|
|
| Internet Security Information |
|
|
|
|
Desktop Security Software Risks - Part 1
This is the second in a series of articles highlighting reasons why we need a new model for anti-virus and security solutions. Reason #2: the Desktop Security Software Risks The risks of placing software on the desktop are such that I will be breaking this article into two parts. Fundamentally we think of having software on our desktops as a good thing. I love downloading or installing new packages and seeing what new creative things people do to the user interface or what they do to make certain aspects of my life easier or more fun. But there are problems inherent with software that resides on the desktop, especially security software. All developers will know what I mean. First and foremost, desktop software can be reverse engineered. What's that mean? Have you ever inadvertently double-clicked on a file and had garbage show up or seen something that looks similar to this? http://www.checkinmyemail.com/Articles/image001.jpg The old hex dump. Programmers will know it well. We actually spend a good deal of time trying to read this stuff. Basically, if there are programs that can (and do) turn instructions like the following If UserBirthDate < "01/01/1960" then IsReallyOld = "Yes Else IsReallyOld = "No" End If into something like the picture above, then the reverse is true: people have developed software that can take that gobbeldy-gook in the picture above and turn it somewhat into the if-statement I wrote out. The reversing software won't know that I had an item called UserBirthDate, but it will know I was testing for a value of January 1, 1960 and it will be able to say that based on that value I set another item to Yes or No. So now we install our fool-proof anti-virus software on our desktop (or our firewall for that matter). Well, so too can a virus author. And that virus author or hacker will also have gotten a copy of the latest reverse-engineering software from his local hacking site. He now goes upon his task of reverse-engineering the software and then trying to decipher the results. It's not easy but it can be done. Unfortunately, vendors know this and understand this as an acceptable risk. The problem here is that your security software is at risk. If your vendor codes an error, the virus author can and will detect it. For example, if your vendor should exclude a file from scanning, it's possible the virus author will figure out which file (or type of file) that is and bury his code there. If the vendor excludes files from scanning or heuristics, it's possible that virus author will figure out a way to corrupt that file. That being said, there are other risks. As we have said, once software is on the desktop it affords virus authors an opportunity to reverse-engineer security software. The knowledge that reverse-engineering provides is invaluable to a virus author when building his next software attack. Third, virus authors can learn where the anti-virus vendors put there software and put the links to their software (directory folders, registry entries, etc.). This too is invaluable information. In fact, in some ways it teaches people intent on writing malicious software clues as to how to infiltrate the computers' operating system, where registry entries need to be made to force software to be loaded every time a computer is started, etc. This information is generally available all over the web and in manuals for operating systems, especially manuals on such subjects as the Windows Registry. But having the software teach you where things belong to be effective is powerful knowledge. Lastly, and perhaps most significantly, is the issue of forebearance. The anti-virus vendors usually know more about the potential exploits inherent in programs than virus authors but they are bound by the fact that should they try to prevent them before the exploits occur, they could be branded as irresponsible for teaching virus authors about these very exploits. For example, when Microsoft first released the macro capabilities of Word, anti-virus vendors immediately realized the potential for danger in macros, but they were handcuffed. If they released software that disabled macros before the first macro virus was ever released, they would signal to virus authors the inherent destructive powers of macros. They chose instead to wait, handcuffed by the limitations of desktop software. Until the Internet there really has been no better medium for delivering virus solutions than desktop software. It was relatively inexpensive to deploy (either market the software and sell it in stores or provide free downloads on bulletin boards and web sites). It is, however, expensive to keep updated in terms of time and effort, even with automated update systems. The Internet caused several things to happen: by becoming a powerful medium for sharing files, whole families of viruses disappeared practically overnight (boot sector viruses, for example); by becoming the option of choice for sharing files, it was easier to infect a single file and have thousands download it. A better solution is to place the security software in an offsite appliance of its own making. All Internet, intranet, networking connections flow through the appliance. Selling off the shelf hardware appliances with built-in security software is better than a desktop software solution but it still suffers ?to a lesser extent- from the pratfalls that desktop software falls prey to. Even better is to create a service that a 3rd party vendor manages in a secure environment. In such an instance both the software and the hardware are away from the prying eyes of the malicious software authors. This further reduces the opportunity for malicious authors to discover the tricks and techniques employed by the security vendors to protect you. About The Author Tim Klemmer Tim Klemmer has spent the better part of 12 years designing and perfecting the first true patented behavior-based solution to malicious software.
|
|
|
|
RELATED ARTICLES
Adware and Spyware: The Problems and Their Solutions The Threat Traditional Antivirus Programs Useless Against New Unidentified Viruses! Every now and then you can read about a new virus and the damage it causes. The millions viruses costs companies each time they strike. It is however not only companies that are suffering from the damages caused by viruses. A virus can be just as damaging if not more for a private Internet user by destroying important documents, family pictures and everything else you keep on your computer. Therefore should no home computer be without a good virus protection software. This way you can protect your computer and yourself from loosing data, corrupted hard drives and a number of other problems. There are several anti virus programs available of which some are free and some are not. You should however always remember that you might get what you paying for, meaning that the service and the updates might be better for the paid alternatives and thereby protect your computer better. Network Security 101 As more people are logging onto the Internet everyday, Network Security becomes a larger issue. In the United States, identity theft and computer fraud are among the fastest rising crimes. It is important to protect your network and ensure the safety of all computers and users in that network. Protect Your Little Black Book The movie Little Black Book features a young woman, Stacy, who is frustrated when her boyfriend refuses to share information about his past relationships. When his PDA, a Palm Tungsten C, falls into her hands, she is faced with a conundrum. Does she give it back, or does she explore it? If she gave it back, we wouldn't have a movie, now would we? Stacy then proceeds to identify his ex-girlfriends and contact them. Let the games begin. Social Engineering: You Have Been A Victim Monday morning, 6am; the electric rooster is telling you it's time to start a new work week. A shower, some coffee, and you're in the car and off. On the way to work you're thinking of all you need to accomplished this week. Then, on top of that there's the recent merger between your company and a competitor. One of your associates told you, you better be on your toes because rumors of layoffs are floating around. Protecting Your Identity On The Internet Afraid that someone is monitoring your PC or installed a keylogger to record every single keystroke? Find out which tools you need to get to make sure you are protected. Internet Small Business and Fraud Be careful of sites that promise to send you "instant pins". These companies usually have lax credit card security and can afford customer charge backs from fraudulent transactions. Instant gratification, so coveted by our lifestyles, is something to be very wary of in the realm of online business. 3 Steps to Ending Scams and Virus Problems Watching how the traditional media covers the latest virus or scam would make one think we are all innocent victims and it is the "evil Internet" at work once again. News flash! Innocent? More like uninformed. Victim? In many cases add the word "willing." The media's point of view and how they choose to portray these occurrences always makes me chuckle. Internet Privacy Over the past few years as the internet has become more and more popular, privacy has become a major issue. Just as if you are walking down the street and can be watched, every click of your mouse every website you browse, or file you download, is traceable. In recent years this has become a major issue. Anti-Spyware Protection: Behind How-To Tips There is no doubt that "how-to articles" have become a separate genre. One can find such an article about almost anything; there are even some entitled "How to Write a How-To Article". And, of course, the Web is swarming with the ones like "10 Steps to Protect Your PC from Spyware"(if not 10, any number will do; odd ones like 5,7,9 are most popular) or "How to Forget About Spyware For Good". Please don't accuse me of being sarcastic -- I am not; all these articles by all means are informative and so very useful. They all include really handy tips to protect you from this recently emerged plague called spyware. But? Virus Prevention 101 Blaster, Welchia, Sobig, W32, Backdoor, Trojan, Melissa, Klez, Worm, Loveletter, Nimda? Do these names sound Familiar? Protection for Your PC - Painless and Free! Viruses, Bugs, Worms, Dataminers, Spybots, and Trojan horses. The Internet is a veritable minefield of things that can invade your PC and affect it's Security and Performance. Why you Must Secure your Digital Product and Thank You Web Page A couple of years back, I paid my dues the 'hard way'. Be Aware of Phishing Scams! If you use emails actively in your communication, you must have received various messages claiming to be from Ebay, Paypal and a number of banks. A recent email as if from U.S. Bank Corporation that I received contains the subject "U.S. Bank Fraud Verification Process" and in the body of the mail it says "We recently reviewed your account, and suspect that your U.S. Bank Internet Banking account may have been accessed by an unauthorized third party. Protecting the security of your account and of the U.S. Bank network is our primary concern. Therefore, as a preventative measure, we have temporarily limited access to sensitive account features. To restore your account access, please take the following steps to ensure that your account has not been compromised:". It continues with a link to a webpage, which looks very similar to original web page of the bank. Is Your Music Player Spying On You? In today's times spyware is a very serious issue and all computer users should be aware of the possible damage it can cause. It is estimated by well known industry insiders that nearly 90% of all computers are infected with some kind of spyware. This no surprise as spyware programs can be highly contagious and spread from computer to computer via emails and network exchanges rapidly. Spyware is Not Like a Nosy Neighbor Remember the television show about the nosy neighbor Mrs. Kravitz always peeking out her window or over the fence, sometimes even knocking on the door just to find out what was going on in her neighborhood? If you don't wait a month or so and the DVD or the movie will be out. Let's move on. New Mass Mailing Spamming Internet Trojan for the Windows Platform May. 16th 2005 - MicroWorld has reported the discovery of Troj/Sober-Q, which is a mass mailing spamming internet Trojan for the Windows platform. Website Security - Creating a Bulletproof Site in 5 Easy Steps When it comes to a secure website and passwords it is all in your hands to create a password that a hacker simply cannot crack. However, this will require that you be creative and use everything at your fingertips to create the strongest password possible for a secure web site. Is The Internet Over Regulated Today's Internet or World Wide Web is being over regulated. Behavior to Stay Safer Online 1. Importance of a Virus Scanner: A Antivirus program can help to prevent you from becoming infected with a Virus or Trojan. It is extremely important to make sure this program is updated at least once a week, and all drives are scanned. Viruses usually are used to destroy your Data or Hardware. Where as Trojans are used to gain remote access into your system. Always scan any new files you receive as well, even if they are off a friend, you don't know where those files originated from. ALWAYS use a little common sense when on the Internet as well. Don't accept files from an entrusted source. Don't go to web sites you have received spam for, they can be infected with viruses or asking you to download files that are infected. Always go only to official sites (i.e... If you ask for a web address for Norton and someone says ww.nortfix.com, that is obviously not an official site). Keep in mind that an Antivirus will only detect known viruses. It is possible that someone can create a new virus or manipulate an existing Virus or Trojan to the point it will no longer be detected by an Antivirus. As each unknown virus is discovered it is then added into the Antivirus database. Always create rescue disks for your Antivirus program, these will enable you to access your computer through MS-DOS if you are unable to access it through windows. If you do not have an Antivirus program try the HouseCall free online virus scan the link if on the top right side of this page. Also never run 2 different Antivirus . By using two different Antivirus software, sometimes the rule sets can cause conflicts in each other.. or think the other is a virus.. which can also give false positives (meaning it detects a file as a Virus or Trojan, when it isn't one).. or not detect viruses as it should. Always delete files you do not remember downloading.
|
| home | site map |
| Copyright © 2005 web.adsense.business.free.fr |