Hi I'm
pbust from Malwarebytes, in charge of the MBAE development team. Found this thread by searching around for references to MBAE. I wanted to jump in and clarify a few misconceptions and misinterpretations of what MBAE does and how it works.
First off for more info I really recommend reading the
MBAE FAQs which can give a very good insight into the technology and product.
As for some of the comments:
Still trying to figure our what exactly it does other than stop zero day java drive-bys. MSE or any free to download anti-virus should have an exe. blocker that does the same thing. Malwarebytes seems to becoming a tad bit redundant with "Install a antivirus then install Malwarebytes and then install this New Malwarebytes Anti-Exploit!" Really? I'm all about safe browsing habits and security but this new program seems to be digging a hole in the ground just because its got a shovel. Not because I need a hole.
In addition to Java zero-days it also blocks browser zero-days, Flash zero-days, Silverlight zero-days, Acrobat Reader zero-days, Word zero-days and basically vulnerability exploits in a large number of other applications. Unlike traditional security solutions like antivirus and anti-malware that look at WHAT is infecting, MBAE looks at HOW it is infecting. This means it is proactive rather than reactive. It specializes in shielding running applications and monitoring their behavior (via API monitoring and application behavior) to determine if a shielded application (browser, pdf reader, office app, media player, etc.) is being attacked by a vulnerability exploit. Exploits are the most dangerous type of infection vectors nowadays as they do not require any user interaction like social engineering type of infection vectors. By simply visiting a site, even a very popular non-malicious site, one can be exposed to an exploit via an iframe redirector, a malicious flash advertisement or other means. Measures such as NoScript are not always a viable solution as sometimes the exploits are hosted in the same compromised website we are visiting.
I didn't read too much, but it sounds like it is probably a sandbox program. I like malwarebytes but the paid version is pointless. It has no need to run automatically.
It is not a sandbox, it is not whitelisting and it is not blacklisting. It is basically behavior analysis of the shielded applications. More information
here,
here and
here.
I think it might be handy for larger sites, depending on the implementation but it should come with the Malwarebytes Premium instead of a different product imho. There's still a few hundred of the lifetime licenses to MBAM:
https://www.malwarebytes.org/eureka/
Please read
this.
I like some of the extra features, but they're not necessary to reap the benefits of Malwarebytes. Free is plenty good. This could be useful. I'd like to test it on a site with 20-100 workstations and see how it responds...those are the kinds of places where this could be useful imho... but if it's a resource hog, then pass. Our monitoring agent runs scans from Malwarebytes on all monitored workstations as it stands. This product will come under heavy fire if it slows the browsing experience down and let's things get by. It'll be annoying if it adds a toolbar or too many popups. It should have a server-side host that the client reports to...and maybe it does. I didn't read too far into it. For home use, the free version is probably plenty for many.
It is not a resource hog at all. It takes less than 3MB in memory and since it does not use signature databases, only API and behavior monitoring, it is extremely light. Of course no toolbars are included with the installer. This is Malwarebytes after all, we hate toolbars and we love disinfecting them! As for the server-side,
Malwarebytes Anti-Exploit for Business does come with a centralized management server that manages both Malwarebytes Anti-Malware (MBAM) and Malwarebytes Anti-Exploit (MBAE) under the same console.
I may try it just so I can form an educated and experienced opinion about it at least...I'm curious to see how it does.
We commissioned a test from renowned independent exploit researcher @Kafeine to verify that MBAE (Free version, mind you!) protects against all exploit kits in circulation in the wild. His test results can be seen at
http://malware.dontneedcoffee.com/2014/06/mbae.html.
I've used it and it's not that bad, but it's not that great either. The whole update system is bad. If they update it then you internet browser won't work until you uninstall it.. I've not used it in a few few months and they may have resolved it...
I'm not sure what you mean by update... you mean install or install of a new version on top of a previous version? Since MBAE hooks into the applications process space (we inject mbae.dll/mbae64.dll into target processes) the injection/uninjection might cause a couple of seconds of the browser becoming unresponsive. But this is only in the case of initial installation. After that I guarantee that you won't ever feel it. It was designed to be install-and-forget.
Microsoft has the (basically) same for free...
EMET (Enhanced Mitigation Experience Toolkit)
You can read about the differences between MBAE and EMET
here.
Well I gave it a try and it seems to slow down my ability to load sites and their normal rate. A lil to much real-time scanning I guess. However it is lightweight and easy to use. Just don't know how effective it is and not sure its even worth the slow down so I uninstalled it. They should just add it to the normal malwarebytes as an option IMO.
Even though MBAE Free provides real-time protection for browsers, addons and Java, impact on system, browser load time and browsing time is very very negligible. If you find otherwise please do let me know as I'm here to help in case you run into any problems.
