Whitelisting and Elegance

Such signatures arent really a whitelist, but they are meant to enforce accountability, which is related. For instance, one could set a rule whitelisting certain vendors and thereby allow any code signed with their keys. And as Rutkowska says, one class of largely obsolete malware, file infectors, are defeated by a well-implemented system of code signatures. A whitelist system could also be implemented by having the administrator use a company key to sign only approved programs. Im sure this is basically how some of the commercial approaches work.

Popular Web sites are being used in a new attack thats targeting eBay accounts. Click here to read more.

Resource Library:

Theres so much software out there how can anyone know whats trustworthy? We currently employ the AV companies to make these decisions for us with their reactive approach, but how about taking a page out of the world of e-mail protection (admittedly, not the most successful bunch of technologists, but stick with me for a moment) and implement a reputation system.

Heres how it could work: All code has to be signed, or at least it needs to be in order to be trusted. Third party reputation systems keep databases of companies and their code signing public keys. They do a double-check on the checks supposedly performed by certificate authorities and take reports of abuse, feeding them back into the reputation report. When a program is installed, the public key is checked for reputation. If the signer of a new program being installed has no reputation or the program is not signed it is deserving of a high level of suspicion; perhaps this is when you turn on the heuristic scanner with the paranoia level set to "Maximum."

Periodically, the system could also check for changes in the reputations of signers of installed software and report these to the user or administrator. This is the kind of system that existing AV vendors could be in a position to implement. The real problem is the infrequent use of digital signatures in the programming community.

Whitelists and signatures cant stop a buffer overflow in an approved program from executing malware passed to it. That system is just as compromised. And while it would be trickier for that attack to persist on the system, its hardly impossible. So Im skeptical of the broad brush Rutkowska uses to paint signature-based AV as a historic mistake. It was expedient at a time when elegant solutions were unavailable. In fact, they still are.

Security Center Editor Larry Seltzer has worked in and written about the computer industry since 1983.

Check out eWEEK.coms for the latest security news, reviews and analysis. And for insights on security coverage around the Web, take a look at eWEEK.com Security Center Editor Larry Seltzers blog Cheap Hack

More from Larry Seltzer