Foreground Security's Sr. Incident Handler and Malware Analyst, Curt Shaffer, co-presented this past weekend at the Shmoocon 2012 Security Conference with Chris Cuevas from Secure Ideas. The research came from two discussing how crazy the marketing was on this newer technology. They decided to test out three popular choices for application whitelisting and see if the hype was true. We do want to mention that Foreground and the researchers believe application whitelisting is a step in the right direction, the implementation has flaws and it should only be used as part of a strong defense in depth solution.

The results are in and they found that Application Whitelisting is nothing more than a small road block much like current Anti-Virus. They found that there are some very easy ways to get around this type of software due to lack of features, lack of understanding the current threat landscape and in some cases vulnerabilities in the software that allow complete bypass. They took the audience through their testing methodology and findings. They tested Bit9 Parity 6.0.x, Microsoft AppLocker and McAfee Application control on both Windows XP and Windows 7.

Read More...