Feeds

Build malware protection into operating systems

Security guru calls for integrity

Protecting against web application threats using SSL

Malware protection needs to be built into operating systems rather than bolted on as an afterthought if the industry stands any chance of dealing with the evolving threat of targeted attacks, according to a senior security researcher.

Joanna Rutkowska, chief exec of Invisible Things Lab, who is best known for her research on rootkits and Vista security, told delegates to the Gartner security conference in London on Monday that user stupidity was only part of the security problem.

She said competent users who, for example, used the privilege separation features built into Vista, were still not safe from security exploits. Better auto-exploit protection technology needs to be developed. In order to work properly this needs to built into operating systems.

"Third party prevention uses tricks and hacks. And that's no good," she said.

Rutkowska has been prominent in the industry for exposing the security shortcomings of Vista's kernel protection technology.

While recognising the general importance of security protection technologies, Rutkowska also noted their shortcomings. "Current technology is not reliable in detecting stealth malware. Protection solutions fail so we need detection. The two need to go together.

"Detection technologies are currently immature and even as the approach develops it will not replace prevention technologies, which are far more mature, despite their shortcomings," she said.

"Detection can never replace prevention. It's too late to do anything if, for example, you detect that your data has been stolen. You can't do anything to make an attacker forget what he has discovered."

Anti-virus vendors have found themselves locked in a perpetual arms race with virus writers, who are increasingly looking to make money from malware. Advances in rootkit development and obfuscation are accompanied by counter-responses from security vendors. Rutkowska argues that we need to move beyond this approach and develop an "automated way to check system integrity".

"The difficulty is that operating systems are too complex. We can't even reliably read system memory," Rutkowska pointed out. "It's not exactly a question of starting from scratch, but some code will need to be rewritten from the start," she added. ®

Reducing the cost and complexity of web vulnerability management

More from The Register

next story
Spies would need SUPER POWERS to tap undersea cables
Why mess with armoured 10kV cables when land-based, and legal, snoop tools are easier?
Early result from Scots indyref vote? NAW, Jimmy - it's a SCAM
Anyone claiming to know before tomorrow is telling porkies
Apple Pay is a tidy payday for Apple with 0.15% cut, sources say
Cupertino slurps 15 cents from every $100 purchase
Israeli spies rebel over mass-snooping on innocent Palestinians
'Disciplinary treatment will be sharp and clear' vow spy-chiefs
YouTube, Amazon and Yahoo! caught in malvertising mess
Cisco says 'Kyle and Stan' attack is spreading through compromised ad networks
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
China hacked US Army transport orgs TWENTY TIMES in ONE YEAR
FBI et al knew of nine hacks - but didn't tell TRANSCOM
Microsoft to patch ASP.NET mess even if you don't
We know what's good for you, because we made the mess says Redmond
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Security and trust: The backbone of doing business over the internet
Explores the current state of website security and the contributions Symantec is making to help organizations protect critical data and build trust with customers.