Stonesoft Discloses 163 New Samples of Advanced Evasion Techniques

A practically unlimited number of combinations can be run simultaneously on several protocol layers

Stonesoft Press Release, Helsinki, Finland — October 10, 2011 — The network security company Stonesoft, today announced it has delivered 163 new advanced evasion technique (AET) samples for global vulnerability coordination. The new samples include AETs over a number of various protocols, including IPv4, IPv6, TCP and HTTP.

Since the discovery of AETs a year ago, Stonesoft has continued extensive research in the area and now delivered CERT-FI (Finnish national computer security incident response team) a new set of 163 AET samples for global vulnerability coordination. The set comprises of 54 atomic evasions and 109 combinations that can be further combined with each other or with the evasions in the previous releases to create new AETs. They work efficiently also over IPv6, which results in increased security risks and challenges.

In Stonesoft’s tests, the latest samples of AETs have successfully bypassed IPS (Intrusion Prevention System) devices currently on the market. As the number of AETs and their potential combinations is constantly growing, building efficient protection against them requires profound understanding of network traffic. However, most network security vendors still have not understood where the problem lies.

“Network security vendors have now had more than a year to provide their customers protection against AETs, but unfortunately we still have not seen much success in this area. Very few vendors have truly understood the magnitude of the problem, while some are struggling to provide some kind of protection. Most of the vendors who acknowledge the problem are incapable of building a working solution - instead, they are keeping themselves busy doing temporary and inflexible fixes. The rest just ignore the issue and do nothing”, said Ilkka Hiidenheimo, founder and CEO of Stonesoft.

According to Stonesoft, network security must be regarded as a dynamic, constantly evolving process.  A security vendor who still uses ten year old protocol normalization methods in order to look for exploits or other malicious activities is prone to miss the contemporary, that is, AETs. The core functionality of the protocol parsing cannot be static – instead, it has to evolve in order to meet the constantly changing threats. While new exploits, vulnerabilities and even attack vectors are constantly discovered and must be addressed quickly by the security products, the new evasions require equally dynamic and fast responses.

For more information about AETs, please visit and