Close
  • Latest News
  • Artificial Intelligence
  • Big Data and Analytics
  • Cloud
  • Networking
  • Cybersecurity
  • Applications
  • IT Management
  • Storage
  • Sponsored
  • Mobile
  • Small Business
  • Development
  • Database
  • Servers
  • Android
  • Apple
  • Innovation
  • Blogs
  • PC Hardware
  • Reviews
  • Search Engines
  • Virtualization
Read Down
Sign in
Close
Welcome!Log into your account
Forgot your password?
Read Down
Password recovery
Recover your password
Close
Search
Logo
Logo
  • Latest News
  • Artificial Intelligence
  • Big Data and Analytics
  • Cloud
  • Networking
  • Cybersecurity
  • Applications
  • IT Management
  • Storage
  • Sponsored
  • Mobile
  • Small Business
  • Development
  • Database
  • Servers
  • Android
  • Apple
  • Innovation
  • Blogs
  • PC Hardware
  • Reviews
  • Search Engines
  • Virtualization
More
    Home Applications
    • Applications
    • Cybersecurity
    • Networking

    Government-Funded Startup Blasts Rootkits

    By
    Ryan Naraine
    -
    April 24, 2006
    Share
    Facebook
    Twitter
    Linkedin

      A startup funded by the U.S. governments Defense Advanced Research Projects Agency is ready to emerge from stealth mode with hardware and software-based technologies to fight the rapid spread of malicious rootkits.

      Komoku, of College Park, Md., plans to ship in the summer a beta of Gamma, a new rootkit detection tool that builds on a prototype used by several sensitive U.S. government departments to find operating system abnormalities that may be linked to malicious rootkit activity. Rootkits modify the flow of the kernel to hide the presence of an attack or compromise on a machine. This gives a hacker remote user access to a compromised system while avoiding detection by anti-virus scanners.

      The companys Copilot prototype is a high-assurance PCI card capable of monitoring the hosts memory and file system at the hardware level. It is specifically geared toward high-security servers and computers.

      Gamma, meanwhile, is a separate, software-only clone of Copilot that will target businesses interested in a low-assurance tool to protect laptops and PCs.

      Komoku launched quietly in 2004 with about $2.5 million in funding and rootkit detection contracts from DARPA, the Department of Homeland Security and the U.S. Navy. The company has its roots at the University of Maryland, where computer scientist William Arbaugh worked on what he calls a “unique approach” to finding rootkits.

      “Security technologies depend on the correctness of the system theyre actually checking,” said Arbaugh, who now serves as president of the outfit, which consists of three full-time and two part-time employees. “If something changes the system at the operating system level, it cant be reliably detected via the OS itself or through applications running on the system,” he said. “We have this notion of what the operating system is supposed to look like, and we look for deviations to that. We arent initially looking for the rootkit—we look at the side effects of the infection.”

      Komoku has partnered with security vendor Symantec to handle disinfection and restoration after rootkits and other sophisticated forms of malware are detected. Symantecs LiveState product combines with Copilot and Gamma to restore the system to its original state.

      James Butler, a renowned rootkit researcher who serves as Komokus chief technology officer, said Gamma will have limited cleanup capabilities because it is software-based and susceptible to direct attack, much like any application running on the operating system.

      “Cleanup is a very difficult goal while maintaining a running system. When you find a rootkit, you essentially have several choices. The easiest choice is to halt the system. But, that means that youll lose any evidence that might be in memory. It also means that the services provided by that system are made unavailable,” Butler explained.

      Another choice, said Butler, is to eliminate the effects of the rootkit, although this can be very difficult because of the complicated nature of an operating system. A third option is to allow the rootkit to remain active while attempting to discern its motives, Butler said, noting that both Gamma and Copilot will allow all three of these choices.

      Komokus long-term plan is to have both the hardware and software versions collect forensic data when a compromise is detected. Butler said both products are able to capture hidden malware in memory and send it back to a central management station when the products are running in enterprise mode. Komoku also is exploring potential partnerships with other security companies that have offline malware analysis tools, he said.

      Pricing details have not been worked out, but Arbaugh expects to ship Copilot to high-end enterprises with supersensitive data. Gamma, on the other hand, is lower-assurance and aimed at protecting business assets that dont require high-end security protection and businesses that are unable to install hardware.

      Arbaugh said Gamma has been built with two modes of operation: an enterprise mode where it communicates with a central server to receive updates and incident reports, and a stand-alone mode where incidents are reported locally. Updates will be available via a subscription service similar to the anti-virus space, he said.

      Citing confidentiality issues, Arbaugh declined to discuss the severity of the rootkit threat on government networks. However, he said that during actual Copilot tests, it is “very clear that the government shares the same problems like everyone else.”

      Copilot was being tested on the Navy networks when news of the Sony DRM (digital rights management) rootkit issue made headlines in November 2005. “That was a zero-day rootkit to us, so we decided to throw it at Copilot as part of the operational tests. We detected the Sony rootkit in all its vectors, in real time,” said Butler.

      According to statistics from Microsoft, rootkits account for more than 20 percent of all malicious programs removed from Microsoft Windows machines. The stealthy technology has been found in a variety of threats, including spyware, Trojans and DRM.

      Komoku at a Glance

      Whats the big idea?

      To offer hardware and software security at the operating system level to ferret out stealth rootkits

      Is there a product?

      Komokus first product is a PCI card that detects malicious changes to the operating system; a software-only product is due this summer

      Whos in charge?

      William Arbaugh, president, and James Butler, CTO; Butler wrote “Rootkits: Subverting the Windows Kernel”; the company has three full-time and two part-time employees

      Does Komoku have customers?

      Yes, it has contracts with the Navy, Department of Homeland Security and DARPA

      Ryan Naraine
      Get the Free Newsletter!
      Subscribe to Daily Tech Insider for top news, trends & analysis
      This email address is invalid.
      Get the Free Newsletter!
      Subscribe to Daily Tech Insider for top news, trends & analysis
      This email address is invalid.

      MOST POPULAR ARTICLES

      Latest News

      Zeus Kerravala on Networking: Multicloud, 5G, and...

      James Maguire - December 16, 2022 0
      I spoke with Zeus Kerravala, industry analyst at ZK Research, about the rapid changes in enterprise networking, as tech advances and digital transformation prompt...
      Read more
      Applications

      Datadog President Amit Agarwal on Trends in...

      James Maguire - November 11, 2022 0
      I spoke with Amit Agarwal, President of Datadog, about infrastructure observability, from current trends to key challenges to the future of this rapidly growing...
      Read more
      IT Management

      Intuit’s Nhung Ho on AI for the...

      James Maguire - May 13, 2022 0
      I spoke with Nhung Ho, Vice President of AI at Intuit, about adoption of AI in the small and medium-sized business market, and how...
      Read more
      Applications

      Kyndryl’s Nicolas Sekkaki on Handling AI and...

      James Maguire - November 9, 2022 0
      I spoke with Nicolas Sekkaki, Group Practice Leader for Applications, Data and AI at Kyndryl, about how companies can boost both their AI and...
      Read more
      Cloud

      IGEL CEO Jed Ayres on Edge and...

      James Maguire - June 14, 2022 0
      I spoke with Jed Ayres, CEO of IGEL, about the endpoint sector, and an open source OS for the cloud; we also spoke about...
      Read more
      Logo

      eWeek has the latest technology news and analysis, buying guides, and product reviews for IT professionals and technology buyers. The site’s focus is on innovative solutions and covering in-depth technical content. eWeek stays on the cutting edge of technology news and IT trends through interviews and expert analysis. Gain insight from top innovators and thought leaders in the fields of IT, business, enterprise software, startups, and more.

      Facebook
      Linkedin
      RSS
      Twitter
      Youtube

      Advertisers

      Advertise with TechnologyAdvice on eWeek and our other IT-focused platforms.

      Advertise with Us

      Menu

      • About eWeek
      • Subscribe to our Newsletter
      • Latest News

      Our Brands

      • Privacy Policy
      • Terms
      • About
      • Contact
      • Advertise
      • Sitemap
      • California – Do Not Sell My Information

      Property of TechnologyAdvice.
      © 2022 TechnologyAdvice. All Rights Reserved

      Advertiser Disclosure: Some of the products that appear on this site are from companies from which TechnologyAdvice receives compensation. This compensation may impact how and where products appear on this site including, for example, the order in which they appear. TechnologyAdvice does not include all companies or all types of products available in the marketplace.

      ×