Build malware protection into operating systems
174478
Security guru calls for integrity Malware protection needs to be built into operating systems rather than bolted on as an afterthought if the industry stands any chance of dealing with the evolving threat of targeted attacks, according to a senior security researcher.â¦
641996
The end-user simply slips a special CD into the PC and reboots it. Instead of the usual operating system loading at boot, the Bank on Secure System software loads first. Once loaded a browser opens followed by a graphical keyboard for added security.
416302
(InfoWorld) - Symantec published a series of four research reports on Feb 28 that critique various security elements of Microsoft's new Windows Vista operating system, including the software's ability to ward off existing malware threats. Unsurprisingly, the security software maker, which still derives the bulk of its revenues from the estimated $3.6 billion market for technologies used to defend Windows computers, found a fair number of shortcomings in the latest iteration of Microsoft's dominant OS. One of the biggest problems is that Vista remains vulnerable to existing malware attacks designed to take advantage of flaws in earlier versions of the OS, according to the reports. However, the Cupertino, Calif.-based antivirus market leader also highlighted a number of features built into the product that it said will advance end-user security. An area where Symantec researchers said Microsoft has greatly improved security is related to the mitigation of virus attacks aimed at code-level vulnerabilities. Previous versions of Windows have been shipped with scads of coding errors that allowed hackers to deliver malware threats, but work on the part of Microsoft -- such as through its Security Development Lifecycle program -- has helped lower the volume of available vulnerabilities, according to the reports. The immediate benefit to Vista users will be the reduction of threats that use common infection techniques like buffer overflows and heap manipulations to deliver their payloads, Symantec predicted. Another area where Symantec recognizes security improvement on the part of Microsoft is in the use of its reduced user privilege model in Vista, which is aimed at preventing virus attacks from upping the administrative status of infected PCs to boost malware proliferation and related damage. While arguing that there may be the ability for hackers to disable Vista's new User Access Control, which is designed to keep users abreast of any changes attempted on their PCs by unknown software programs, Symantec concedes that the security tool should help fight malware attacks, including worm viruses. Despite the praise and its submission that Vista thus far appears to be the safest operating system ever produced by Microsoft, the Symantec reports levels a great deal of criticism at many other aspects of the OS. Vista is a more secure product than previous versions of Windows, but there is still plenty of need for users to buy the layered security defense products the security company markets, said Ollie Whitehouse, a researcher with Symantec's Security Response team. "Vista is a security evolution, but not a revolution," Whitehouse said. "Microsoft did invest a lot of time and resources into the development of Windows XP SP2, and Vista is a continuation of that, and they addressed a number of core issues, such as buffer overflows, but it is still only an OS, not a security solution itself." Vista may help stop some traditional types of attacks, such as worms, but Symantec maintains that newly emerging threats, integration problems with third-party Windows applications, and a range of other issues will keep users in the market for additional security tools. One area that remains a sore spot from Symantec's perspective is Microsoft's use of new features to protect the Vista kernel against root kits and other attacks. In 2006, a major controversy broke out between the two firms and other security technology providers based on the fact that Vista's PatchGuard system, available only in 64-bit versions of the OS, prevents any programs -- including Symantec's security applications -- from patching the software's kernel memory. Symantec and rival McAfee, among others, argued at that time that not being allowed to access the kernel as they have in prior iterations of Windows would prevent their advanced behavior-based technologies from working properly. But Microsoft and the security firms claim to have solved the problem using a set of APIs. In the research reports, Symantec repeats its contention that PatchGuard may also be easily bypassed, defeating its very purpose and allowing kernel-altering attacks, including root kits, to live on. Labeling the combination of PatchGuard and two other Vista kernel protection technologies, known as Driver Signing and Code Integrity, as a mere "bump in the road" for attackers, Symantec said that a single researcher bypassed all three features in one week's time, further proving their vulnerability. "Microsoft has made good strides with kernel protection, but again, it's not perfect," Whitehouse said. "PatchGuard has and will be broken, and while it is obviously better than nothing, people who have an interest will find ways to get around these features." Another area where Symantec leveled criticism at Microsoft is in relation to Vista's ASLR (Address Space Layout Randomization) feature, which is designed to help obscure programs stored in the operating system's memory to make it harder for attackers to isolate vulnerabilities. Symantec said the feature has a flaw that prevents it from working properly. Here again, Symantec mixed praise and calls for concern in outlining its observations of ASLR. "When implemented correctly, this technology is extremely effective in mitigating the exploitation of memory corruption and memory manipulation vulnerabilities," reads the Symantec report. However, the research contends that Symantec has already found that one element of ASLR that means to randomize and hide software components does not work consistently, therein making it easier for attackers to guess where vulnerabilities may lie. Symantec said further that Microsoft has confirmed the issue and pledged to fix it when it issues a Windows Vista SP1 update. Both the PatchGuard and ASLR issues feed into another Vista problem cited in the Symantec research: integration with third-party products. In addition to the potential problems introduced by PatchGuard to its own products, Symantec said that the third-party drivers provided by Microsoft may be targeted as a means of gaining kernel-level access on compromised machines. ASLR has been highlighted by at least one other security company as a potential weak point in Vista. Just as Symantec maintains that many of Vista's security features won't help protect end-users unless third-party software makers can effectively integrate with the tools, penetration testing specialists Core Security, based in Boston, published a report on Feb. 6 that highlighted a well-known vulnerability existing in CA's BrightStor backup software that it said could still be exploited on machines running Vista. Because the CA software had not been updated to integrate with ASLR and other Vista security features -- although CA said it would soon have a new version of the product to market and Microsoft officials disputed the issue -- the operating systems' onboard defense features won't help protect such legacy systems, Core said. Symantec's report repeatedly highlights the third-party integration issue as a major weak point for Vista's security goals. Microsoft officials stuck to their long-standing defense that Vista goes a long way toward mitigating many common PC security issues and that the company will continue to bring new security features to bear on the OS and future products. Microsoft said it is further investigating several specific product flaws cited in the Symantec report, including the ASLR problem. "It is important to note that none of the security features in Windows Vista, either individually or collectively, are intended as a 'Silver Bullet' solution to the problem of computer security," said Russ Humphries, senior product manager, Windows Vista Security. "We believe Microsoft has developed the right balance and made the right decisions when evaluating the tradeoffs between usability and security," Humphries said. "[Symantec's] report does not properly address the fact that many of the Window Vista security technologies have numerous options that allow for a user to make their own judgments as to their need for security balanced against usability."
509953
During a weeklong period in mid-November, security experts with Symantec observed roughly 65,000 new applications being downloaded onto the computers of customers participating in a new research project -- based on their analysis of the software, as many as 60 percent of the programs were malicious.The involved timeframe represented a relative high point for the percentage of unknown applications being downloaded by Symantec's project participants, and the basis for the company's assessment of the programs as malicious was predicated largely on the programs' use of obfuscated naming conventions.However, the numbers point to a disturbing trend that the researchers say may force the security company to change its fundamental approach for warding off threats -- that being that the number of malicious applications coming to life on the Web appears to be outpacing the volume of legitimate programs.With malware authors using fuzzing tools to find holes in popular applications such as Web browsers, and testing their work against commercial anti-virus (AV) products to ensure that the attacks evade detection by the tools, leading researchers at Symantec admit that defending against threats using traditional methods has become something of a losing battle."The reality is that most new malware is going undetected by commercial security products, and not just Symantec's, but we have to recognize that like all other AV products we are probably missing a sizeable amount of this malware," said Carey Nachenberg, a member of the company's Security Response team who also wears the title of Symantec Fellow."Eventually we write [virus] signatures and get those out to customers, but it appears that a sizeable proportion of this malware never gets detected," he said. "Instead of distributing one copy of each malware program to thousands of people, they're producing a copy for as few as two or three people and then re-writing it; so, if we get one version we can remove it from a few computers, but not all the variants. The problem with this is that there is the potential over time for almost everyone to have some form of infestation, maybe in only a few years time."The trend toward malware authors using small runs of attacks to evade detection and hook as many victims as possible, known as server-side polymorphism, is forcing Symantec to reassess how it goes about protecting its users.Since it can't hope to keep up with every flavor of threat that is being created, traditional countermeasures such as the use of malware signatures or behavioral heuristics will need to be augmented with new tactics, Nachenberg said.One such alternative is the use of the same distributed data collection capabilities that Symantec is using to track the proliferation of malware. By creating a system of file and Web site reputation by studying applications usage patterns among its customers, the researcher said, Symantec hopes to use a community approach to help people determine which programs they decide to use, or avoid.Much as many people turn to the reviews section on Amazon.com or the buyer feedback system on eBay to get a real-world take on products before they decide to buy, Nachenberg contends that by watching how people are using various applications the security vendor can use a process of elimination for weeding out malware from legitimate software.If only a few people among the millions of Symantec customers who could contribute usage data to such a program were utilizing some application in question, it would be prudent to recommend that people avoid the program until its nature has been better determined, he said.Using opt-out tools that provide anonymous feedback on applications that were built into Symantec's existing Norton AntiVirus and Internet Security 2008 products, the company is already gathering the type of data necessary to create such a system of recommendation."Right now this is just a long-term research project, but we hope that as we get more users involved in the system, we can truly get a better idea of what is on people's computers so that we can identify malicious software based on the demographics of who is using it, versus what it does," Nachenberg said. "We're hoping to get more clarity through the large base of users we have; by collecting this data we should be able to get the most comprehensive view of the usage patterns to derive reputation information for everything they use."Faced with questions over potential privacy issues driven by Symantec's ability to watch just who is using what applications and how, the researcher reiterated that users must be made aware of the data collection, allowed to opt-out, and guaranteed that all the information aggregation is done in an anonymous fashion.By offering users the ability to decide whether or not to use an application based on demographics, versus simply blocking programs based on its own observations, the company will also give people more freedom to determine what tools they feel are appropriate to use, he said."If we know that only five people are using a program, given the tens of millions of users we ultimately hope to have in the system, we can be totally objective and recommend that people wait until it is scrutinized further before using it," the researcher said. "We will need to have some manual process for white-listing programs as well, but we think that using this approach we can deliver a reasonable amount of quality with a low false positive rate."If the volume of new malware strains arriving on the Web continues to outpace the proliferation of legitimate programs, Nachenberg said that AV vendors including Symantec may need to move to a white-listing approach in general, and focus more attention on identifying good applications instead of trying to chase down all the bad."If there is less software to analyze that is good, it makes more sense to spend our time scanning for good programs and simply telling our users to avoid everything else," he said. "We're considering models where we can produce the world's largest up-to-date white list of software, but it's not something we can put together in a year; maybe in two-to-three years time."
312429
You can't cheat an honest person, they say. Like generations of scammers before them, some malware writers are taking that "advice" to heart, releasing their Trojan software and keyloggers as "cracked" versions of Vista oon peer-to-peer service. Who's going to turn them in, after all -- a would-be pirate?
124412
Earliest adopters of updated program should download again to ensure full security.
503684
Talk about the worst of both worlds: When Jon Espenschied tried to untangle a malware attack on his dual-boot system, he found out just how vulnerable combining open- and closed-source software can leave a machine.
166352
Over the past month, a new type of malicious software has emerged, using a decades-old technique to hide itself from antivirus software.
3394
The security guru for the One Laptop Per Child program unveils his plan to make the rugged machines uniquely resistant to spyware and hack-attacks. Ryan Singel reports from the RSA Conference.
405976
Letters: Going deeper on the question of security and operating systems.
58499
(InfoWorld) - When Windows Vista ships next year, customers might have a tougher time getting their security software to work properly, executives from Symantec said Wednesday. At issue are two new features being introduced with Vista: an enhanced Windows Security Center as well as a feature in the 64-bit version of Vista called PatchGuard. Microsoft says it is adding these features to lock down the operating system, but Symantec believes that they will be harmful to customers by making it harder for them to use third-party software. "There's no question that they're leveraging a monopolistic position to limit customer choice," said Chris Paden a Symantec spokesman. While Symantec executives did accuse Microsoft of being more difficult to work with on Vista than with previous operating system introductions, they stopped short of accusing Microsoft of antitrust violations. "It's not anti-competitive behavior, because Vista hasn't even hit the market yet, " Paden said. Security vendors like Symantec are in a state of heightened sensitivity these days as they've begun to compete with Microsoft head-on, and the specter of further antitrust actions looms over Microsoft's every move in the security space. Last week the European Union's spokesman on competition, Jonathan Todd, warned that theÂ market could be threatenedÂ if Microsoft doesn't allow security vendors a fair chance of competing. Symantec and other security vendors dislike PatchGuard because it prevents them from accessing the Windows kernel. They say it will stop them from delivering important features like Symantec's "anti-tampering" technology, which prevents malicious programs from modifying Symantec's own software. PatchGuard will also make it more difficult for security vendors to protect against malicious software that takes advantage of kernel-level bugs, said Eric Sites, vice president of research and development with Sunbelt Software. "There are a lot of new exploits coming out that exploit kernel-level drivers, " he said. "If we're able to get into the kernel, we can watch for things like that, but with what Microsoft is doing we can't do that." Microsoft declined to be interviewed for this article, but in an interview with IDG News last week a Microsoft executive said that PatchGuard was simply an effort toÂ prevent the kernel from being misused. "We think that there's a significant amount of confusion around... certain security features in the product that we think raise the foundation," said Stephen Toulouse a senior product manager in the Security Technology Unit. "What we're doing is we're walling off the kernel from attackers, because the functionality that is currently there was never meant to be used by anybody -- by software vendors or attackers." But PatchGuard is enabled only in the 64-bit version of Windows. Because there are few 64-bit applications written for Vista, most of Vista's initial users are expected to run the operating system in 32-bit mode, and their security software will still be able to access the kernel. A more immediate issue for Symantec is many Vista users will find that both the Windows Security Center and Symantec warnings will pop up simultaneously. This doesn't happen with Windows XP because Symantec's software is able to automatically disable the Windows warnings, but with Vista users will have to turn off the Security Center themselves. This will make things unnecessarily complicated for many customers, said Rowan Trollope, Symantec's vice president of consumer engineering. "Most users can't figure out how to do that," he said. With two warnings popping up, each with different wording, users will be confused at best, and may simply begin ignoring security warnings altogether, said Sites. Some observers have speculated that Symantec may press the EU for action against Microsoft in this matter, but Trollope and Paden wouldn't say what Symantec planned to do to address these problems. "We're looking at all the possibilities now," said Trollope, "And none of them are good for customers."ADVERTISEMENTMAKE SOA REAL WITH IBM WEBSPHERE PODCASTStreamline processes and maximize efficiency within a proven service oriented architecture. Take back control of your business processes with IBM WebSphere.
120681
How do I fully remove an antivirus program from my computer?
693586
New utility from PivX keeps intruders out of Windows systems.
185711
Also: High security built right into $100 laptop's OS. Read these stories and more from around the Web at News.com Extra.
263204
ElectricNews: Mandrakesoft and several other Linux backers are to work together to build a version of the operating system that will be far more secure than previously available.
507312
Trojan.Mebroot malware is read at startup, then changes the Windows kernel to avoid detection.
621411
Attackers could attack Windows, launch a denial of service attack, or execute malicious code.