Slashdot Mirror
IEEE Launches Anti-malware Services To Improve Security
New submitter Aryeh Goretsky writes: The IEEE Standards Assocation has launched an Anti-Malware Support Service to help the computer security industry respond more quickly to malware. The first two services available are a Clean file Metadata Exchange (PDF), to help prevent false positives in anti-malware software, and a Taggant System (PDF) to help prevent software packers from being abused. Official announcement is available at the offical website."
I can't get the linked PDF to load
This probably isn't the same thing, but it explains what they're trying to do and why
https://media.blackhat.com/bh-us-11/Kennedy/BH_US_11_KennedyMuttik_IEEE_Slides.pdf
[Fuck Beta]
o0t!
Official announcement is officially available at the official website* - FTFY
Sigger than your average
#cyberoam cyberoam güvenlik te üstün koruma hizmei ile dünyada ve türkiyede lider firmalarndandr. kaynak:http://www.cyberoam.web.tr
No need to be cross platform. Any platform that is not Windows is impervious to malware, /. says so.
... whatever
I don't think other platforms are impervious, but other platforms have sensible package management that doesn't encourage users to download random unsigned packages from random websites.
I really do think that Windows trains users in the worst possible behaviours - download and install from any website and if you see a dialog, don't bother reading it, just keep clicking "next" or "ok" until it's done.
You're a temporary arrangement of matter sliding towards oblivion in a cold, uncaring universe
My head is defective. I always see "IEEE" and transform it into "Internet Explorer Enterprise Edition". Makes me cringe every time.
...gis sdrawkcab (usually not responding to ACs; don't bother posting as AC)
I've thought that with windows store Microsoft people wanted to solve this problem, but unfortunately they have only enabled this mechanism for metro apps. I hope that rumors are right about windows store apps being abled to also run on desktop windows.
CMX Consumer and/or Taggant SSV (price US $8,000.00)
Access to CMX for 1 year
Access to Taggant System IEEE Public Root Key, and blacklist for one year
http://standards.ieee.org/deve...
Most TI vendors at least offer some free feeds to suggest they have valuable content before asking you to pay up. Adoption of this new service isn't going to very good if no one can try it out/use it for free. *shrug*
<script>alert("I never liked JavaScript, really; it just seemed a bad idea.");</script>
The Six Dumbest Ideas in Computer Security
Network operating systems such as Linux take a different approach from the Windows line of disk operating systems. You CAN get some Windows-style anti-malware stuff for Linux or Mac, but it's main use is to scan emails on the server in order to protect the Windows clients. To protect the Linux/BSD/Mac systems, we take the opposite approach. Not anti-malware, loading up another 75,000 virus signatures to try in vain to identify the bad stuff, but a pro-goodware approach, identifying the 20 or so programs that are supposed to be running. An excellent example of this is Tripwire http://sourceforge.net/project... . One primary function of Tripwire is that is does a scan of your system before anything bad happens, hopefully when you first set up the system, and it catalogs which files are supposed to be there. Then when it does it's nightly run it doesn't try to figure out if any of the files are malware, it looks for anything that has changed from the day before. My computer should be the same today as it was yesterday, except for some emails and logs, so any new files are suspect. Any new programs running is definitely suspect. The first few days that you run Tripwire or another IDS it'll catch some things that legitimately change from day to day. You set it not to alert you to that stuff that's normal. I'd leave it where it still tells you about new programs that show up - though installing software is "normal", I don't install new stuff every day so I don't mind being alerted to the fact.
An IDS like Tripwire is just one example of the different approach. Another example, which Windows is starting to emulate now, is that normally on Linux nothing is allowed to come in from the network except what you specifically allow. Some think that works better than intensively scrutinizing everything that comes in and trying to identify the bad stuff.
While I'm admittedly not an expert in cryptography or trusted computing schemes in general, I don't see how this differs on a technical level from numerous other code-signing schemes with a central certificate authority (CA) (and its chain of delegations) blessing "good" code and revoking such blessings. Well known examples include Securicode / Windows Driver Signing, the anti-consumer bits of UEFI, etc. Can anyone shed some further light on how this is different?
As with other such systems, it assumes the existence of a benevolent authority that cannot be hacked, the cooperation of all packer vendors, the cooperation of all packer *users* (who are not malware authors)... and all packer users who *are* malware authors never hearing of it.
The only main difference I can see (and its potential downfall for its purpose) is that end-users don't pay for certificates. While that's great for end-users (driver signature enforcement in x64 Windows versions is pretty close to extortion IMO), this seems to break down for any packers that are not a licensed commercial product where an explicit, one-on-one packer-vendor to packer-user relationship exists. This excludes any freeware and open-source packers*, where any schmuck can just download and run it (and even modify it) without key exchanges or other communication with its author.
Conversely, if any old schmuck can obtain a fresh signature at any time ("it's free!"), what's to stop any old schmuck from doing exactly that? The stipulations that the system is free to both end-users and packer vendors, bankrolled entirely by A/V vendors out of the goodness of their hearts, suggests any background-checking that occurs as a condition of generating a signature can't be very exhaustive.
* While the IEEE materials refer to the proof-of-concept running on "a modified version of UPX", a well-known F/OSS packer, this almost certainly has to do with the ability to quickly bodge this feature in due to easy source code access, and very little to do with whether the actual author of UPX is complicit in or aware of the system, or whether this scenario can possibly work in the real-world for open-source packers with anonymous downloads.
Caveat Emptor is not a business model.
N/m