Feeds

Intel goes virtual to root out rootkits

DeepSafe: Follow the malware

SANS - Survey on application security programs

IDF 2011 Intel bought McAfee so it could bring antivirus and intrusion detection closer to the chip, and with DeepSafe – a technology that CEO Paul Otellini previewed at Intel Developer Forum in San Francisco this week – the company will be making good on that promise.

DeepSafe will put some of the antivirus code underneath the operating system, in a virtualization layer that makes use of the VT hardware-assisted virtualization that is part of all modern Core processors for PCs and Xeon processors for servers.

Intel's Candace Worley

McAfee's GM of endpoint security
Candace Worley

DeepSafe will be the foundation of a number of different enterprise security products that the McAfee unit will roll out, beginning later this year. Joining Otellini on stage at IDF was Candace Worley, general manager of endpoint security at Intel's McAfee unit, who showed of a beta of McAfee antivirus software that does kernel-mode rootkit prevention.

"The traditional approach is really a software-based approach, and the challenge of that approach is that malware – for example, rootkits – load and embed themselves at the kernel level of the operating system, making it very difficult for antivirus products to actually see them and clean them," explained Worley.

"Using a combination of hardware and software allows us to monitor memory and processor activity, giving us a way of detecting the intrusion of unknown threats," explained Worley. "This is a fundamentally different approach to security."

Intel McAfee DeepSafe

Intel's McAfee DeepSafe rides below the OS

Intel did not divulge exactly how DeepSafe works and if it would require customers to run their operating system images on an actual hypervisor for it to work. From the diagram above, it looks like McAfee has in essence created a security hypervisor layer that nonetheless will allow an operating system to think that it is running on bare metal, even though it isn't. It stands to reason that this security hypervisor layer will not allow for virtual machine partitioning, and further than there will eventually be versions of it that ride below actual bare metal hypervisors, thus securing them.

Intel could obviously embed DeepSafe within ESXi, Xen, KVM, and Hyper-V hypervisors too, to secure virtual machine guests and their operating systems, but that would leave the hypervisor – which is really itself a kind of stripped down operating system with partitioning – exposed to security risks. It will be interesting to see how this plays out, and if McAfee will support the AMD-V virtualization extensions for Fusion PC and Opteron server chips from Advanced Micro Devices. While Intel did not mention Xeon processors specifically in the DeepSafe presentation, there is no technical reason why it could not be used to secure server workloads.

McAfee says that more than 1,200 new rootkits per day are detected out there on the networks of the world. ®

High performance access to file storage

More from The Register

next story
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Samsung Galaxy S5 fingerprint scanner hacked in just 4 DAYS
Sammy's newbie cooked slower than iPhone, also costs more to build
Putin tells Snowden: Russia conducts no US-style mass surveillance
Gov't is too broke for that, Russian prez says
Snowden-inspired crypto-email service Lavaboom launches
German service pays tribute to Lavabit
Mounties always get their man: Heartbleed 'hacker', 19, CUFFED
Canadian teen accused of raiding tax computers using OpenSSL bug
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Call of Duty 'fragged using OpenSSL's Heartbleed exploit'
So it begins ... or maybe not, says one analyst
prev story

Whitepapers

Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
SANS - Survey on application security programs
In this whitepaper learn about the state of application security programs and practices of 488 surveyed respondents, and discover how mature and effective these programs are.