Matousec

Matousec (short project's name, means part of its founder family name - Matoušek + part of "security" word) is a personal firewall testing group, known also as Matousec Transparent Security.

History

It was founded in March 2006 by Czech IT security researcher David Matoušek with a small group of university students (mostly) to find vulnerabilities in Windows PC security software. Nowadays the group's focus is on non-commercial public testing of personal firewall and Internet Security software.^{[1] [2]}

Group's testing results are usually mentioned in reports "Comparative reviews of personal firewall software".^[3]

In April 2009, the group and project were acquired by unknown Internet and software-related company Difinex (Different Internet Experience) Ltd. under which it continues testing security software working under Microsoft Windows systems.^[4]

Projects

The most known project of Matousec is an independent security software testing challenge called Firewall Challenge^[5] (in 2009 - Proactive Security Challenge). The group is also known by the development of Security Software Testing Suite used for the tests mentioned above.

Matousec is often mentioned in IT security forums when talking about how secure a firewall-based software is.^[6][7] or at personal firewall and Internet security software producer's sites news (Comodo,^[8] Kaspersky^[9]). Currently, more than 50 firewall-related products were tested by Matousec group.

Matousec tests an Internet Security suites' or personal firewalls' with HIPS engines ability to stop leaks, how well it protects itself from crashing, if it can stop spywares from spying^[10] and some other tests, the test used to include a performance test, but that has been removed now.

All tests are performed on an administrator account on Windows XP with recent version of Internet Explorer.^[11]

Criticisms

Some have criticized Matousec for demanding more of a firewall than what is traditionally expected ^[12][13][14]. A PC firewall should stop leaks, and some argue that it must not protect against other vulnerabilities such as key logging.^[15]

Matousec has also been criticized on the basis of conflict of interest, due to being paid by security software makers for re-testing. Results may then, at the discretion of the software vendor, be disclosed or kept private. However, Matousec is transparent about this, and the testing procedure is described in detail on the website:

Every vendor has a right to request a paid Proactive Security Challenge testing, in which case its product will be tested in all levels regardless the results on each of the levels. After the vendor receives the results of the paid testing, it can either keep them private or request their publishing on our website, but such a request will be satisfied only if the previously published results for the tested product, if any, are at least one month old and if the tested version is stable and publicly available. There are no limits of the frequency of the paid tests.^[10]

References

1. ^ "Matousec – About Us". matousec.com. 2011 [last update]. http://www.matousec.com/matousec/about-us.php. Retrieved October 12, 2011. 
2. ^ An example of the company's work: "SecurityTracker: BlackICE Insufficient Access Controls on 'pamversion.dll' Lets Local Users Gain Elevated Privileges". securitytracker.com. August 1, 2006. http://securitytracker.com/id/1016618. Retrieved October 12, 2011. 
3. ^ Henry S. Markus (November 5, 2010 [last update]). "Personal Firewall Reviews". firewallguide.com. http://www.firewallguide.com/software.htm#Comparative. Retrieved October 12, 2011. 
4. ^ "DIFINEX acquired Matousec". matousec.com. April 14, 2009. http://www.matousec.com/info/?news=121-DIFINEX_acquired_Matousec. Retrieved October 12, 2011. 
5. ^ http://www.matousec.com/projects/firewall-challenge/faq.php#administrators-limited-account
6. ^ http://www.wilderssecurity.com/showthread.php?t=183431
7. ^ http://forums.comodo.com/leak_testingattacksvulnerability_research/matousec_retest_comodo_does_not_pass_100-t22963.0.html
8. ^ "Web User Bestows its 2007 Gold Award on Comodo's Firewall Pro" (Press release). comodo.com. July 12, 2007. http://www.comodo.com/news/press_releases/12_07_07.html. Retrieved October 12, 2011. "Firewall Pro topped the list in Matousec's May 24, 2007 leak-test of 11 leading firewalls, and was one of only two firewalls to receive an "excellent" rating. Of a possible total score of 9,625 over 77 various leak tests, Comodo scored 9,475, making it the highest scoring firewall available." 
9. ^ http://www.kaspersky.com/comparative_tests?id=207575592
10. ^ ^{a b} "Proactive Security Challenge – Methodology and rules". matousec.com. 2011 [last update]. http://www.matousec.com/projects/proactive-security-challenge/#methodology-rules. Retrieved October 12, 2011. 
11. ^ "Proactive Security Challenge FAQs". matousec.com. 2011 [last update]. http://www.matousec.com/projects/proactive-security-challenge/faq.php#administrators-limited-account. Retrieved October 12, 2011. 
12. ^ http://www.techsupportalert.com/content/matousec-personal-firewall-tests-analyzed.htm
13. ^ http://www.wilderssecurity.com/showpost.php?p=1314035&postcount=88
14. ^ http://www.wilderssecurity.com/showpost.php?p=1899090&postcount=6
15. ^ http://www.dslreports.com/forum/r20905485-firewall-tests