Feeds

Intel goes virtual to root out rootkits

DeepSafe: Follow the malware

The Power of One eBook: Top reasons to choose HP BladeSystem

IDF 2011 Intel bought McAfee so it could bring antivirus and intrusion detection closer to the chip, and with DeepSafe – a technology that CEO Paul Otellini previewed at Intel Developer Forum in San Francisco this week – the company will be making good on that promise.

DeepSafe will put some of the antivirus code underneath the operating system, in a virtualization layer that makes use of the VT hardware-assisted virtualization that is part of all modern Core processors for PCs and Xeon processors for servers.

Intel's Candace Worley

McAfee's GM of endpoint security
Candace Worley

DeepSafe will be the foundation of a number of different enterprise security products that the McAfee unit will roll out, beginning later this year. Joining Otellini on stage at IDF was Candace Worley, general manager of endpoint security at Intel's McAfee unit, who showed of a beta of McAfee antivirus software that does kernel-mode rootkit prevention.

"The traditional approach is really a software-based approach, and the challenge of that approach is that malware – for example, rootkits – load and embed themselves at the kernel level of the operating system, making it very difficult for antivirus products to actually see them and clean them," explained Worley.

"Using a combination of hardware and software allows us to monitor memory and processor activity, giving us a way of detecting the intrusion of unknown threats," explained Worley. "This is a fundamentally different approach to security."

Intel McAfee DeepSafe

Intel's McAfee DeepSafe rides below the OS

Intel did not divulge exactly how DeepSafe works and if it would require customers to run their operating system images on an actual hypervisor for it to work. From the diagram above, it looks like McAfee has in essence created a security hypervisor layer that nonetheless will allow an operating system to think that it is running on bare metal, even though it isn't. It stands to reason that this security hypervisor layer will not allow for virtual machine partitioning, and further than there will eventually be versions of it that ride below actual bare metal hypervisors, thus securing them.

Intel could obviously embed DeepSafe within ESXi, Xen, KVM, and Hyper-V hypervisors too, to secure virtual machine guests and their operating systems, but that would leave the hypervisor – which is really itself a kind of stripped down operating system with partitioning – exposed to security risks. It will be interesting to see how this plays out, and if McAfee will support the AMD-V virtualization extensions for Fusion PC and Opteron server chips from Advanced Micro Devices. While Intel did not mention Xeon processors specifically in the DeepSafe presentation, there is no technical reason why it could not be used to secure server workloads.

McAfee says that more than 1,200 new rootkits per day are detected out there on the networks of the world. ®

The Power of One eBook: Top reasons to choose HP BladeSystem

More from The Register

next story
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
BMW's ConnectedDrive falls over, bosses blame upgrade snafu
Traffic flows up 20% as motorway middle lanes miraculously unclog
LibreSSL RNG bug fix: What's all the forking fuss about, ask devs
Blow to bit-spitter 'tis but a flesh wound, claim team
Mozilla fixes CRITICAL security holes in Firefox, urges v31 upgrade
Misc memory hazards 'could be exploited' - and guess what, one's a Javascript vuln
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
Don't look, Snowden: Security biz chases Tails with zero-day flaws alert
Exodus vows not to sell secrets of whistleblower's favorite OS
Putin: Crack Tor for me and I'll make you a MILLIONAIRE
Russian Interior Ministry offers big pile o' roubles for busting pro-privacy browser
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
prev story

Whitepapers

Top three mobile application threats
Prevent sensitive data leakage over insecure channels or stolen mobile devices.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
Application security programs and practises
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
The Essential Guide to IT Transformation
ServiceNow discusses three IT transformations that can help CIO's automate IT services to transform IT and the enterprise.