activity.”

Do you think Sunbelt and Norman are on to something unique here? Is this a better approach to dealing with malware threats?

Well, they do list Symantec on the page you mentio...

2006-10-25T08:45:00.000-04:00

Well, they do list Symantec on the page you mentioned, but it's not included on the report itself, so I can't say that they're supporting it at all. I've heard from at least one other person that Symantec was showing up on reports at least a few weeks ago, so perhaps this is just a temporary thing.

VirusTotal does support Symantec.

http://...

2006-10-24T13:43:00.000-04:00

VirusTotal *does* support Symantec.

http://www.virustotal.com/en/virustotalf.html

The missing heavyweight is Trend Micro. The VirusTotal folks say that they approached Trend Micro but Trend Micro refused to participate.

Comments on Infosec Potpourri: Comparing Automated Malware Analysis Services

A few more:http://camas.comodo.com/htt...

It's too bad I didn't see this post earlier! Thank...

David,I did some research on the companies...

Well, they do list Symantec on the page you mentio...

VirusTotal *does* support Symantec.http://...

A few more:

http://camas.comodo.com/
htt...

David,

I did some research on the companies...

VirusTotal does support Symantec.

http://...