Categories
Security

Why Malwarebytes for Mac

As some of you may have already seen, we released Malwarebytes Anti-Malware for Mac last week. Prior to the release of the new product, I was of the mindset that Macs were not vulnerable to malware. So what changed my mind?

Doug Swanson, my former CTO at Malwarebytes (and current board member!) e-mailed me about a cool product called AdwareMedic he had found over the weekend. Doug’s grandmother’s computer, a Macbook Pro, had fallen victim to a search hijacker that was redirecting any links she clicked to advertising content. He ran AdwareMedic and all was well in the world. Doug insisted I take a look at the software, and his story certainly left me intrigued.

Categories
Entrepreneurship

Location, location, location!

Sounds like something a real estate agent would shout at you while selling you a house, right? Well, sort of.

Just like a grocer may perform a location survey to determine the best place for their store, i.e. the corner versus in a back alley, as an entrepreneur starting a business it is absolutely critical to choose your location. And I don’t mean your office location, I mean your niche. I hate calling it a niche, because it implies something small. Uber certainly didn’t find anything small when it chose to redefine how calling a taxi works!

We faced this hurdle at Malwarebytes early on. When we built the product almost eight years ago, antivirus companies had already saturated the market. There was no room for another antivirus, not that we wanted to be one anyway. From the very beginning, we decided to position ourselves as another layer of protection, one that focuses on the most aggressive and unknown threats and we left the rest to antivirus. It was one of the best decisions we had ever made.

At the time, we had no idea the position (location!) was so important. The revelation came to me recently while reading The Granularity of Growth where the author’s research found that “a company’s choice of where to compete is almost four times more important than outperforming within its market.” Had we positioned ourselves as another antivirus, who knows what Malwarebytes would be today.

Categories
General

Malwarebytes makes appearance on The Office

I like to have background noise as I answer work e-mails. Typically, I leave Netflix streaming and every so often I glance at the television. While watching The Office, I noticed something very interesting.

Malwarebytes on The Office

If you look at the bottom right corner of the screen, on the monitor, you’ll see Malwarebytes installed on the computer of a customer that Michael, Dwight, and Jim go to see. Turns out this isn’t the first time we’ve “appeared” on the show. We’ve also shown up on Darryl Philbin’s computer — look at the top left of the screen.

Malwarebytes is so good, even Dunder Mifflin uses it!

Edit: the icon used to be red!

Categories
General

Malwarebytes launches enterprise edition

Forgive my absence, I’ve been chained to a headset on several press calls per day for the last few weeks. Now that the press tour is basically over, I’m able to happily announce the launch of an exciting new product, Malwarebytes Enterprise Edition. This thing is awesome. Seriously.

So much work has gone into this product and I’m excited to finally announce it.

I’m working on some really cool changes to the blog and content that I will hopefully post every week, so stay tuned!

Categories
Security

Mysterious case of the broken browser

A friend of mine asked me to take a look as to why Google and Bing were inaccessible using Firefox. I dove in and realized that they were also unreachable using Internet Explorer, Chrome, and even command line ping. It became apparent that the hosts file had been hijacked. In fact, these entries were the only ones present:

87.229.126.50 www.google.com
87.229.126.51 www.bing.com

I swiftly removed them from the hosts file and both websites loaded fine. But what had put them there? With a working browser, a quick search revealed that those addresses were not legitimate and something had clearly hijacked the machine.

Knowing my friend to be an avid Malwarebytes Anti-Malware user, I checked the quarantine and found several objects. The main files appeared to be dplayx.dll and dplaysvr.exe and had several registry entries allowing them to start with the computer. I sent the files to Adam Kujawa, a Malware Intelligence Analyst working with me at Malwarebytes. Adam confirmed that this malware was responsible for the hosts file redirection.

However, a further analysis revealed a more cynical side. Adam continued by saying that “all binaries analyzed were heavily packed with custom obfuscation methods and employed anti-debugging tricks which made them a pain to get through” and that “the use of the filenames dplayx.dll and dplaysvr.exe is important because the names belong to legitimate applications and are integral parts of Direct X.”

While not new, the use of these particular filenames shows that malware authors are still trying to hide their executables behind legitimate names.