Feeds

McAfee dumps signatures and proclaims an (almost) end to botnets

Claims first truly integrated security package

Next gen security for virtualised datacentres

RSA 2013 Signature-based malware identification has been around since the dawn of the computer security industry, but McAfee has said it's dumping the system – or rather, adapting it – in an upgraded security suite which will (it claims) virtually eliminate susceptibility to botnets.

McAfee's malware signature database has grown to over 113 million core samples in the last year. But rather than using just that data to spot malware, McAfee has now integrated behavioral heuristics into its security code so that it can spot unknown samples based on their operating characteristics. The end result could crush botnets as a threat, said the company's GM of network security, Pat Calhoun.

"We're getting rid of malware signatures, all our systems now work on behavior and reputation," he said. "Customers no longer have to worry about botnets; we will take care of that for them. We can catch things that no one else can in the industry."

Calhoun told The Register that when Intel took over McAfee in 2010, Chipzilla put extra funding into countering the threat from botnets. As a result, it now has the ability to search specifically for command-and-control server code, as well as the malware that brings new computers into the botnet fold.

In all, McAfee says it has made 38 new improvements to its security suite, and integrated its various modules much more tightly with each other. Integration of security products into a single unified suite has been the goal of the large security vendors for years, but this time McAfee thinks it has cracked it.

"You can’t take a set of tools, codify a few marketing relationships, and expect it to work," explained McAfee CTO Mike Fay. "We have 150 such relationships and you need to merge them into a system. We've done this and over the next three years you're going to see more innovation as a result than in the last 10 of McAfee's history."

Mac and PC users on Chipzilla's hardware will get an advantage, of course, since McAfee's Deep Defender relies on Intel's kit for much of its efficacy. Fay said it would look at market demand and some technology rejiggering before it would integrate with AMD chips.

As for rootkits – a particular Intel bugbear – McAfee touted a recent test by AVLabs that it sponsored that highlighted the effectiveness of part of its suite at cutting this attack vector short (although it did not specify testing criteria). The tests give McAfee a 100 per cent rating at killing rootkits, compared to 83 per cent for Microsoft and 67 per cent for Symantec.

McAfee also announced it has bought in sandboxing technology from ValidEdge, which runs malware samples in a virtual machine to test their effects on Windows and other systems without letting it loose on the operating system. The first products using the technology will be out in the second half of this year. ®

The essential guide to IT transformation

More from The Register

next story
Goog says patch⁵⁰ your Chrome
64-bit browser loads cat vids FIFTEEN PERCENT faster!
Chinese hackers spied on investigators of Flight MH370 - report
Classified data on flight's disappearance pinched
NIST to sysadmins: clean up your SSH mess
Too many keys, too badly managed
Scratched PC-dispatch patch patched, hatched in batch rematch
Windows security update fixed after triggering blue screens (and screams) of death
Researchers camouflage haxxor traps with fake application traffic
Honeypots sweetened to resemble actual workloads, complete with 'secure' logins
prev story

Whitepapers

Top 10 endpoint backup mistakes
Avoid the ten endpoint backup mistakes to ensure that your critical corporate data is protected and end user productivity is improved.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Backing up distributed data
Eliminating the redundant use of bandwidth and storage capacity and application consolidation in the modern data center.
The essential guide to IT transformation
ServiceNow discusses three IT transformations that can help CIOs automate IT services to transform IT and the enterprise
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.