Feeds

McAfee dumps signatures and proclaims an (almost) end to botnets

Claims first truly integrated security package

Secure remote control for conventional and virtual desktops

RSA 2013 Signature-based malware identification has been around since the dawn of the computer security industry, but McAfee has said it's dumping the system – or rather, adapting it – in an upgraded security suite which will (it claims) virtually eliminate susceptibility to botnets.

McAfee's malware signature database has grown to over 113 million core samples in the last year. But rather than using just that data to spot malware, McAfee has now integrated behavioral heuristics into its security code so that it can spot unknown samples based on their operating characteristics. The end result could crush botnets as a threat, said the company's GM of network security, Pat Calhoun.

"We're getting rid of malware signatures, all our systems now work on behavior and reputation," he said. "Customers no longer have to worry about botnets; we will take care of that for them. We can catch things that no one else can in the industry."

Calhoun told The Register that when Intel took over McAfee in 2010, Chipzilla put extra funding into countering the threat from botnets. As a result, it now has the ability to search specifically for command-and-control server code, as well as the malware that brings new computers into the botnet fold.

In all, McAfee says it has made 38 new improvements to its security suite, and integrated its various modules much more tightly with each other. Integration of security products into a single unified suite has been the goal of the large security vendors for years, but this time McAfee thinks it has cracked it.

"You can’t take a set of tools, codify a few marketing relationships, and expect it to work," explained McAfee CTO Mike Fay. "We have 150 such relationships and you need to merge them into a system. We've done this and over the next three years you're going to see more innovation as a result than in the last 10 of McAfee's history."

Mac and PC users on Chipzilla's hardware will get an advantage, of course, since McAfee's Deep Defender relies on Intel's kit for much of its efficacy. Fay said it would look at market demand and some technology rejiggering before it would integrate with AMD chips.

As for rootkits – a particular Intel bugbear – McAfee touted a recent test by AVLabs that it sponsored that highlighted the effectiveness of part of its suite at cutting this attack vector short (although it did not specify testing criteria). The tests give McAfee a 100 per cent rating at killing rootkits, compared to 83 per cent for Microsoft and 67 per cent for Symantec.

McAfee also announced it has bought in sandboxing technology from ValidEdge, which runs malware samples in a virtual machine to test their effects on Windows and other systems without letting it loose on the operating system. The first products using the technology will be out in the second half of this year. ®

Intelligent flash storage arrays

More from The Register

next story
Regin: The super-spyware the security industry has been silent about
NSA fingered as likely source of complex malware family
Why did it take antivirus giants YEARS to drill into super-scary Regin? Symantec responds...
FYI this isn't just going to target Windows, Linux and OS X fans
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Home Office: Fancy flogging us some SECRET SPY GEAR?
If you do, tell NOBODY what it's for or how it works
HACKERS can DELETE SURVEILLANCE DVRS remotely – report
Hikvision devices wide open to hacking, claim securobods
'Regin': The 'New Stuxnet' spook-grade SOFTWARE WEAPON described
'A degree of technical competence rarely seen'
Syrian Electronic Army in news site 'hack' POP-UP MAYHEM
Gigya redirect exploit blamed for pop-rageous ploy
Astro-boffins start opening universe simulation data
Got a supercomputer? Want to simulate a universe? Here you go
prev story

Whitepapers

Seattle children’s accelerates Citrix login times by 500% with cross-tier insight
Seattle Children’s is a leading research hospital with a large and growing Citrix XenDesktop deployment. See how they used ExtraHop to accelerate launch times.
Getting started with customer-focused identity management
Learn why identity is a fundamental requirement to digital growth, and how without it there is no way to identify and engage customers in a meaningful way.
Why CIOs should rethink endpoint data protection in the age of mobility
Assessing trends in data protection, specifically with respect to mobile devices, BYOD, and remote employees.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Website security in corporate America
Find out how you rank among other IT managers testing your website's vulnerabilities.