OS X Malware

If you thought using an Apple with Mac OS was safe from all the nasties out there, think again!!! Even though the risk is lower for Mac OS compared to Windows, you still need to take the proper precautions.

In the words of many Windows antimalware developers, OS X users can feel a little less smug about their security after a new piece of OS X malware was discovered circulating on various fake codec sites. As would be expected, this news is beginning to receive fairly widespread coverage across the Internet, though more coverage has been received in recent days on arguments about whether the Leopard firewall is fundamentally flawed or not (probably not).

Read more

Beware of software cracks!!!

Those tempted to download software cracks to unlawfully activate software from a trial mode into a paid mode have been warned that they may be unknowingly installing hacking tools onto their system.

Read more

Malware bazaar @ Bank of India Website

Read this article on The Register about how attacker were able to hack the Bank of India website to infect its online customers with malware. You might re-think whether your bank is truly delivering on its promises for safer online banking... go through their policy statements... you might be surprised to find out exactly how much they claim liability if you get compromised while doing an online transaction.

Is there a magic pill for security?

I always wonder whether there is or whether there will ever be a magic pill for security. A one shot solution to protect from it all. With the direction the security industry is heading and the emergence of new threats, more intelligent, adaptive, and evolving threats, I do not think such a thing exists in the present or even in the future.

Maybe it is human nature, but we mostly tend to be in a defensive nature. We react only when things go wrong. I am not saying this just in the context of computer security. If there was a guy in the organization who thought differently and proposed ideas that are preventive of some sort, management sometimes fail to see the point and disregard it under the grounds of being wasteful of resources. It may also be that the guy failed to present the point across to the management in an understanding manner in the first place, but thats not the point I am trying to make here.

I have been noticing emergence of new technologies in the security arena, and some although not referred as new technologies, people have been coming up with new approaches to deal with viruses, malware and the like.

There have been several news recently on new startups that are whitelisting companies and I myself have posted and entry on this. The latest I came across is relating to malware.

A new startup by some previous Microsoft employees has released a beta version of a realtime malware blocking tool for the browser. It seems that they have entered a market dominated by big players such as McAfee's SiteAdvisor, Symantec's AntiBot, Exploit Prevention Labs' LinkScanner, and Google.

According to the company website, the tool can protect the user against malware while surfing social network sites and blogs (eg. facebook, blogger), watching embedded flash videos (eg. youtube), viewing sites with banner ads and widgets (eg. almost every site), clicking search engine results that unknowingly point to malicious sites (eg. while googling).

According to article on Techworld.com the tool has a multilayer strategy against the malware. The first layer works at the kernel level by monitoring dozens of windows processes and services amongst the API calls to the kernel and suspicious behavior from the browser. This realtime task is done by the identification and interception of the behavior based profiling algorithm.


The second layer protects by using blacklisting based on a database of malicious links and blocks the site.


As I have said before, these technologies aren't new technologies. Blacklisting and anomaly based malware detection has been around for sometime. And these technologies are being researched by academics even today. However I believe this tool is a one of a kind as there approach is different and obviously the implementation will be different from every other product out there.

It is indeed interesting and hopeful to see such attempts by people in the battle against the threats that exist out there. And such attempts are needed despite the many products that claim to be "the" magic pill to solve all your problems.

All images in this article have been taken from the Haute Secure website.
Original news article is from Techworld.com.

Bye Bye Anti-Virus?

Recently I read an interesting article regarding Anti-Virus (AV) technology. This article reports that the AV technology is dying and will be replaced by a technology called whitelisting. Some of the trends that we are seeing today is that major AV companies are trying to acquire the whitelisting technology, and the rise of new whitelisting startups. More on this article can be read on The Register.

One of the whitelisting vendors stated in the article was SignaCert. So I did some research on their site. The basis behind the concept of whitelisting is software authentication. According to SignaCert, a whitelist is a repository of identified authentic individual data elements (file signatures generated using cryptographic hashing techniques) that are used to validate the integrity of contents on devices (such as files stored on PCs).

For the whitelists to be effective, it should contain software signatures and metadata of a wide range of commercially available software relavent to an enterprise’s specific needs. These signatures and metadata should be based on the source and from verifiable authentic sources. The signatures and metadata needs to be continually synchronized against the continuous changes to the software by the vendors. It should provide simple and flexible mechanisms to extend the repository for these commercial and also internally developed custom applications. And flexible and easy to use mechanisms for organizing the whitelists.

The goal of all this and other fancy products they have are to ensure the integrity of the IT platform. Whether it is the files stored on the servers/PCs or configuration, registries, etc. Besides this there are other products out their which specializes in file integrity and one of the most widely used and popular one is Tripwire.

With all this, I wonder if the signature based virus detection will get obsolete and whitelist technology will takeover. Or would other technologies will come to surface as they gain more production value such as more adaptive and intelligent techniques in detecting such malware. One such interesting project I came across sometime back is Janus (the intelligent firewall) project by InSeon Yoo. This project has a non-signature based virus detection module.

Whatever the future holds, I believe this battle with viruses and other malware will never end unless more innovative and intelligent solutions are developed.

References:

• The Register: A slow death of AV technology
• SignaCert Website
• SignaCert: Software Signature Quality
• Tripwire