Skip to content

ESET Performs Best in Inaugural Test of Android Security Apps for Corporate Users

BRATISLAVA – May 27, 2020 – The enterprise version of ESET’s Android mobile security app, ESET Endpoint Security for Android, reached the best score in the first edition of the Android Security Apps for Corporate Users test by AV-TEST, a respected independent testing organization.

“Requirements of businesses differ from those of consumers, so it’s a step in the right direction by AV-TEST to design the Android test specifically for corporate use cases,” says Jiří Kropáč, Head of Threat Detection Labs at ESET.

In the first edition of the new test, three security solutions were tested, including ESET Endpoint Security for Android. In two of the three key parts of the test – Usability and Performance – all three solutions reached the best possible score. In the Protection part of the test, arguably the crucial one, ESET Endpoint Security for Android was the only app to detect 100% of the 3,100-strong sample set.

“This test shows ESET Endpoint security for Android is the right security solution for mobile devices allowed in corporate networks,” comments Kropáč.

The test of corporate Android security apps differs from the test for consumer apps in two main areas.

First, the set of samples for detection reflects the specifics of the business use of Android devices. For example, instead of infected game apps, the testing set contains threats known to target corporate users. Apps for the corporate version of the test were taken exclusively from the official Android app store, Google Play. This eliminates the need for tuning up the protection to also cover obscure types of threats that a corporate user will rarely encounter.

Second, the manageability of the security solution is also considered.

Besides that, the design of the performance test has been slightly adjusted so the new test evaluates the impact on website loading, document reading, or network traffic.

The testing of corporate Android apps was long overdue, according to Kropáč. “Nowadays, corporate internal systems tend to be accessible from mobile devices. Additionally, those devices are often also used for personal purposes. This combined means that the need for reliable corporate mobile security solutions is imminent. And where there is a need for reliability, there is also a need for independent tests.”

The results of the first edition of the test of Android security apps for corporate users can be found on AV-TEST’s website.

Head to ESET’s official Corporate blog, to read an interview with Jiří Kropáč.

Make sure to follow ESET research on Twitter for the latest news from ESET Research.

 

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.

Cyber-espionage group Turla (a.k.a. Snake) now uses Gmail web interface for command and control, ESET discovers

Bratislava, Montreal – ESET researchers have uncovered a new version of one of the oldest malware families run by the Turla group, the ComRAT backdoor. Turla, also known as Snake, is an infamous cyber-espionage group that has been active for more than ten years. The most interesting feature of the updated backdoor is its use of the Gmail web UI to receive commands and exfiltrate data. ComRAT steals sensitive documents, and since 2017 it has attacked at least three governmental institutions. ESET has found indications that this latest version of ComRAT was still in use at the beginning of 2020, showing that the Turla group is still very active and a major threat for diplomats and militaries.

The main use of ComRAT is stealing confidential documents. In one case, its operators even deployed a .NET executable to interact with the victim’s central MS SQL Server database containing the organization’s documents. The malware operators used public cloud services such as OneDrive and 4shared to exfiltrate data. Turla’s latest backdoor can perform many other actions on compromised computers, such as executing additional programs and exfiltrating files.

The fact that the attackers try to evade security software is concerning. “This shows the level of sophistication of this group and its intention to stay on the same machines for a long time,” explains Matthieu Faou, who has investigated the infamous group for several years. “Additionally, the latest version of the ComRAT malware family, thanks to its use of the Gmail web interface, is able to bypass some security controls because it doesn’t rely on any malicious domain,” says Faou.

The backdoor upgrade was first discovered by ESET in 2017. It uses a completely new code base and is far more complex than its predecessors. The most recent iteration of the backdoor that ESET researchers have seen was compiled in November of last year.“

Based on the victimology and the other malware samples found on the same compromised machines, we believe that ComRAT is used exclusively by Turla,” says Faou.

ComRAT, also known as Agent.BTZ, is a malicious backdoor that became infamous after its use in a breach of the US military in 2008. The first version of this malware, likely released in 2007, exhibited worm capabilities by spreading through removable drives.

For more technical details of ComRAT and a full and comprehensive list of Indicators of Compromise (IoCs), please read the full ESET white paper From Agent.BTZ to ComRAT v4: a ten year journey on WeLiveSecurity. Make sure to follow ESET research on Twitter for the latest news from ESET Research.

 

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.

Bratislava, Montreal – ESET researchers have uncovered a new version of one of the oldest malware families run by the Turla group, the ComRAT backdoor. Turla, also known as Snake, is an infamous cyber-espionage group that has been active for more than ten years. The most interesting feature of the updated backdoor is its use of the Gmail web UI to receive commands and exfiltrate data. ComRAT steals sensitive documents, and since 2017 it has attacked at least three governmental institutions. ESET has found indications that this latest version of ComRAT was still in use at the beginning of 2020, showing that the Turla group is still very active and a major threat for diplomats and militaries.

The main use of ComRAT is stealing confidential documents. In one case, its operators even deployed a .NET executable to interact with the victim’s central MS SQL Server database containing the organization’s documents. The malware operators used public cloud services such as OneDrive and 4shared to exfiltrate data. Turla’s latest backdoor can perform many other actions on compromised computers, such as executing additional programs and exfiltrating files.

The fact that the attackers try to evade security software is concerning. “This shows the level of sophistication of this group and its intention to stay on the same machines for a long time,” explains Matthieu Faou, who has investigated the infamous group for several years. “Additionally, the latest version of the ComRAT malware family, thanks to its use of the Gmail web interface, is able to bypass some security controls because it doesn’t rely on any malicious domain,” says Faou.

The backdoor upgrade was first discovered by ESET in 2017. It uses a completely new code base and is far more complex than its predecessors. The most recent iteration of the backdoor that ESET researchers have seen was compiled in November of last year.“

Based on the victimology and the other malware samples found on the same compromised machines, we believe that ComRAT is used exclusively by Turla,” says Faou.

ComRAT, also known as Agent.BTZ, is a malicious backdoor that became infamous after its use in a breach of the US military in 2008. The first version of this malware, likely released in 2007, exhibited worm capabilities by spreading through removable drives.

For more technical details of ComRAT and a full and comprehensive list of Indicators of Compromise (IoCs), please read the full ESET white paper From Agent.BTZ to ComRAT v4: a ten year journey on WeLiveSecurity. Make sure to follow ESET research on Twitter for the latest news from ESET Research.

 

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.

ESET NOD32 產品註冊伺服器將於2020-06-02進行定期維護

為了提供更穩定的服務,ESET NOD32 產品註冊伺服器 (https://www.eset.hk/download/register/) 將於2020-06-02進行定期維護。

不便之處,敬請原諒。

技術支援熱線: (852) 2893 8186
或電郵至: support@eset.hk

關於Version 2

Version 2 Digital 是立足亞洲的增值代理商及IT開發者。公司在網絡安全、雲端、數據保護、終端設備、基礎設施、系統監控、存儲、網絡管理、商業生產力和通信產品等各個領域代理發展各種 IT 產品。透過公司龐大的網絡、通路、銷售點、分銷商及合作夥伴,Version 2 提供廣被市場讚賞的產品及服務。Version 2 的銷售網絡包括台灣、香港、澳門、中國大陸、新加坡、馬來西亞等各亞太地區,客戶來自各行各業,包括全球 1000 大跨國企業、上市公司、公用事業、醫療、金融、教育機構、政府部門、無數成功的中小企及來自亞洲各城市的消費市場客戶。

關於ESET
ESET成立於1992年,是一家面向企業與個人用戶的全球性的電腦安全軟件提供商,其獲獎產品 — NOD32防病毒軟件系統,能夠針對各種已知或未知病毒、間諜軟件 (spyware)、rootkits和其他惡意軟件為電腦系統提供實時保護。ESET NOD32佔用 系統資源最少,偵測速度最快,可以提供最有效的保護,並且比其他任何防病毒產品獲得了更多的Virus Bulletin 100獎項。ESET連續五年被評為“德勤高科技快速成長500 強”(Deloitte’s Technology Fast 500)公司,擁有廣泛的合作夥伴網絡,包括佳能、戴爾、微軟等國際知名公司,在布拉迪斯拉發(斯洛伐克)、布裏斯托爾(英國 )、布宜諾斯艾利斯(阿根廷)、布拉格(捷克)、聖地亞哥(美國)等地均設有辦事處,代理機構覆蓋全球超過100個國家。

總統府釣魚信事件,情境換成假冒董事長、振興券,您的使用者能辨別嗎?

多個立委辦公室電子郵件信箱在總統就職日當晚,都收到一封偽冒總統府的信件,要求前往連結網頁填寫聯絡表單,但實際上這是一封騙取資料的釣魚郵件。根據刑事局的調查分析,釣魚郵件是由外部郵件主機寄發,將寄件者偽裝為總統府寄發的郵件,內容包含的惡意連結則是連到烏克蘭的雲端服務公司。若不慎點選連結,可能會被植入木馬程式、竊取資料!

 

偽冒總統府寄發的郵件



雖然上述案例是針對立委辦公室,一般民眾不會收到來自總統府的信件,但其實駭客一直運用相同的手法,透過高度偽裝的釣魚郵件,搭配社交工程對各種產業、各式企業發動攻擊。這類釣魚郵件大多偽冒精良且手法高招讓人難以肉眼分辨,巧妙運用與收件者切身關聯或有興趣的議題,引誘收件者執行指示動作,如點選惡意連結或惡意附件,再進一步竊取帳密或安裝木馬程式,做為下一次攻擊的可用工具。

假如,將這些偽冒精良的郵件情境換成假冒董事長寄發的信,或來自政府機關的振興券消息,您的使用者都能夠辨別嗎?

企業防禦這類郵件的不二法門,仍是設法提供使用者相較安全的郵件使用環境,避免他們接觸到這類郵件。例如運用中華數位科技 SPAM SQR進行惡意威脅郵件攔截。SPAM SQR 內建惡意檔案分析、威脅感知、智能詐騙等多種引擎與惡意網址資料庫,可整合防毒與動態沙箱等機制,以多層式過濾方式,針對內寄郵件內容及附件內容進行掃描,更全面防禦釣魚等惡意郵件。
另外,避免企業成為被駭客偽造冒名的工具,可運用 SPAM SQR 防偽認證模組,防止認證通過的帳號,利用他人名義發信,降低偽造企業人員發送黑函、釣魚、詐騙郵件的風險。

然而,使用者的安全意識仍舊是資安防護最重要的一道防線。因此,除了提供安全的郵件使用環境,輔以教育訓練與社交工程演練,加強企業防線。透過定期舉辦社交工程講習與社交工程演練,來提升使用者資安意識、分析演練成效,來找出企業中需要強化的環節,才能有效降低企業的安全風險!

更多防禦方式,請參考中華數位科技【釣魚郵件解決方案】

關於Version 2

Version 2 Digital 是立足亞洲的增值代理商及IT開發者。公司在網絡安全、雲端、數據保護、終端設備、基礎設施、系統監控、存儲、網絡管理、商業生產力和通信產品等各個領域代理發展各種 IT 產品。透過公司龐大的網絡、通路、銷售點、分銷商及合作夥伴,Version 2 提供廣被市場讚賞的產品及服務。Version 2 的銷售網絡包括台灣、香港、澳門、中國大陸、新加坡、馬來西亞等各亞太地區,客戶來自各行各業,包括全球 1000 大跨國企業、上市公司、公用事業、醫療、金融、教育機構、政府部門、無數成功的中小企及來自亞洲各城市的消費市場客戶。

關於中華數位科技 Softnext Technologies Corp.
創立於2000年8月。
秉持著【We Secure Your Content】的服務理念,以提供企業資訊應用管理服務及打造資訊內容安全防護為宗旨。專精於提供網路應用服務技術,根據市場需求推出多款資訊內容安全的解決方案及應用服務,能夠協助企業透過符合資安管理規範並遵循法規的方式進行資訊內容安全管理,以維護員工的生產力、提升企業經營績效。

×

Hello!

Click one of our contacts below to chat on WhatsApp

×