The OPSWAT Metadefender Vulnerability Engine identifies known application vulnerabilities and reports them by severity level. The Vulnerability Engine allows system administrators to identify vulnerabilities in files and data being brought into a secure network and on endpoints within a network, significantly expediting remediation of the issue.

Common Vulnerabilities and Exposures (CVE) is a catalog of publicly known cyber security vulnerabilities that's sponsored by the United States Department of Homeland Security. The first table below lists the new CVEs and product versions for which support was added to the Metadefender database during the week of April 10-17, 2017. The second table lists the hashes and application installers for which support was added.

Learn more about the Metadefender Vulnerability Engine:

LEARN MORE

Newly Supported CVEs and Product Versions as of April 17, 2017

Newly Supported Hashes and Installers as of April 17, 2017

With botnets, DDoS attacks, and secret lists of exploits being all over the news in recent months, vulnerabilities should be top of mind for anyone who's concerned with cyber security, especially vulnerabilities in consumer devices.

While CISOs, IT administrators, and other security professionals will know better than to allow unsecured, vulnerable IoT devices in internal networks, the personal devices employees connect to networks can be just as risky.

BYOD environments, according to 2016 data from the Harvard Business Review, may actually be on the decline. However, more employees than ever are bringing personal devices to the office – perhaps even in defiance of organizational security requirements. "BYOD increased from 80% to 90% overall although the 'officially allowed' [BYOD policies] dropped by 18 percentage points," wrote Jane McConnell for the Harvard Business Review.

Those personal devices are often rife with known-yet-unpatched vulnerabilities.

Android devices, for example, are rarely updated by their users. In March 2017, Wired reported that "half of Android devices [went] unpatched in 2016." Even more chilling: "Less than three percent of Android phones run the operating system's latest version, Nougat." (Devices that run iOS have low update rates as well.)

Users remain the No. 1 weak link in security architecture. User reluctance to install updates and apply patches appears to be persistent. Such reluctance leaves their devices prone to exploits, obviously – but when those devices come into contact with corporate networks, the user's exposure becomes the organization's exposure.

It is likely that the best solution to the problem of user-introduced vulnerabilities is a combination of more robust network access control and better user education.

Network access control solutions can limit or block access for noncompliant devices. OPSWAT and OPSWAT's partners offer a number of solutions for more robust network access control.

User education is another major area where much progress can be made. Users may not fully comprehend the sheer volume of threats awaiting them and their employers on the internet – the place where they shop, socialize, read, entertain themselves, and conduct business every day. And they may not realize just how important it is to install updates and keep software updated in order to patch vulnerabilities.

They may not even be familiar with the concept of "vulnerabilities" or the necessity of security patches.

Five out of 6 users are not even aware of Android security patches, according to a recent survey. User obstinance would be an uncorrectable problem; user ignorance, on the other hand, can be addressed with training and education.

And finally, solutions like Metadefender Endpoint Management can aid with the problem of vulnerable user devices by checking the security and compliance posture of all endpoint devices connected to a network.

Last week, our channel partners from all over the world joined us at our headquarters for the OPSWAT Channel Partner Conference in San Francisco, California.

Our channel partners distribute OPSWAT products, including Metadefender and all its deployments, to global markets. We partner with them to ensure that organizations around the world have access to OPSWAT's unique data sanitization (Content Disarm and Reconstruction), vulnerability assessment, and multi-scanning technologies.

OPSWAT Channel Partners Conference seminar group shot

Throughout the conference, the OPSWAT product management team led sales training sessions and product overview seminars, presenting product road map updates and case studies for all of OPSWAT's products and deployments, including Metadefender Core and Kiosk.

Additionally, several of our partners and clients presented their success stories and experiences with our team and our products.

Left: Benny Czarny, CEO and Founder of OPSWAT, presents

Right: Tory Pitts, Director of Global Channel Partner Programs at OPSWAT, gets ready to speak

Benny Czarny speaks at one of the sessions

Throughout the year, OPSWAT co-hosts events with channel partners. During last week's event, we presented our road map for these events, and shared our messaging focus and marketing strategy going forward.

You can learn more about the OPSWAT Channel Partner program here.

LEARN MORE

Showing off Metadefender Kiosk

There was time for some fun at the conference, too. On Wednesday evening, OPSWAT employees and channel partners toured Anchor Brewing, which is located just a few blocks away from the OPSWAT office. (Anchor Brewing was originally located in OPSWAT's current headquarters!)

Touring Anchor Brewery

On Thursday afternoon, we all went on a cruise of the San Francisco Bay for dinner and drinks on the water, and on Friday, we closed out the conference with food trucks and a happy hour.

Dining and cruising on the San Francisco Bay

Happy hour Friday afternoon

OPSWAT-themed cookies served at happy hour!

Our channel partners are a major key to OPSWAT's continued success, and we'd like to thank them for coming out to San Francisco. We look forward to continuing our mutually beneficial partnerships.

OPSWAT has several upcoming events if you'd like to meet and talk with us about our products or the channel partner program.

• April 26: Webinar - Enhance Your Email and Web Proxy for Better Ransomware Prevention (Sign Up)
• May 5, Dallas, Texas: Cyber Security Summit
• May 10-12, Tokyo, Japan: Japan IT Week

See the rest of our upcoming events on the OPSWAT Events page.

Contact OPSWAT today to set up a meeting or learn more about becoming a channel partner.

See you at next year's conference

The OPSWAT Metadefender Vulnerability Engine identifies known application vulnerabilities and reports them by severity level. The Vulnerability Engine allows system administrators to identify vulnerabilities in files and data being brought into a secure network and on endpoints within a network, significantly expediting remediation of the issue.

Common Vulnerabilities and Exposures (CVE) is a catalog of publicly known cyber security vulnerabilities that's sponsored by the United States Department of Homeland Security. The first table below lists the new CVEs and product versions for which support was added to the Metadefender database during the week of April 17-24, 2017. The second table lists the hashes and application installers for which support was added.

Learn more about the Metadefender Vulnerability Engine:

LEARN MORE

Newly Supported CVEs and Product Versions as of April 24, 2017

Newly Supported Hashes and Installers as of April 24, 2017

Endurance Antivirus, an anti-malware solution offered by Edelweiss, has been awarded Bronze certification for the Anti-malware category by the OPSWAT Certified Security Application Program. Originally launched in 2007, OPSWAT's certification program currently supports over 1,000 applications from various anti-malware engines to ensure their compatibility with all leading access control solutions, their detection quality, and their false positive responsiveness.

Endurance Antivirus is an anti-malware solution from Romanian technology company Edelweiss. Edelweiss is constantly working hard on making the Endurance Antivirus application better and more useful for their users. OPSWAT certified Endurance Antivirus after determining it met a number of strict criteria established by OPSWAT, and Endurance Antivirus will now be listed as an OPSWAT Bronze Certified security application.

The OPSWAT Certified Security Application Program helps endpoint security applications vendors certify regularly. IT administrators can browse OPSWAT's list of certified applications to find effective, compatible applications for their security stack. The certification program was first developed after gathering compatibility requirements from over 50 OPSWAT OEM customers.

Cristina Stet, Certification Manager at OPSWAT, said, "We're excited to announce the Bronze-level certification of Endurance Antivirus. This anti-malware solution from Edelweiss is compatible with leading access control solutions and will be listed on the OPSWAT website as a certified anti-malware application."

Edelweiss and OPSWAT encourage all cyber security solution vendors to learn more about the OPSWAT Certified Security Application Program, and to certify their latest versions prior to public release. OPSWAT recommends that IT administrators check OPSWAT's index of certified security applications before buying a new solution.

About Endurance Antivirus

Endurance Antivirus scans all files and folders in a user's system thoroughly. Its scanning engine has passed all the EICAR test files and detects over 4 million kinds of malware. With the advancement of technology and the internet era, it is very likely that systems can get infected quickly, corrupting the device. Viruses can attack a system in any form, which makes it necessary to keep all files safe and uncorrupted. Endurance Antivirus has an intuitive user interface with great performance. The app quickly performs a thorough scan of all the files in a system. Upcoming releases will also focus on a new look for the product with more usability options, along with features to detect new viruses. Download the app and keep systems constantly protected from malware. The antivirus app is daily updated to detect new malware. Stay updated and stay protected with Endurance Antivirus.

About Edelweiss

Based in Bistrita, Romania, S.C. Edelweiss SRL has over a decade of experience developing its products. Edelweiss develops and sells Endurance Antivirus, which is available on the Mac App Store and through MacUpdate.

About OPSWAT

OPSWAT is a San Francisco-based cyber security software company that provides solutions to secure and manage IT infrastructure. Founded in 2002, OPSWAT has delivered solutions and technologies that protect organizations from threats and secure digital data for over a decade. OPSWAT combines next-generation Content Disarm and Reconstruction technology, its cutting-edge Vulnerability Engine, and multi-scanning with over 30 anti-malware engines in its Metadefender suite of products, and its OESIS Framework endpoint security SDK has helped secure over 200 million endpoints. To learn more about OPSWAT, visit OPSWAT.com.

A vulnerability is a security flaw in an application that attackers can exploit. Vulnerabilities leave software and systems open to all sorts of cyber attacks.

Software vendors repair these vulnerabilities in the form of patches or software updates, but if those updates are not installed by the user, the system will remain vulnerable to exploits. For this reason, vulnerabilities are a major security risk for many organizations. IT administrators and security officers need to be able to quickly detect and assess vulnerabilities present on endpoints in a network.

In this blog post, we will demonstrate how outdated software can be exploited in order to install ransomware, and how to prevent this with the OPSWAT Vulnerability Engine.

Exploiting a Vulnerability to Install Ransomware

For comparison, we used two systems: The first ran Windows 7 and had Acrobat Reader 17.9 installed, while the second one had Windows XP and Acrobat Reader 8.1. We created a simulated "malicious" PDF file which would exploit a vulnerability in Acrobat Reader 8.1, and we used the same file to test both systems. Such a file could be delivered to a victim via a phishing attack, or a number of other methods.

Click image to expand

Acrobat Reader 17.9 could safely and successfully open the malicious PDF like normal, without any kind of exploit taking place.

Click image to expand

However, when we opened this PDF in the second system with Acrobat Reader 8.1...

Click image to expand

...Adobe Reader crashed.

Click image to expand

Next, the malware automatically created an executable file and the file executed itself, and then...

Click image to expand

...within seconds the executable file encrypted all the files in the system.

Click image to expand

Finally, the following pop-up appeared:

Click image to expand

Basically, the malicious PDF exploited CVE-2008-2992 to cause buffer overflow, executed a script to download ransomware from a server, and then ran the ransomware!

Detect Vulnerabilities with the OPSWAT Vulnerability Engine

Let's try using the OESIS Endpoint Assessment Tool, which integrates with the OPSWAT Vulnerability Engine, to scan the two systems described above.

In the first system, the tool detected Adobe Reader 17.9.

Click image to expand

Taking a look at the details, we can see that no vulnerabilities were found in Acrobat Reader 17.9.

Click image to expand

In the second system, the Vulnerability Engine detected Acrobat Reader 8.1.

Click image to expand

It detected a lot of vulnerabilities in Acrobat Reader 8.1 (identified by CVE ID), and one of them is CVE-2008-2992.

Click image to expand

Key Takeaways

If applications are not fully patched and updated, malicious software – in this example, ransomware – can infect a system in the amount of time it takes to open a document.

This is why it is so essential to gain visibility into all vulnerabilities present on a system; typically, because any given system will have a multitude of applications installed, there will be multiple vulnerabilities of varying severity.

The OPSWAT Vulnerability Engine provides a report on the vulnerabilities present on a system or network within just a few moments.

Learn more about the OPSWAT Vulnerability Engine here.

The below chart will be updated as new releases are available, so check back on our blog for regular updates.

The current releases of each Metadefender product are the following:

The OPSWAT Metadefender Vulnerability Engine identifies known application vulnerabilities and reports them by severity level. The Vulnerability Engine allows system administrators to identify vulnerabilities in files and data being brought into a secure network and on endpoints within a network, significantly expediting remediation of the issue.

Common Vulnerabilities and Exposures (CVE) is a catalog of publicly known cyber security vulnerabilities that's sponsored by the United States Department of Homeland Security. The first table below lists the new CVEs and product versions for which support was added to the Metadefender database during the week of April 24-May 1, 2017. The second table lists the hashes and application installers for which support was added.

Learn more about the Metadefender Vulnerability Engine:

LEARN MORE

Newly Supported CVEs and Product Versions as of May 1, 2017

Newly Supported Hashes and Installers as of May 1, 2017

Using data sanitization (or content disarm and reconstruction, CDR), vulnerability assessment, and multi-scanning, Metadefender detects and prevents both known and unknown threats. Each week, we recap the top threats blocked by OPSWAT's free version of Metadefender Cloud, which offers free multi-scanning and data sanitization (with some limitations).

This week, a number of archive files and compressed files are included in the scan results. Metadefender Cloud uses archive extraction to scan for threats hidden within compressed files and archive files. Be sure to click the links in the far right column to see details about threats found in the extracted files.

The OPSWAT Metadefender Vulnerability Engine identifies known application vulnerabilities and reports them by severity level. The Vulnerability Engine allows system administrators to identify vulnerabilities in files and data being brought into a secure network and on endpoints within a network, significantly expediting remediation of the issue.

Common Vulnerabilities and Exposures (CVE) is a catalog of publicly known cyber security vulnerabilities that's sponsored by the United States Department of Homeland Security. The first table below lists the new CVEs and product versions for which support was added to the Metadefender database during the week of May 1-8, 2017. The second table lists the hashes and application installers for which support was added.

Learn more about the Metadefender Vulnerability Engine:

LEARN MORE

Newly Supported CVEs and Product Versions as of May 8, 2017

Newly Supported Hashes and Installers as of May 8, 2017

OPSWAT has been making improvements to Metadefender.com. Updates include changing the layout and user interface slightly for easier navigation, and adding new pages that display our latest threat research.

Metadefender Cloud is OPSWAT's threat intelligence platform. At Metadefender.com, users can test out Metadefender Cloud technology by uploading files for data sanitization and multi-scanning, looking up a hash, or checking an IP address's reputation. All these functionalities, and more, are available in the commercial and enterprise versions of Metadefender Cloud.

Changes made to Metadefender.com include:

• A new Vulnerabilities section
• A new Reports page
• Easy access to Metadefender Email Security Cloud
• An upgraded main page interface

New Vulnerabilities Section

Metadefender Cloud detects and assesses vulnerabilities in over 15,000 applications and application versions. In the new Vulnerabilities section of Metadefender.com, we list all vulnerabilities supported by Metadefender Cloud, with information about each vulnerability.

This new page allows users to easily browse all supported CVEs using a simple interface. See the page here.

New Reports Section

Metadefender.com has added two newreports over the last five months: the Content Disarm & Reconstruction Report and the Malware Outbreak Report. With four different reports now hosted on Metadefender.com, we have created a new reports section to consolidate our team's research.

On this page, users can browse:

• Multi-scanning Statistics
• the Windows Anti-malware Market Share Report
• the Content Disarm & Reconstruction Report
• the Malware Outbreak Report

View all of these reports here.

Metadefender Email Security Cloud: Free Demo

Metadefender Email Security Cloud is a free demo of Metadefender Email Security technology – just forward suspicious emails with or without attachments to sanitize@metadefender.com, and a scanned, sanitized version of the email and the attachments will be sent to you automatically.

On the main page of Metadefender.com, we've added a quick link to send emails to sanitize@metadefender.com:

Learn more about Metadefender Email Security here.

New Panels Section

We added a new section at the bottom of Metadefender.com:

This new layout makes it simple to navigate to the reports section, Metadefender Threat Intelligence Feeds, Metadefender Cloud Client, and the other offerings hosted on Metadefender.com. Click on each of the panels to access these pages.

Visit Metadefender.com to see the website's new look, and learn more about Metadefender Cloud here.

Since last week, users and organizations in over 100 countries, including major corporations and various government agencies, have fallen victim to the "Wanna Decryptor" or "WannaCry" ransomware attack. This ransomware was initially introduced to systems via phishing emails and spreads using a known Windows vulnerability.

Initial reports last Friday said that the United Kingdom National Health Service was infected by the ransomware, affecting up to 16 U.K. hospitals. Such an attack would have been disastrous enough on its own, but the ransomware has since spread to companies and government agencies all over the world. Wanna Decryptor is a ransomware attack of unprecedented scale, and it is currently ongoing.

MalwareTech found a simple way to disable an earlier version of the ransomware (h/t Ars Technica). However, new versions of Wanna Decryptor that cannot be disabled in this way have now been seen in the wild (h/t Wired).

The ransomware uses Windows vulnerability MS17-010. Windows issued a patch for this vulnerability on March 14, but many systems had not been updated. (Patching this vulnerability will help keep a system from being infected.)

OPSWAT Technology Helps Block 'WannaCry'

Many of our customers have been asking us if OPSWAT technology would have blocked this ransomware attack.

From the most current research available, there are a large number of malicious executables in the wild that were vehicles to install this ransomware. OPSWAT has been collecting and reviewing these files. As of this writing, Metadefender Cloud has detected every one of these files as malicious, which means if you had used it to scan incoming files you would have caught them.

What about our Metadefender on-premises solutions? As one would expect, the larger the Metadefender multi-scanning package, the more likely it is that the ransomware would be caught. According to our research, Metadefender Core 16 and Metadefender Core 20 flag all of the files associated with Wanna Decryptor as malicious.

Additionally, the Metadefender Workflow Engine enables administrators to set policies blocking executable files altogether. Metadefender data sanitization strips malicious content from all kinds of files. With these two technologies, malicious files that spread ransomware can be blocked or rendered harmless.

Metadefender Email Security renders phishing emails harmless by removing malicious hyperlinks and sanitizing all email attachments. This would have rendered useless whatever phishing emails were used to spread Wanna Decryptor.

How to Block Ransomware with Metadefender

Ransomware like WannaCry/Wanna Decryptor can enter a system in any number of ways. That's why organizations should:

• Increase their email security in order to detect, block, or remove malicious email content. Employees receive phishing emails constantly, and Metadefender Email Security will block malicious content in these emails.
• Improve their IPS, proxy, and storage server security to protect their data. Metadefender ICAP Server efficiently and effectively accomplishes this.
• Add protection from malicious files uploads and downloads. Metadefender ICAP Server also provides this.
• Block threats on portable media such as USB drives. Metadefender Kiosk is deployed in many critical infrastructure facilities for this purpose.
• Acquire development tools to create powerful customized cyber security solutions. OPSWAT enables organizations to do this with Metadefender APIs and OESIS Framework.

  Contact the OPSWAT sales team today to prevent ransomware attacks like Wanna Cryptor/WannaCry.

  CONTACT SALES

The OPSWAT Metadefender Vulnerability Engine identifies known application vulnerabilities and reports them by severity level. The Vulnerability Engine allows system administrators to identify vulnerabilities in files and data being brought into a secure network and on endpoints within a network, significantly expediting remediation of the issue.

Common Vulnerabilities and Exposures (CVE) is a catalog of publicly known cyber security vulnerabilities that's sponsored by the United States Department of Homeland Security. The first table below lists the new CVEs and product versions for which support was added to the Metadefender database during the week of May 8-15, 2017. The second table lists the hashes and application installers for which support was added.

Learn more about the Metadefender Vulnerability Engine:

LEARN MORE

Newly Supported CVEs and Product Versions as of May 15, 2017

Newly Supported Hashes and Installers as of May 15, 2017

Metadefender Cloud Client - Click image to expand

OPSWAT today announced the release of Metadefender Cloud Client 4.0.6. The new release includes support for detection of Microsoft Windows vulnerability MS17-010, the vulnerability exploited by the recent WannaCry ransomware. Adding support for this vulnerability will help organizations confirm their endpoints are not vulnerable to the ransomware, in addition to the powerful endpoint protection that Metadefender Cloud Client already provides for application-level vulnerabilities.

The WannaCry ransomware has spread extremely quickly around the globe, infecting over 300,000 computers in over 150 countries in less than a week since its first reported appearance on Friday, May 12. Although a patch for MS17-010 was made available by Microsoft on March 14, systems impacted by WannaCry have not had the patch applied. This latest product release from OPSWAT provides a quick and easy check to see if an endpoint is at risk.

Benny Czarny, Founder and CEO of OPSWAT, said, "With a threat like WannaCry that has spread so quickly and has such global reach, it is important for security professionals to make sure their systems are not exposed to the threat. Time is of the essence in making that determination and remediating any systems that could become compromised.

"We are proud that OPSWAT is able to provide this free tool to help administrators check for vulnerabilities in the systems they are managing. This is true not only for the immediate threat posed by the WannaCry ransomware, but also for other known application vulnerabilities that could be the target of the next ransomware outbreak. By using tools such as Metadefender Cloud Client, these vulnerabilities can be identified and patched in advance of attacks by malware seeking to exploit known vulnerabilities."

When Metadefender Cloud Client is downloaded from OPSWAT.com and launched, it scans the endpoint for threats and vulnerabilities using the multi-scanning and vulnerability detection of Metadefender Cloud. With this release, Metadefender Cloud Client will also check for the Windows operating system vulnerability that is exploited by the WannaCry ransomware so that users will know to apply the operating system patch.

Visit this page for more information about Metadefender Cloud Client and for a free download of the tool. The product release notes are on this page.

To learn more about how OPSWAT products protect organizations from ransomware, be sure to attend OPSWAT's upcoming webinar "The Age of Ransomware: Detect and Prevent Threats" on Monday, May 22 at 11 AM PT. Sign up for the webinar here.

About OPSWAT

OPSWAT is a global cyber security company providing solutions for enterprises since 2002 to identify, detect, and remediate advanced security threats from data and devices coming into and out of their networks. Trusted by over 1,000 organizations worldwide for this secure data flow, OPSWAT prevents advanced security threats across multiple channels of file transfer and data flow with flexible options of Metadefender® solutions and API-based development and threat intelligence platforms. With over 30 anti-malware engines, 100+ data sanitization engines, and more than 25 technology integration partners, OPSWAT is a pioneer and leader in data sanitization (Content Disarm and Reconstruction), vulnerability detection, multi-scanning, device compliance, and cloud access control. To learn more about OPSWAT, please visit www.OPSWAT.com.

Using data sanitization (or content disarm and reconstruction, CDR), vulnerability assessment, and multi-scanning, Metadefender detects and prevents both known and unknown threats. Each week, we present data on some of the threats blocked by OPSWAT's free version of Metadefender Cloud, which offers free multi-scanning and data sanitization (with some limitations).

Metadefender Cloud detected these malware outbreaks with multi-scanning: