Feeds

McAfee dumps signatures and proclaims an (almost) end to botnets

Claims first truly integrated security package

SANS - Survey on application security programs

RSA 2013 Signature-based malware identification has been around since the dawn of the computer security industry, but McAfee has said it's dumping the system – or rather, adapting it – in an upgraded security suite which will (it claims) virtually eliminate susceptibility to botnets.

McAfee's malware signature database has grown to over 113 million core samples in the last year. But rather than using just that data to spot malware, McAfee has now integrated behavioral heuristics into its security code so that it can spot unknown samples based on their operating characteristics. The end result could crush botnets as a threat, said the company's GM of network security, Pat Calhoun.

"We're getting rid of malware signatures, all our systems now work on behavior and reputation," he said. "Customers no longer have to worry about botnets; we will take care of that for them. We can catch things that no one else can in the industry."

Calhoun told The Register that when Intel took over McAfee in 2010, Chipzilla put extra funding into countering the threat from botnets. As a result, it now has the ability to search specifically for command-and-control server code, as well as the malware that brings new computers into the botnet fold.

In all, McAfee says it has made 38 new improvements to its security suite, and integrated its various modules much more tightly with each other. Integration of security products into a single unified suite has been the goal of the large security vendors for years, but this time McAfee thinks it has cracked it.

"You can’t take a set of tools, codify a few marketing relationships, and expect it to work," explained McAfee CTO Mike Fay. "We have 150 such relationships and you need to merge them into a system. We've done this and over the next three years you're going to see more innovation as a result than in the last 10 of McAfee's history."

Mac and PC users on Chipzilla's hardware will get an advantage, of course, since McAfee's Deep Defender relies on Intel's kit for much of its efficacy. Fay said it would look at market demand and some technology rejiggering before it would integrate with AMD chips.

As for rootkits – a particular Intel bugbear – McAfee touted a recent test by AVLabs that it sponsored that highlighted the effectiveness of part of its suite at cutting this attack vector short (although it did not specify testing criteria). The tests give McAfee a 100 per cent rating at killing rootkits, compared to 83 per cent for Microsoft and 67 per cent for Symantec.

McAfee also announced it has bought in sandboxing technology from ValidEdge, which runs malware samples in a virtual machine to test their effects on Windows and other systems without letting it loose on the operating system. The first products using the technology will be out in the second half of this year. ®

Combat fraud and increase customer satisfaction

More from The Register

next story
Parent gabfest Mumsnet hit by SSL bug: My heart bleeds, grins hacker
Natter-board tells middle-class Britain to purée its passwords
Samsung Galaxy S5 fingerprint scanner hacked in just 4 DAYS
Sammy's newbie cooked slower than iPhone, also costs more to build
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Web data BLEEDOUT: Users to feel the pain as Heartbleed bug revealed
Vendors and ISPs have work to do updating firmware - if it's possible to fix this
Snowden-inspired crypto-email service Lavaboom launches
German service pays tribute to Lavabit
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Call of Duty 'fragged using OpenSSL's Heartbleed exploit'
So it begins ... or maybe not, says one analyst
NSA denies it knew about and USED Heartbleed encryption flaw for TWO YEARS
Agency forgets it exists to protect communications, not just spy on them
prev story

Whitepapers

Designing a defence for mobile apps
In this whitepaper learn the various considerations for defending mobile applications; from the mobile application architecture itself to the myriad testing technologies needed to properly assess mobile applications risk.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.