Stopping Malware Before It Hits

SpudGunMan writes "John Lockwood, Ph.D, an assistant professor of computer science at Washington University, and the graduate students that work in his research laboratory, have developed a hardware platform called the Field-programmable Port Extender (FPX) that scans for malware transmitted over a network and filters out unwanted data."

Comments

hah

[mxn]

Belkin beat him to it.. Though, their system goes one step further: rather than filter out unwanted data it turns it into precious precious ad revenue.

A great idea, but.....

[thewiz]

Who does the reprogramming of the device; the end user or the company that make the device? For security, I'd rather it be the end user.
Also, shouldn't they make a cheap version for home users since those are the machines that are most vulnerable?

Re:A great idea, but.....

[LostCluster]

I think the concept is for it to be the device itself, making its decision based on patterns that just plain shouldn't appear in normal traffic. If people all over the world are sending the exact same long message into your network, something's up and it's likely not good.

- If the same e-mail attachment comes through your network a few hundred times, it must be a virus.
- If the same kilobyte-long web address keeps getting requested, it must be a worm.
- If the same messages are headed to your NetBIOS ports, it must be the pop-up-message spam of the week. In fact, if somebody wants to deliver any message any kind to all of your ports one-by-one, it must be the exploit of the week.

This seems to be all about patern matching... the device isn't meant to replace your firewall and antivirus systems, but to be faster than them and to take off the work load of having to identify this week's worm when it comes in for the 34,939th time. This might even be useful for ISPs to cut off D-DOS attempts before entering the major traffic exchages so that less of traffic makes it to the victim's bandwidth pipe.

Nifty.

[MoriarGryphon]

Sounds like a nifty piece of hardware. Put one at the front of your network, and reduce internal bandwidth wastage from propogation of virii/worms inward. Even if all your stuff is patched, this could help keep all your servers from having to listen to the worms and script kiddies several hundred times a second. ;>

Treating the symptoms, not the disease

[Dark Lord Seth]

I suggest enlightening the users about malware while they download it. Let's go for the Pavlov effect and hook the hardware platform up to a pellet gun, tazer and a program which mails the squid logs of the current day of said victim to his/her mother/SO. Users learn so much easier that way...

So windows....

[utlemming]

Did it verify that Windows is mal-ware?
What about Windows-update?

These are hard questions that we need to know...

How it works

[Anonymous Coward]

For non geeky types, here is how it works.

As part of the TCP/IP connection specification, Each Ethernet Cable has 65,536 exactly small fibers. To send data, a prgoram must tell the network card to "pluck" the fibers 5000 tines a second to send data.

Now Viruses pluck usually unused fibers to confuse the Network card. Once it is confused the virus can Execute it self by running on the firmware of the Ether, which sends rouge Assebly instructions to the GBX register on the CPU which is an illegal instruction. This disables the ECIR and RIF jumpers on the motherboard. Then it can pluck all the wires at the same time, which of course causes a D-DOS attack.

Now you know how it works, get a Firewall to stop the wrong fiber being plucked.

What utter marketroid-fuelled drivel.

[Mr Thinly Sliced]

They claim that the product is able to 'scan data quickly ... uses hardware, not software to scan quickly ...'.

This product seems entirely built upon PHB fear of technology - its a rack mounted unit that scans network traffic looking for rogue packets/signatures. So to do this effectively, you'd need one of these devices in place _for every router, firewall and computer to computer connection_ - along with some way to travel into the future to obtain the signatures of the all the viruses of the future.

I just don't see how this is securing a network against viruses and worms. The best thing corporates can do (who I guess this particular piece of IT jewelry is aimed at), is lock down the desktop as far as they can go, and have a sensible patch system in place to roll out automagically.

I mean, when "Travelling Salesman Dixie" brings his laptop back from the wild of the Sales Conference and plugs it in, do they honestly think that having it in hardware, rather than software, will cover their asses?

Full marks for receiving funding though. I'm probably just bitchy cos I didn't think of it.

Re:What utter marketroid-fuelled drivel.

[Helter]

Which is easier, trying to force thousands of people to practice network security, or installing a device that does it for them?

Sure you need to update the thing as new viruses come out, but you need to do the same thing with your AV software, that doesn't make it worthless. This won't stop virus' and worms from being written, but it can stop them from spreading past day 2.

An easier way to stop Windows malware:

[Anonymous Coward]

Here.

Re:An easier way to stop Windows malware:

[placeclicker]

Or one that doesn't require a new computer..

Oh, great.

[volkerdi]

While in theory this is a great idea, in practice it's likely to be less great. I commonly get sent reports that .ZIP files used in ZipSlack (which have never seen a Windows machine in handling by me), are infected with viruses. This is because "signatures" thought by virus scanning companies to be unique are a lot less unique than they imagined.

If something like this is ever implemented on a wide scale, expect the system to refuse to allow random non-malware files to be used, transferred, or handled, in those cases where they happen to match a banned bit-pattern. Files and emails might even be silently dropped with no notification at all, depending on the implementation (and with an eye to history).

Re:Oh, great.

[rgmoore]

It seems to me that this is just more evidence that computer systems will wind up looking like biology. First we had viruses and similar infectious things. Now people are trying to create the machine equivalent of an immune system. The problem is that in the process they're likely to rediscover all of the problems that our immune system causes as well as the benefits.

This particular case is quite similar to allergies in the natural immune system. It's an overly aggressive response to an essentially harmless signal. The big problem is that virus and worm scanners are going to be succeptible to the computer equivalent of autoimmune disease; they'll start thinking that essential system files have been corrupted and try to wipe out something really important. I just hope they never develop the computerized equivalent of leukemia.

advantages

[BubbleNOP]

Some advantages I can think of:

1. Speed. Servers often are already too loaded to run more apps that check for signatures.
2. A hardware device is usually harder to hack than the software platform doing checking. A clever piece of malware can compromise the checking machine itself.
3. If checking is done by a secondary machine, by the time it detects the malware the infected machine may be significantly damaged already. A hardware device placed between the network and the machine, on the other hand, can stop things early enough.

it's the freeware, stupid

[Potor]

Indeed. Funny how malware does not seem to infest products we actually pay for. The desire to find free software leads us to download products that are more and more iffy. The key is not detecting malware, for malware will always be one step ahead. The key is carefully screening what we will download, searching out reviews, reading the EULA before the install, and basically being intelligent.

I am not against freeware -- far from it. However, I would say that there is freeware addiction out there that opens the doors to malware. Moreover, I am not against this product; it will certainly be helpful. Yet, those who put their trust in yet another algorithm will certainly get bit again, albeit in some other way.

cheers, potor

Sounds great.

[rune.w]

Quoting from the abstract of the paper:

FPGA logic is used to implement circuits that track the state of Internet flows and search for regular expressions and fixed-strings that appear in the content of packets.

So apparently this hardware can only recognize patterns programmed beforehand (which makes a lot of sense). However, a problem would arise whenever an original piece of malware is released into the net. I mean, how do they plan to identify and program new strings into the machine before the systems behind it are infected? Worms tend to expand fairly quickly...

Further insight is always welcome.

R.

Isn't this just a network censorship device?

[Bookwyrm]

I am rather surprised at the commentary so far on this device, given the usual tone of responses made on slashdot that I have seen.

This device appears to be, at heart, a box that is put in along side the routers to filter out content that the owner of the device does not want to be sent over the network. It is capable of looking for specific patterns of data and blocking the transfer of the data based on that in real time.

Is this not precisely what one would use to filter out, say, unwanted political documents going in/out of China? To, say, spot a specific MP3 file being traded on a P2P network and stop it?

Other comments seem to suggest people think this might actually be a workable, good idea -- guess folks are finally realizing that the Internet cannot route around all forms of censorship after all, if they think this will work.

Re:Isn't this just a network censorship device?

[bedessen]

Right, this goes above and beyond simple port filtering or firewalling, in that it actively deletes material from the wire. It's kind of like the case with spam. If you reject the mail at delivery-time then at least the sender of a legitimate false-positive knows to resend. But if you silently delete things, no one is ever the wiser.

I don't really like the notion of my ISP actively grepping every packet I send and selectively deleting some of them that match some rules. Sure, I don't care if it ONLY messes with malware, as that would never affect me since I keep a tight ship. But, what if someone programs a really sloppy or poorly written rule, and there are false positives? What if the ISP decides that it wants to start deleting other things, like p2p traffic that's taking up all that bandwidth? Again, this is different from blocking p2p ports outright, which, while still repulsive, would at least alert you to the fact that something's being blocked since you wouldn't be able to establish a connection on the blocked ports.

Now, on a corporate/university LAN I can see a lot fewer issues. For one thing, it's a case of "their net, their rules" in that you really have no rights (in the case of the workplace) to complain about what's filtered and what isn't. But workplaces tend to already have some form of firewall or other preventative measures in place. Not that this wouldn't help, but the real case for something like this is a consumer broadband ISP, where a single installation could potentially isolate and neuter thousands of infected home boxes of people running a stock Windows 98 with no updates and no firewall.

Re:Some questions:

[gnu-generation-one]

"Why should we look at this product as opposed to AdAware, a good firewall and a good AV program?"

Because you don't always have control of the computers which will be running the virus?

"How do you plan to adapt your hardware once the creators of Malware adapt to yours?"

The article mentioned that it took less than 9 minutes for someone familiar with the web interface to add a new rule.

"How much will this *really* slow down a LAN or Intranet?"

Read the article (or the linked paper) for precise figures. It's less than a router, and comparable to a hardware firewall

Fantastic!

[B2K3]

I hate programs that get stuck in infinite loops. Now, with this software, I'll just scan for these pieces of malware, and stop them from being sent over the network.

Finally, a solution to my Halting Problem!

What if someone wants to filter competitive data

[so sue mee]

as malware? Say MS or any other abbreviation that is interested in declining access to competitive data just filter it. Adding a number of these devices to echelon or selling a few to repressive governments. You get the picture

Re:Some questions:

[gad_zuki!]

>? Why should we look at this product as opposed to AdAware, a good firewall and a good AV program?

Prevention, thats why.

Killing the packets before they arrive means more signal within the noise (look at my apache log for all those code red machines on comcast's network for instance), saving time and money by having less sys admins fighting malware 24/7, helping the technoproles out by the fact that the less viruses they are able to get the less trouble they'll have in the long run.

Lastly, because what you mentioned isn't working.

>How do you plan to adapt your hardware once the creators of Malware adapt to yours?

Same is true with the methods you mention that you suggest work just fine. The Ad Aware people and the AV people are always fighting the cold war too. So are the anti-spam people. Another piece of tech that helps is a win for the good guys.

> How much will this *really* slow down a LAN or Intranet?

If it works like its described it would actually speed up malware infested LAN and WAN connections.

This actually works...

[morzel]

"Maybe if we put our system in a shiny box with cool LEDs instead of a rackable server like everyone else, we can call it breakthrough technology!"

This reminds me of an anecdote I heard from one the distributors of Watchguard firewalls over here:
one of the major selling points of watchguard products when they were initially introduced was the fact that the appliance was bright red, and had a lot of blinky leds on the front plate :). Being a much 'sexier' package, the watchguard products were chosen instead of e.g. cisco PIX firewalls when the technical merits did not point to a clear winner.

Stopping network junk "on the wire"

[mattbee]

After speaking to one of the chaps behind ddos.com I'm very excited by this kind of emerging technology: essentially ethernet/fibre "filters" which can scan and dump "unwanted" traffic without a noticeable lag on the network. I'm less excited by how much it costs at the moment: $18k list price for one of the 100Mb boxes at DDoS.com, but I suspect as competition opens up, the waffle about exciting and complicated patented technologies will give way to a decent and open discussion about the best algorithms for doing this.

As an example of the current waffle on this topic, the white paper at ddos.com promises in one of their upcoming *cough* products a wire-speed spam filter which is 100% accurate and needs no training. Sure, sure... it's this ridiculous claim which calls into question the "zero training" aspect of their DDoS prevention-- I'm sure some configuration and known "signature" patterns of abusive traffic will help matters.

I'm not here to pick on ddos.com, I'm sure they have an excellent and useful product. But since they are one of a very small number of people with such a product, they are prone to making wild claims and charging extortionate fees. I'm convinced a Linux/BSD kernel module could achieve the same effect and I'd be very interested to see the algorithms, training and so on needed to achieve it. But for the moment we're still subject to these pretty wild claims without much in the way of algorithmic detail.

Re:Wow

[Megor1]

Actually is an Intrustion prevention system, not only does it identify the attack/virus it also blocks it.

I'm waiting to see a nice open source/free IDS that would allow per protocol specifications so you could not only catch known viruses/exploits but also put in checks based on the protocol. For example you have an ftp server, you load up the ftp protocol module and it knows that the user field should be followed by a username, but that the username should be less than say 256 characters, so if someones tries to exploit some buffer overflow in the username for your ftp server the system would block it before it even got to the server. Also you could use them to remove identification information, so your service banner that identifies what is being run would be stripped for anything behind your IPS.

It's NOT a censor-box, it's a Good Thing

[shostiru]

I think a lot of people are confused about what this box does, and what it doesn't, do.

By using FPGAs to scan network traffic (not a new idea, by the way), the device looks for fixed signatures much faster than an equivalent software solution can do so (yes, software may control it, but the actual "decisions" are made by hardware. Think level 3 switch). I'm guessing there's probably some sort of state engine implemented in the FPGAs (I haven't kept up on field-programmable logic), and optimization to look for multiple signatures in parallel, but that's just a guess. It's no different in theory from a virus detection add-on to a mail transfer agent that uses fixed string (as opposed to regex) detection, it's just much more efficient.

Because there's no regex capability, any attempt to use this box for censorship will fail. For example, suppose your upstream programs in a ruleset to match "nuclear". Fine, just pull a Dubya and use "nucular", or "nuke", or "nook-yoo-lar". Problem solved. Or for that matter just zip, tarball, or rot-13 encrypt your file before sending it.

Furthermore, no actual signature would be this short; the false positive rate would be enormous. In practice expect signature lengths of 64 bytes and up, which is what we use when scanning email traffic for viruses.

Why is this a good thing? Keep in mind this is NOT intended as an end-user box, it's intended for network providers. As one, I can tell you that viruses and worms cost real money. Even when we do disable customers for virus activity (and invariably piss off most of them), it takes time to detect and do this. It also takes staff hours; tracking down the customer's username isn't always trivial (RADIUS accounting packets get lost, some outsourced dialup providers send accounting data only on termination, and open wireless points are a huge pain)

For example, Nachi sends out vast numbers of ICMP pings to sequential IP addresses, which rapidly fills the IP cache and depletes the memory of many Cisco routers (why they cache IPs for ICMP is beyond me, but they do, and the patch -- which requires a maintenance contract to get by the way -- doesn't work very well). Watching multi-kilobuck routers die repeatedly because a handful of customers have a worm is NOT my idea of a good day. And don't get me started on mail server load.

I don't know what price they're going to ask for this, but if it's reasonable ($10K or lower) it could easily pay for itself in six months for us. Even if it's an order of magnitude pricier, larger NSPs will probably snatch them up if they work. Trying to do this in software with the same bandwidth (the article quoted 2.4Gbps, right?) may well cost more, esp. when you have to drop a couple of OC-whatever cards in your linux box, harden it, and make sure it never *ever* goes down.