Is there a solution

 
 
By Larry Seltzer  |  Posted 2007-09-05 Email Print this article Print
 
 
 
 
 
 
 


?"> Such signatures arent really a whitelist, but they are meant to enforce accountability, which is related. For instance, one could set a rule whitelisting certain vendors and thereby allow any code signed with their keys. And as Rutkowska says, one class of largely obsolete malware, file infectors, are defeated by a well-implemented system of code signatures. A whitelist system could also be implemented by having the administrator use a company key to sign only approved programs. Im sure this is basically how some of the commercial approaches work. Popular Web sites are being used in a new attack thats targeting eBay accounts. Click here to read more.
Theres so much software out there how can anyone know whats trustworthy? We currently employ the AV companies to make these decisions for us with their reactive approach, but how about taking a page out of the world of e-mail protection (admittedly, not the most successful bunch of technologists, but stick with me for a moment) and implement a reputation system.
Heres how it could work: All code has to be signed, or at least it needs to be in order to be trusted. Third party reputation systems keep databases of companies and their code signing public keys. They do a double-check on the checks supposedly performed by certificate authorities and take reports of abuse, feeding them back into the reputation report. When a program is installed, the public key is checked for reputation. If the signer of a new program being installed has no reputation or the program is not signed it is deserving of a high level of suspicion; perhaps this is when you turn on the heuristic scanner with the paranoia level set to "Maximum." Periodically, the system could also check for changes in the reputations of signers of installed software and report these to the user or administrator. This is the kind of system that existing AV vendors could be in a position to implement. The real problem is the infrequent use of digital signatures in the programming community.
Whitelists and signatures cant stop a buffer overflow in an approved program from executing malware passed to it. That system is just as compromised. And while it would be trickier for that attack to persist on the system, its hardly impossible. So Im skeptical of the broad brush Rutkowska uses to paint signature-based AV as a historic mistake. It was expedient at a time when elegant solutions were unavailable. In fact, they still are. Security Center Editor Larry Seltzer has worked in and written about the computer industry since 1983. Check out eWEEK.coms for the latest security news, reviews and analysis. And for insights on security coverage around the Web, take a look at eWEEK.com Security Center Editor Larry Seltzers blog Cheap Hack More from Larry Seltzer


 
 
 
 
Larry Seltzer has been writing software for and English about computers ever since—,much to his own amazement—,he graduated from the University of Pennsylvania in 1983.

He was one of the authors of NPL and NPL-R, fourth-generation languages for microcomputers by the now-defunct DeskTop Software Corporation. (Larry is sad to find absolutely no hits on any of these +products on Google.) His work at Desktop Software included programming the UCSD p-System, a virtual machine-based operating system with portable binaries that pre-dated Java by more than 10 years.

For several years, he wrote corporate software for Mathematica Policy Research (they're still in business!) and Chase Econometrics (not so lucky) before being forcibly thrown into the consulting market. He bummed around the Philadelphia consulting and contract-programming scenes for a year or two before taking a job at NSTL (National Software Testing Labs) developing product tests and managing contract testing for the computer industry, governments and publication.

In 1991 Larry moved to Massachusetts to become Technical Director of PC Week Labs (now eWeek Labs). He moved within Ziff Davis to New York in 1994 to run testing at Windows Sources. In 1995, he became Technical Director for Internet product testing at PC Magazine and stayed there till 1998.

Since then, he has been writing for numerous other publications, including Fortune Small Business, Windows 2000 Magazine (now Windows and .NET Magazine), ZDNet and Sam Whitmore's Media Survey.
 
 
 
 
 
 
 

Submit a Comment

Loading Comments...
 
Manage your Newsletters: Login   Register My Newsletters























 
 
 
 
 
 
 
 
 
 
 
Rocket Fuel