Xiaotian competition: Host guard VS dongle protection Comparison Test report

Xiaotian competition: Host guard VS dongle protection Comparison Test report

Recently, the server security software dongle released a new version and held a race to bypass server guard. Similar Products include host guard. The following is a comparative test on the effectiveness of the two software detection and removal.

I. Environment Construction

First, follow the official competition documents to build the environment.

The installation environment is harsh and must be windows 32-bit. In particular, it is inconvenient that php should be loaded as an isapi because isapi is not supported after php5.3, therefore, only php5.2 and earlier versions can be used, and some manual settings are required for the software.

It takes more than three hours to build an environment. When the network environment is very complex, such competition conditions are given, showing the lack of system support for the software. In comparison, host guard of another server security software is simpler and more practical. It only needs to be installed once without any settings.

Ii. Practice Bypass

According to the rules of the competition, the first level is static detection and removal, and the webshell and one-sentence backdoor of asp and php need to be provided.

In terms of static scanning and removal (still based on signatures), it can be bypassed theoretically. However, it takes too much time to develop a webshell. I searched the internet for "too many webshells" and collected some non-popular webshells. Then I can scan them. Soon, the result came out, and it was very easy to go around. After the scan was deleted, the rest were not scanned. The results show that no webshell is found. Scan the host guard again. If the dongle does not scan it, all the host guard will scan it ~

 

 

Iii. Summary

1. After comparison, there should be no host guard in the static scanning and removal feature library of safedog, and it remains to be improved.

2. The environment construction conditions are harsh, and multiple settings are required, which is time-consuming. In contrast, host guard does not require any settings.

3. According to the operations on the two software interfaces, the dongle needs to install the website version and server version, and has many options. Host guard only needs to install one version, which occupies a small amount of resources and provides simple and clear interface operations.