eEye Digital Security

This is part one of a multiple part review I will be doing for the board over at GRC.com and hopefully it will help some better understand how BLINK works and also how it can help the more average home and small business user.... I have been wanting to write up something since I started using BLINK back when Marc spoke about it months ago but witht he release of 3.5 it now really gives me a chance to sink into it and layout the issues and problems I have had and how they have been fixed or imporved with the newer versions...

Please understand this is a multiple part review and this is only the first section of it... but this is the timley section for the 3.5 testers .... my first day of use for 3.5 started today about 6 hours ago - so I will test it over the weekend and continue to scribe out the rest of the review sections as i get time over the weekend....

Please let me know if I blew anything or if you had other results as I would like to make this review as clear as possible outlining user issues that I know of that I can replicate.

Link to the review part 1: http://www.burzycki.org/2007/10/13/eeye-releases-blink-35-beta-initial-overview/

Text below - Hopefully the screenshots will post up here also....

Eeye Releases BLINK 3.5 Beta - Initial Overview

Part 2: http://www.burzycki.org/2007/10/13/eeyecom-blink-35-beta-part-2-immediate-feedback/

Eeye.com - BLINK 3.5 Beta - Part 2 - Immediate Feedback…

Wow, great job so far!  What screen capture program are you using, I like it also.  Your submitting this in one of Steve's newsreader chat rooms (good idea last time I was in there a majority of them were whining about how Blink blocked this and that....kind of bothered me.)  I won't get started on my rampage on what I feel about that.

THe screen cap program is hands down the best one i have found...

Fastone Capture - if you cannot find a freeware version I think the last is 5.3 I have a copy - happy to pass it along...

And yes this will and has been submitted over there - when i am done with it - I will send a copy to Steve becase he had asked for a copy to try to share with the Security Now audience... thats if i get another few hours to finish it - hopefully this weekend - but there is so much to cover....

And opinions are not worth anything without backup...

Brent:

And opinions are not worth anything without backup...

 I was thinking the same...I noticed a lot of the users in his newsreading forums were whining about how it blocked their favorite VOIP, newsreader, or filesharing program.  My comment to that is, "Good, simply unblock it and move on.  You should be happy Blink is being suspicious of such programs to begin with."  That's just my opinion.

Blue1978:

Brent:

And opinions are not worth anything without backup...

 

 I was thinking the same...I noticed a lot of the users in his newsreading forums were whining about how it blocked their favorite VOIP, newsreader, or filesharing program.  My comment to that is, "Good, simply unblock it and move on.  You should be happy Blink is being suspicious of such programs to begin with."  That's just my opinion.

I for one like the review, but it's a little shallow.  No meat and potatoes stuff.  Just my opinion.  

However I must say that I don't agree at this point that BLINK is consumer grade.  The program requires a fair amount of detailed understanding on how to setup rules.  An example is to have two PC's with BLINK and setup file sharing between the two, BUT not INSECURING NETBIOS.  Not trivial for the average user.  

As for BLINK's capabilities so far I'm not impressed.  Four malware I have, have never been detected by BLINK, ever, since 3.0 (or many other packages for that matter so I'm not just picking on BLINK, but this is a supreme test of it's heuristic functions and they don't seem to work.  But I have no technical details so I cannot really advise further.  Requests for the malware will be denied, I cannot release them.

Now what is very annoying is how BLINK seems to love to DELETE everything by default, even false positives.  I highly recommend any 'newbie' to change this behaviour immediately to QUARANTINE or LOG.  This way it doesn't delete important files, and you still have the ability to review the so-called malware.  But again, is this really something for the consumer or the professional?  Mixed feelings on that note.

This review is no where near complete.... As stated it is only the begining and I have not even dealt with the meat and potatoes items - All this is so far is a quick overview of the isntall process of 3.5 and the first impressions of the major changes.... I have alot more to write and most of it deals with issues you mention....

JayEff:

But again, is this really something for the consumer or the professional?

      Until recently Blink was only use in the enterprise/corporate business environment.  These areas have completely different demands when compared with the everyday user.  Blink is a solid product that has been hammered on and tested (its base code and all).  It would be hard for eEye to point out vulnerabilities in other company’s software and be respected by the security community if they did not test and be sure their software was squared away as well.  I do not expect the everyday consumer to understand why Blink is the way that it is, but I can give you some common reasons why:

     First of all the everyday consumer expects to have every possible bell and whistle built into a security program.  Why, simply because every company out there is aimed at competing with other companies trying to make sure they have what others have in their product and then something else.  In simple terms, they want to be ahead of the other guy and have something special that he does not.  Because of this, we come to expect by default, every security program to have all of these things built in.

     In the enterprise/corporate world they demand a product that is effective, easy to maintain and deploy on all of their systems, and something that can be locked down and controlled by their IT administrators.  The product can not be bloated and have too many things in it that will affect the functionality of the company’s network.

     Examples of this pertaining to Blink are as follows (dealing with the Professional Edition Primarily sine the Personal Edition came from it):

1. The ability to run Blink hidden in the background and make it unable to be modified or changed by any other account on a computer system (other than the administrator account.) – This is obviously this way because you, as a IT administrator, do not want your everyday users to modify your security software or its policies in anyway.  You set the policies and must protect/enforce them.
2. Delete Malware Risks by Default – This is done because on a typical corporate computer you do not want anything malicious in behavior to reside on a system too long allowing it to propagate or spread itself to the rest of your network.  Yes you may say, “But I have this and that program that are okay to be on my system and Blink is interfering with them.”  My response – on a typical corporate computer system you have a limited number of approved and tested applications running.  Anything else of malicious and or having suspicious behavior is removed automatically per a company’s policy.
3. Limited Rule base – Most companies want a firewall that has no rules to begin with.  This allows the IT administrator to create the rules specific to the software they are running on their networks.  Fewer rules by default mean less cause for configuration issues from the start.

     These are just a few examples, I could keep the list going on and on.

     Finally, when you take a business product and attempt to introduce it to the general consumer, obviously it is not going to have everything they want in it.  The problem with just simply adding a feature is your now introducing new code that has to be tested into the original product.  Problems/bugs will occur because of this, naturally.  Simply adding all of these added features we all want to Blink may not always be the wisest choice.  Keep in mind any changes eEye is making to the Blink Personal Edition will be carried over to the Professional Edition.  With that in mind they have to be careful not to interfere with a product that is working well for the business customer on our behalf.  Another thing everyone seems to fail to understand abut Blink is not the same as 98% of all the other products we are use to using.  Blink was not created to “contain” a threat that may already be on a system.  Blink was created in an attempt to protect its user(s) from being exploited to begin with.  The everyday consumer, in my opinion, is beaten red in the face with products that seem to concentrate on raw “detection” numbers and who can find more things than the other person, but they seem to put the fact of actually attempting to stop the threat (at its source) as their second priority, not their first.  eEye focuses on attempting to minimize the threat to your system not contain something that has already infected you.

     This is just my 2 cents on the matter though, you have to make your own decisions on what you want and need.

Blue1978:

The everyday consumer, in my opinion, is beaten red in the face with products that seem to concentrate on raw “detection” numbers and who can find more things than the other person, but they seem to put the fact of actually attempting to stop the threat (at its source) as their second priority, not their first.  eEye focuses on attempting to minimize the threat to your system not contain something that has already infected you.

Man I can sure agree with that.... but I know from y other companies and dealing with customers everyday -- especially when it comes to tech products that think outside the box.... some people just do not and will not get the why and really do not care if it works as long as they can get email and look at porn and not have their system crash or work slow.... that said - most people on this forum are the exact opposite as we are all pretty tech savvy and understand their might be some pain in the security solution we pick but I look at BLINK as a pain I am willing to take.... I want it to tell me it has issues with programs and that it sees a program doing a certain thing it feels is a problem.... in the most recent versions with a more "friendly" rule interface the developers are showing people - hey there is an issue you can allow or not allow you system to do this.... I like that info... but how do you handle the technotard that knows nothing ... well you do as stated above - lock them out if in a business environment or let them just run a simpler app that just gives them crap security and make sure they have their windows reinstall disks handy...

Its a hard call but people that use computers also need to start to understand how the bigger picture works at least in a very minimal fashion... and I think as time goes on we will see this increased knowledge if not solely because the biggest offenders will eventually just rotate out of the living world and be replaced with others that already had a higher base understanding of the way the Internet and Internet security works..

But in the bigger picture is BLINK trying to be the easiest most user friendly app in the world?
Is the market truly the mom and grandma and dad that really know very little about the whole Internet security world?
Does that mom, dad, etc need a IT pro son or daughter to set up their system for them to be safe?

I think the answer to this is muti-fold but also I think BLINK is trying to do what it does best and also now adding the layer of usability that is more feasible for the general non enterprise user... is it there yet? I would say not yet - but its getting very close - or better yet - its getting so close that with a bit of explanation or even some online videos of rule making or the install process, most of the questions to the new user would be cleared up quickely...

I just like the fact that especially now the Eeye staff seems very much involved with the forum and seems to really be listening to the users to make changes.... I had three changes and issues I sent in and they are already resolved for the next release and I have seen others... that is unseen in other products.... and I really respect that in a company and a product and honestly will give that product even more leeway if there are slight issues current or in the future because I know they will work to fix them and not screw me.....

I have used a saying in my companies for a long time..... Its not how bad you screw it up its how well you fix it - and I think in todays marketplace of non-existent support and no customer service, Eeye for the smaller sized tech company they are is really showing that not all hope is dead.... and thats coming from one of the most skeptical people I know.... me...