Text only | Text with Images

Randem Systems Support Board

Other Info => Malwarebytes => Topic started by: Randem on March 01, 2017, 03:42:07 PM

Title: Evaluation of the Malwarebytes Endpoint Security Management Console
Post by: Randem on March 01, 2017, 03:42:07 PM
Initial Client Push Installs

IMPORTANT: Every station that you want to push the client software has to have the default Administrator account active and setup (including the Endpoint Management machine). Meaning that the Administrator account has to be logged into at least once after setting the account to the active state. If you do not do this all your software push installations will fail. If you have a lot of stations on a domain then much of this requirement can be accomplished with a few server pushed scripts, but if not on a domain this will be a lot of work to satisfy this requirement.


If you attempt to push an installation to the client without setting up the Administrative account on the client you will get messages something like these:

"3/1/2017 2:12:24 PM","Admin","127.0.0.1","System",5011,"""RS-WS1"" [192.168.1.28]: Installation failed. Access is denied.","RS-WS2"
"3/1/2017 2:48:23 PM","Admin","127.0.0.1","System",5010,"""RS-WS1"" [192.168.1.28]: Simulation failed. The specified network password is not correct.","RS-WS2"

There is no attempt to tell you the actual problem or to offer a solution, just some general messages which do not help much.

We have also found that if you have a different version of Malwarebytes Premium or Free installed; the Endpoint software will still attempt to push the installation of the client software; but will fail. We uninstalled the premium version 3.0 from the client computer then attempted to re-push the client software installation and it installed successfully but failed this time on registration, "unable to connect to remote server". Do not know what this means for both machines have internet connections and update on each machine works... The strange part is the client push of Malwarebytes installs version 1.80 on the client station. Not sure if this is updated software; or if the management software will upgrade this later. From a look and feel point of view; our software is regressing, and makes one feel a bit uneasy thinking that they might not be getting the latest and greatest protection going from version 3.0 or 2.x to 1.80...

"3/1/2017 3:19:13 PM","Admin","127.0.0.1","System",5011,"""RS-WS1"" [192.168.1.28]: Installation failed. Managed client software installation failed.","RS-WS2"

We strongly suggest using a simulation installation before attempting to push the software to the client. It also seems that all the errors that happen do not end up in the Admin log. It would be very helpful for some of the error messages are overwritten on the screen and leave no trace of their existence for late debugging.

IMPORTANT: It turns out that if we disable the firewall on the Endpoint machine the installation goes smoothly. This means that the installation of the Endpoint Management software does not create a firewall exception rule for itself so that the clients can communicate with it. The instructions in the manual only gives instructions for the Windows Firewall, but we all know that anyone serious about security does not use the Windows Firewall. The exception rule that needs to be created on every station is:

Protocol: TCP
Direction: IN
Local Port: 18457
Remote Port: 1024-65535 (or ANY)
Remote Addresses: All Networks

Once you get this straightened out; the push installations will work smoothly. What we did was to create the firewall exception in our firewall Central Management System then push out the rule to all the stations.

We have attached the complete MBAM official operations manual
Title: Re: Evaluation of the Malwarebytes Endpoint Security Management Console
Post by: Randem on March 02, 2017, 01:38:47 PM
Client Management

After figuring out all the firewall issues, we ran into this issue. We saw that one client was being reported as offline, and the strange thing is that we can still uninstall and reinstall the software remotely; so I am at a loss to what Offline really means. What I had to do to get rid of this status was to delete the client and refresh the clients screen then the client was online; this status seems not to be real time. The IP nor the computer name was changed but the system could not locate the computer to report on it but could locate it to uninstall/re-install the software. I also had to push uninstall/reinstall the software on several computers to get the protection icons to show the protected state in the client screen. This may have had something to do with the firewall exception rule not being on the client computers at the time of the original install.

On some stations I cannot get the protection icon to show for Anti-Exploit no matter what I do, even with the same procedure that I have done for other stations. On the some stations Anti-Exploit is working and in a protection state but the console does not recognize this. All the stations have the same firewall rules because they are pushed from the firewall management console so that cannot be the issue. A few minutes later the status changed to protected without any reason that I can tell. This was after several refreshes of the screen. For some stations; they are still reported as offline even though on the station itself Anti-Exploit and Malwarebytes are running fine.

The thing that I really dislike about this management console is that when you send a command to the client such as to update the database, there is no indication to the user that anything is happening at all. So you are really at a loss as to what is really happening.

NOTE: After several push uninstalls/re-installs; the anti-exploit protection icon showed up and is working properly on some stations, on others not. Also interesting is that after deleting one problem station from the client screen, the client computer will not show up again even though It will show up on the Admin scan and I can still install and uninstall on it. Client machines go offline for no reason in the client view screen, the software on each machine is active and running but it is still reported as offline in the console. In order to get a station back online you have to restart the computer and even that is no guarantee it will be reported as online. We have had to restart 4-5 time just to get one computer online, not a real world situation.

UPDATE: 03/8/2017 Malwarebytes support sent me a cleaning tool and a new Anti-exploit install and instructed me to install uninstall/install directly on the client stations that did not work and then push an installation of Anti-Malware/Anti-Exploit from the console and everything worked the first time. Malwarebytes support stated that a new roll-out of the console would be release in the second quarter of the year.

From the contacts I have had with support; they don't seem to understand how the real world small businesses use computers & networks and only seems to only be concerned about corporate uses of networks with Windows servers and Active Directory installations. Most real world small business have no use for Windows Servers or AD...

CMS products are supposed to make life easier for the businesses that have no IT departments. Fore thoughts like this would open the market up to these types of small businesses who could have their sites managed by off-site personnel. The "cloud" is not an option...

UPDATE: 03/17/2017 After uninstalling from every client using the MBAE uninstall tool, we re-installed the new MBAE software on every client and we have had some success in getting things to work correctly. We had one issue with an XP client but after checking the Windows Event logs we found out that the real problem was .NET 2.0. So, we re-installed .NET 2.0sp2 and .NET 3.5SP1 on that client then uninstalled/installed MBAE and all was working correctly.

UPDATE: 04/13/2017 Malwarebytes has sent me a new console install with a fixed communications program. i have installed the communications program and all seems to work as expected with the stations showing up and the components being marked as installed and working. Also I was instructed on how to get the console to monitor client stations that were not on the same network segment (IE. another building across town). You cannot remotely deploy to these external stations but you can monitor them once you get the software installed.
Title: Re: Evaluation of the Malwarebytes Endpoint Security Management Console
Post by: Randem on March 18, 2017, 10:51:46 PM
Malwarebytes Management Console Review - 03/14/2017

Finally got everything up and running after multiple uninstalls and re-installs. Found that the process of uninstalls/installs only worked if using the MBAE uninstall tool. Remote uninstalls should be updated to only use the tool instead of the current process used. There are times when the console appears not to be real-time or it just loses the ability to communicate with some clients. One example is that when a client computer is shutdown; over an hour later the client is still being reported as online. I eventually had to use the MBAE uninstall on all client stations to get some stability.

Client Tab:

These issues are for clients on the same subnet as the console, but also happen with external network clients.

Title: Re: Evaluation of the Malwarebytes Endpoint Security Management Console
Post by: Randem on April 23, 2017, 12:16:12 PM
Malwarebytes Management Console Review - 04/23/2017

We are resellers of Malwarebytes products and have been evaluating and testing the Malwarebytes Console since March in the hopes of getting our customers to use it and to help make this a better product. The concept being that is a technical expert with over 35 years of experience on Wall Street cannot get the system to work properly in real world situations; then the average consumer does not have a chance (our customers).

Malwarebytes support gave me a few new installs and install techniques that worked for a brief period. Some of the same problems seemed to reoccur, this may be from the program updating itself and the corrections were not implemented on the update server at Malwarebytes. These updates however proved to be meaningless if the program is just going to revert back to its old behaviors from updates after a correction. Here is a list of current issues that have not been resolved or have gotten worse since my last review of 3/14/2017. We have had a change of support staff since the last review that does not seem at all concerned for they seem to refuse to give any answers or knowledgeable support. The last contact from support was on 4/17/2017 telling us to restart the server as if that was going to solve the listed issues... they have not responded to our support request since then.

Client Tab:

These issues are for clients on the same subnet as the console, but also happen with external network clients.

Title: Re: Evaluation of the Malwarebytes Endpoint Security Management Console
Post by: Randem on May 02, 2017, 05:10:12 PM


UPDATE:

05/01/2017: Malwarebytes technical coordinator has contacted me on 5/1/2017 about pushing the issues to the department that handles customer experiences. We will see how this goes.

07/01/2017: We still have not gotten any kind of response from Malwarebytes on anything except to say that they are moving to a cloud platform, which is ridiculous. Why would anyone serious about security use the cloud platform? It just opens the door for external hacking on your information and the most problematic situation is that you have to attach to an external system so that you can manage your own internal one. If your internet is down; you are screwed on ALL cloud platforms... It's like you need the police in your area but you have to call the police five states away... Don't expect help anytime soon.

Meanwhile here is some information on usage:

Malwarebytes Management Console Review - 05/02/2017

NOTES:

These tests were run in a real world environment initially with a policy update of 1 hour (real world would be 24 hours), this setting caused
multiple unexpected issues. We had to change the setting to non-real world lab settings (policy update 1 minute) in order to get some things
to somewhat work.

In order for this console and applications to work; TCP ports 135,137,445 & 18457 must be opened (traffic both ways) on your firewall
and or router with the remote port of 0 - 65535 open for this rule. This is especially true if you plan to use external clients
(PC's in another physical location or on another subnet). It may be prudent to add the files "Management Console.exe" and "SCCOMM.exe" to your
firewall allow rule list to prevent unexpected communications errors. The MBAM documentation is not clear about this.
   
It seems that the communications is backwards on this console which leads to much confusion. Apparently when you ask the console to do something
it queues the request then only when the client station contacts the console the request is given to the station. This makes the console
not "Management" in the fact that from the console you want to be able to control the stations behavior and force out of date scans updates etc...
or even force a scan or update for maintenance or testing reasons. This means that if the client station never contacts the console there is no
error telling you that anything is wrong or that your request have not been made. There is no request queue to see exactly what has not been
completed or to delete the request if you want to.

The only way to help this situation is to set the checking for a new policy to about 1 minute. The default of every 5 seconds will create a
large amount of useless network traffic. Say 200 stations checking every 5 seconds for an update that should only change once in maybe 3 - 6 months (if at all). All this network traffic is just clutter on a company's network and need not be there. We had our policy check set for 60 minutes
(real world would possibly once a day) and communications seemed to never happen for we had to wait 1 hour before the clients would check again
so that any new values would become effective. This new setting helped all our communications immensely. The policy update time should have nothing
to do with console requests to perform tasks immediately. These tasks should be a forced communication from the console. Also a policy update would
be better served as a broadcast to all stations to get the new policy. Stations that were offline at the time of the broadcast would naturally
automatically check when they are powered on or connected to the network.

Our test were performed using a packet sniffer and AVG Internet Security for Business (with Management Console). In the MBAM Console the following settings have been used is Auto Refresh on, Policy update to 1 Minute.

Client Tab:

These issues are for clients on the same subnet as the console, but also happen with external network clients.

Text only | Text with Images