HitmanPro.Alert 3

[wojek]

Ukazał się HitmanPro.Alert 3.0.12 build 63 CTP1 (Community Technology Preview 1).
Jest to wersja 3 programu, której oczekiwaliśmy od lutego, gdy poinformowano o pracach nad nią.
Zawiera moduł anty-exploitowy oraz kilka innych nowych funkcjonalności.

Oto informacje podane przez dewelopera wraz z linkiem do pobrania:

HitmanPro.Alert 3.0.12 build 63 CTP1

HitmanPro.Alert 3 Community Technology Preview 1 is now available!

With version 3 we deliver comprehensive exploit protections and anti-espionage technologies to both home users and IT professionals.
The software works in real-time and does not rely on signatures or the cloud.

NOTE: HitmanPro.Alert 3 CTP1 is pre-release software and should not be used in production environments.

Hardware-Assisted Control-Flow Integrity (CFI)
Alert version 3 introduces hardware-assisted control-flow integrity, which leverages special Intel CPU hardware registers
to monitor how software executes on the CPU. This allows Alert 3 to detect sophisticated return-oriented programming (ROP) attacks.
Read chapter 2.5 of the Exploit Test Tool manual (provided in the download below) for supported Intel CPUs.

New Features (compared to version 2)

Exploit Mitigation
Active Vaccination
Keystroke Encryption
Webcam Notifier
Hollow Process blocker
Integrates with HitmanPro

Exploit Test Tool
To verify the correct working of HitmanPro.Alert we have developed an Exploit Test Tool. This safe and easy-to-use tool can perform
over a dozen exploit techniques that attackers currently use to compromise computers from remote.
The Exploit Test Tool can also act like a keylogger and access the webcam. A manual is provided in the download below.

Download

[Aby zobaczyć linki, zarejestruj się tutaj]

License
Exploit Mitigation requires a valid HitmanPro license. A trial license is available from within the application.
The regular HitmanPro paid license will work as well and is available from our online shop.
HitmanPro.Alert 3 is free software if you already own a license for the HitmanPro on-demand anti-malware software.

Users who would like to try the software beyond the trial period can send me a PM for an extended trial key.

Known Issues

Malwarebytes Anti-Exploit is currently incompatible with HitmanPro.Alert, but the Exploit Test Tool is compatible.
AutoIt applications like AdwCleaner show a warning when started. Temporarily disable Active Vaccination allows the AutoIt application to run.
Webcam Notifier works with standard webcams. Webcams using vendor specific drivers are currently not yet supported.
Alert counters in the UI are currently disabled but exploit detections are logged in the Windows Event Log.
Alert 3 is currently incompatible with Emsisoft Anti-Malware on 64-bit versions of Windows.

Please report issues via PM or email <!-- e --><a href="mailto:[email protected]">[email protected]</a><!-- e -->.

[Aby zobaczyć linki, zarejestruj się tutaj]

Okres próbny trwa 30 dni; aby go przedłużyć, trzeba napisać do dewelopera na adres mailowy podany powyżej.

Ponieważ jest to wersja CTP1, nie zaleca się instalować jej użytkownikom,
którym szczególnie zależy na stabilności pracy ich OS oraz używanych programów i aplikacji.

Bardzo ciekawie zapowiada się konkurencja z innym produktem anty-exploitowym, czyli MBAE,
który niedawno ukazał się w wersji stabilnej i cieszy się dużym zainteresowaniem.

[zbc]

Szkoda, że będzie płatny
Wiesz może wojek, jakie funkcje będą za darmo?

[wojek]

Wszystkie funkcje obecne już w HMPA 2.x pozostaną bezpłatne.
Moduł anty-exploitowy będzie płatny i dostępny po wykupieniu standardowej licencji na HMP.
Pozostałe, nowo wprowadzone funkcjonalności - nie wiem.

[ichito]

Działa bardzo ładnie, znaczy się lekko i bezproblemowo...zauważyliście, że aplikacje chronione mają obwódkę wokół okna...widać ja dopiero po najechaniu na krawędź okna/ekranu...jak w Run Safer w OA czy w BufferZone

[wojek]

Wygląda na to, że HMPA 3 nakłada poważne ograniczenia sprzętowe; oto cytat z manuala (HitmanPro.Alert Exploit Test Tool Manual 1.0):

HitmanPro.Alert will automatically employ Intel MSR hardware registers when it e.g. detects a 2nd, 3rd or 4th generation (or newer) Core i3, i5 or i7 processor (CPU)
– from 2011 and later – based on microarchitecture codenamed Sandy Bridge 1 , Ivy Bridge 2 , Haswell 3 (or newer); Nehalem and Westmere are not supported.
E.g. desktop and mobile processors with model numbers 2xxx, 3xxx, and 4xxx (e.g. Intel Core i5-4288U) are supported.

To dość poważne restrykcje, bo chyba (?) wykluczają np. procesory Core2Duo, czy Quadcore,
które przecież nie są aż takie stare. Wygląda zatem na to, że wielu użytkowników Windows XP
raczej nie nacieszy się HMPA 3, bo często sprzęt z tym OS nie jest już pierwszej młodości.

Jak to w praktyce wygląda, tzn. czy program w ogóle nie działa (i czym się to objawia), lub czy działa tylko
w ograniczonym zakresie (np. nie działają niektóre funkcjonalności), trudno mi powiedzieć.

I jeszcze jedno info: HMPA 3 ma własny test anty-exploitowy, któremu można poddać też MBAE i EMET.

[markloman]

Wygląda na to, że HMPA 3 nakłada poważne ograniczenia sprzętowe; oto cytat z manuala (HitmanPro.Alert Exploit Test Tool Manual 1.0):

HitmanPro.Alert will automatically employ Intel MSR hardware registers when it e.g. detects a 2nd, 3rd or 4th generation (or newer) Core i3, i5 or i7 processor (CPU)
– from 2011 and later – based on microarchitecture codenamed Sandy Bridge 1 , Ivy Bridge 2 , Haswell 3 (or newer); Nehalem and Westmere are not supported.
E.g. desktop and mobile processors with model numbers 2xxx, 3xxx, and 4xxx (e.g. Intel Core i5-4288U) are supported.

To dość poważne restrykcje, bo chyba (?) wykluczają np. procesory Core2Duo, czy Quadcore,
które przecież nie są aż takie stare. Wygląda zatem na to, że wielu użytkowników Windows XP
raczej nie nacieszy się HMPA 3, bo często sprzęt z tym OS nie jest już pierwszej młodości.

Jak to w praktyce wygląda, tzn. czy program w ogóle nie działa (i czym się to objawia), lub czy działa tylko
w ograniczonym zakresie (np. nie działają niektóre funkcjonalności), trudno mi powiedzieć.

I jeszcze jedno info: HMPA 3 ma własny test anty-exploitowy, któremu można poddać też MBAE i EMET.

The mentioned hardware isn''t actually a requirement. The exploit mitigations will work quite nicely if you have any other CPU, as mentioned in the same manual, in the same paragraph:

HitmanPro.Alert will automatically fallback on software-only Control-Flow Integrity checks if your computer does not have a hardware-assisted CFI supported processor.

Hardware-assisted CFI allows Alert 3 to query the CPU on which branches it took before reaching a checkpoint. This in contrast to EMET which can only traverse the stack to see what is going to happen next. Since the stack is under control of an attacker, you can serve EMET a fake stack, which obviously has consequences. To illustrate, Alert can block this attack just by analyzing the branches the CPU took:

[Aby zobaczyć linki, zarejestruj się tutaj]

We''ve included a ''Jared DeMott'' like exploit in our Exploit Test Tool to illustrate (ROP 4, via CALL). You''ll see that EMET doesn''t detect and Alert does.

NOTE: MBAE currently does not mitigate ROP attacks at all.

[zbc]

Welcome developer HMPA!

[wojek]

Mark, thanks a lot for your detailed explanation.

[wojek]

Wiesz może wojek, jakie funkcje będą za darmo?

Mamy już odpowiedź na to istotne pytanie; za darmo będą następujące nowe funkcjonalności:

Active Vaccination
Webcam Notifier
Keystroke Encryption
Hollow Process blocker
HitmanPro integration
Colored border around application (e.g. red border when browser is unsafe to use)
Overall improvements

Zatem płatny będzie tylko ''wspierany sprzętowo'' moduł anty-exploitowy.

[Aby zobaczyć linki, zarejestruj się tutaj]

[zbc]

Wiesz może wojek, jakie funkcje będą za darmo?

Mamy już odpowiedź na to istotne pytanie; za darmo będą następujące nowe funkcjonalności:

Active Vaccination
Webcam Notifier
Keystroke Encryption
Hollow Process blocker
HitmanPro integration
Colored border around application (e.g. red border when browser is unsafe to use)
Overall improvements

Zatem płatny będzie tylko ''wspierany sprzętowo'' moduł anty-exploitowy.

[Aby zobaczyć linki, zarejestruj się tutaj]

Dzięki!!!
Czekam na zgodność z MBAE.

Emsisoft on x64 is in the known issues list.

Ajj

[wojek]

Ukazała się wersja HMPA 3 CTP2.

Informacje od dewelopera wraz z linkiem do pobrania:

Today we release the second Community Technology Preview of HitmanPro.Alert 3. This release bears the version number 3.0.12.73 CTP2.

Release notes

Added ability to protect custom applications against vulnerability attacks. Users can now use the ‘Running applications’ dialog under ‘Exploit mitigations’,
which offers a user-friendly overview of the running applications and the ability to choose and protect applications against vulnerability attacks.
Added automatic exploit protection for ''Skype for Windows desktop''.
Added automatic detection of media applications to the built-in software radar. This means that applications that can open music
or video files are automatically protected against exploit attacks (e.g. Windows Media Player, VLC media player, etc.)
Added a notification and ability to restart an application when the user updated its exploit mitigation settings.
Added ability to remove exploit mitigations from configured applications.
Added tray icon to summon the main user interface, scan the computer or check for updates.
Improved detection of uninstalled applications so that they are no longer listed under ‘Your web browsers’ or ‘Your applications’.
Improved the software radar to also detect 64-bit applications with 32-bit registrations; e.g. WordPad on 64-bit Windows is now correctly recognized.
Improved detection and blocking of malware downloads initiated from attacker-controlled memory.
Improved support for the Opera web browser, including Opera Next and Opera Developer.
Improved compatibility of ‘Active vaccination’ with installed applications.
Enabled the checkbox to ‘Perform malware scan after installation’ on the Install dialog.
Solved input lag that occurred in games like Battlefield 4.
Solved compatibility issue with some 64-bit security software, like Emsisoft Anti-Malware.
Many small fixes and improvements.

Remarks and known issues

Values of ‘Number of alerts’ and ‘Last alert shown’ in the main user interface are currently not available, but any exploit detection will be logged in the Windows Event Log.
Webcam Notifier works with webcams that use the Windows usbvideo.sys driver. Webcams using vendor specific drivers are currently not supported.
AutoIt applications like AdwCleaner show a warning when started. Temporarily disabling ‘Active vaccination’ in HitmanPro.Alert allows the AutoIt application to run.
The checkbox ‘Show border around applications’ under ‘Safety notification’ is currently checked and locked on purpose.
Sandboxie and Norton Security with Backup version 22 (BETA) can interfere with the drawing of the notification border around protected applications.
Agnitum Outpost Firewall on 64-bit versions of Windows is currently incompatible with HitmanPro.Alert 3.
Malwarebytes Anti-Exploit is currently incompatible with HitmanPro.Alert, but our Exploit Test Tool is compatible.

Download

[Aby zobaczyć linki, zarejestruj się tutaj]

Installation notes
If you''re already running CTP1, you must first uninstall CTP1, reboot the computer and then install CTP2.

NOTE: HitmanPro.Alert 3 CTP2 is pre-release software and should NOT be used in production environments.

[Aby zobaczyć linki, zarejestruj się tutaj]

[wojek]

Mamy już odpowiedź na to istotne pytanie; za darmo będą następujące nowe funkcjonalności:

Active Vaccination

Drobna korekta: okazuje się, że funkcja Active Vaccination jednak będzie płatna.

[Aby zobaczyć linki, zarejestruj się tutaj]

[zord]

Niestety program wymaga jeszcze mnóstwa pracy.

Tu można zobaczyć jak radzi sobie albo raczej nie radzi z cryptolokerem

[Aby zobaczyć linki, zarejestruj się tutaj]

[wojek]

Ciekawe, zwłaszcza że dotyczy ostatniej/bieżącej stabilnej wersji HMPA 2.6.5,
która miała być jakoś-tam dopracowana co do ochrony przeciw CL.

[tachion]

Przed CTB-Locker (Critroni.A) też nie chroni,no cóż twórcy 0day i różnej maści krypterów,packerów są zawsze o jeden krok do przodu.
Ochrona programem HMPA zależy głównie od wzorców zachowań,czyli głównie jest to oparte o metodę wykrywania behawioralnego.

[wojek]

Ciekawe, co z AppGuardem i tym małym programem CryptoPrevent?
Niestety, sam nie testuję...

[tachion]

Ta wersja 3.0.12.73 CTP2 chroni przed Citroni
Wcześniej testowałem 2.6.5.7.7 i poległ.

[wojek]

Pod wideo zalinkowanym przez Zorda jest zacytowana odpowiedź
przedstawiciela SurfRight na to nowe zagrożenie (nazwane ''Support at casinomtgox.com''):

This new variant is not picked up by our CryptoGuard in Alert
because the cybercriminals behind this new variant have devised a new approach.
Alert is capable of blocking CryptoLocker, CryptDefense and CryptoWall but not this new variant.
The new variant creates an encrypted copy of each file and removes the original file.
We are currently working on HitmanPro.Alert 3 and will update CryptoGuard
as well to address this new approach of this variant.

[wojek]

Nowe wideo od Britec - tym razem HMPA radzi sobie z kolejną wersją CryptoLockera:

[Aby zobaczyć linki, zarejestruj się tutaj]

HMPA 3 nie jest kompatybilny z nową wersją EMET 5.0:

Today Microsoft has announced the general availability of EMET 5.0.
While HitmanPro.Alert 3 CTP1 and CTP2 were compatible with the EMET 5.0 Technical Preview,
the updated EAF mitigation in EMET 5.0 GA can prevent programs from opening when both EMET 5.0 and HitmanPro.Alert 3 CTP2 are on the same computer.
We''re investigating and addressing it in CTP3. In the meantime you could either use EMET 4.1 U1 instead of EMET 5.0 GA,
remove HItmanPro.Alert 3 or disable the EAF mitigation in EMET 5.0 GA.

Feel free to test the anti-exploit capabilities of EMET 5.0 using our Exploit Test Tool, available in the HitmanPro.Alert 3 CTP2 download.
Before testing, don''t forget to add our applications hmpalert-test.exe and hmpalert64-test.exe to EMET to apply the protection.

[Aby zobaczyć linki, zarejestruj się tutaj]

[wojek]

Ukazała się wersja HMPA 3 CTP3.

Informacje od dewelopera:

With each Community Technology Preview (CTP) of HitmanPro.Alert 3 we introduce new features for compatibility testing.
CTP1 was our first development release of HitmanPro.Alert 3 wherein we introduced our hardware-assisted exploit mitigations.
A few weeks later, with CTP2, we added the ability for users to add and protect custom applications through an easy-to-use Running Applications interface.

Now, for CTP3 we enabled our network inspection driver and Java lockdown, while we also expanded support to
all Intel Core i3, i5 and i7 processors for our hardware-assisted mitigations.

As before, this preview is released here at Wilders Security Forum only. A CTP is not to be used in production environments
and for extra clarity we also added the "Not for review" phrase to this build. This as not all features are fully implemented yet.

Release notes

Improved hardware-assisted control-flow integrity (CFI) for detection of sophisticated ROP attacks.
CFI now supports all Intel Core i3, i5 and i7 processors from November 2008 and later, including codenames Nehalem, Westmere, Sandy Bridge, Ivy Bridge and Haswell.
Improved stack-based ROP mitigation for legacy Windows XP in virtual environments.
Improved repetition-based detection of attack code that starts via the heap (Dynamic Heap Spray).
Improved recognition of attacker-executed processes.
Improved compatibility with local Java applications and games.
Improved Restart Application handling when altering exploit mitigations of in-use applications.
Improved malware scan after installation.
Improved detection of Java runtime and added more media file types to the Software Radar.
Enabled network inspection layer to analyze and log attack pages.
Enabled the Java Lockdown security feature to block communication channels from malicious Java applications in the browser.
Enabled the alert counters on the main window.
Fixed BSOD on legacy Windows XP running on physical machine with Intel Core processor from 2011 or newer.
Fixed prolonged “Please wait” during boot on some computers.
Fixed compatibility issue with video streaming on e.g. Magine.com, which employs Digital Rights Management (DRM).
Fixed compatibility issue with the Microsoft MPEG2 audio and video plug-in.
Fixed compatibility issue with iTunes for Windows.
Fixed a memory leak in internal message handling.
Fixed event ID 6281 that caused audit failures.
Removed "New Process" and "Deny New Process" from Exploit Mitigations as they are now automatic and integrated into other mitigations.
Updated the Exploit Test Tool with two additional return-oriented programming exploit techniques: “ROP – system() in msvcrt” and “ROP – WinExec() via anti-detour”.
Updated the Exploit Test Tool Manual with an important note (in paragraph 2.5.1) on testing in virtual environments, advantage of our hardware-assisted technology (paragraph 2.5)
over software stack-based approaches and background information on the two new ROP tests.

Remarks and known issues

Webcam Notifier works with webcams that use the Windows usbvideo.sys driver. Webcams using vendor specific drivers are currently not supported.
AutoIt applications like AdwCleaner show a warning when started. Temporarily disabling ‘Active vaccination’ in HitmanPro.Alert allows the AutoIt application to run.
The checkbox ''Show border around applications'' under ''Safety notification'' is currently checked and locked on purpose.
HitmanPro.Alert 3 is currently not compatible with Sandboxie on Windows Vista.
Sandboxie and Norton (Internet) Security can interfere with the drawing of the notification border around protected applications.
Agnitum Outpost Firewall on 64-bit versions of Windows is currently incompatible with HitmanPro.Alert 3.
The Export Address Table Access Filtering (EAF) module of Microsoft EMET 5.0 is currently incompatible with HitmanPro.Alert 3, but our Exploit Test Tool is compatible.
Microsoft EMET 4.1 Update 1 is fully compatible with HitmanPro.Alert 3.
Malwarebytes Anti-Exploit is currently incompatible with HitmanPro.Alert 3, but our Exploit Test Tool is compatible

Download

Please uninstall previous versions of Alert before installing CTP3.

Reporting issues

Please report issues via PM or via email: <!-- e --><a href="mailto:[email protected]">[email protected]</a><!-- e -->.
Please send me a PM if you need a product key for testing purposes.

Link do pobrania jest w oryginalnym poście na forum Wilders Security:

[Aby zobaczyć linki, zarejestruj się tutaj]