At RSA Conference 2013 in San Francisco, Stonesoft released Evader 2.01, an updated version of their advanced evasion software testing tool.


Since its initial release at Black Hat in July, thousands of companies have downloaded the tool to identify potential security risks in their network.

Evader 2.01 provides organizations with a free tool that can be used to test their network’s ability to withstand advanced evasion techniques (AETs). It includes a new graphical user interface to improve usability and the tool supports multiple evasion techniques and can be used in any test environment.

AETs are used to attack networks by combining several known evasion methodologies to create a new, earlier unknown and dynamically changing technique that is delivered over several layers of a network simultaneously. This allows the attacker to successfully deliver any exploit, malicious payload or code to a target host without detection.

Evader 2.01 is a ready-made test lab that includes a set of AETs. It enables an organization to run manually or automatically a variety of AET combinations that hide well-known MSRPC (vulnerability from 2008) and HTTP (2004) exploits, and then deliver them through the tested network security devices to a vulnerable target host image.

The tool includes a set of AETs that has gone through the CERT vulnerability coordination process, which began two years ago. The essence of Evader is to provide hard facts about AET readiness of an organization’s own security devices, support decision making and raise an organization’s security level.

“Breaches continue to occur where corporations have invested heavily in security solutions. However, design flaws in existing firewalls and intrusion prevention systems are being exploited,” said Ilkka Hiidenheimo, CEO of Stonesoft. “Attackers are more sophisticated today and employ evasive techniques to avoid detection. Organizations must be aware of these types of attacks and Evader can be used to help them find out whether they can resist the attacks.”