Slashdot Mirror
Open Source Self-Healing Software For Virtual Machines
An anonymous reader writes Computer scientists have developed Linux based software that not only detects and eradicates never-before-seen viruses and other malware, but also automatically repairs damage caused by them. If a virus or attack stops the service, A3 could repair it in minutes without having to take the servers down. The software then prevents the invader from ever infecting the computer again. "It's pretty cool when you can pick the Bug of the Week and it works."
(Here's a paper with more details.)
The analogy is a big stretch, as it would take a very long time and huge effort to approach the unbelievably complex sophistication of the immune system. But the outlines are there: software that detects previously unknown threats, quickly mobilizes to defeat them, and then stands guard against each (now known) threat in future.
I am sure that there are many other solipsists out there.
So, basically you welcome viruses and malware, but fix up the damage afterwards?
Sounds like the anti-vaccine crowd. In reality, it is far better to vaccinate and never get sick, than it is to self-repair after you get a virus.
Once the operating system can self-heal, evolve into an A.I., and network itself across the Internet, getting rid of the carbon-based units will be the next step in self-healing.
This is a glorified IPS, and those in the know are aware of how ineffective such systems are. You might stop a few skiddies attacking the internet en masse, but this is a speed bump for anything remotely close to an advanced persistent threat.
I predict this so called open source project is merely a framework. Expect to be extorted for all kinds of expensive service contracts, high dollar subscriptions, enterprise finder's fees, multilateral value added commissions, etc. Open source my butt...
It would be a PFY, not a Padawan. Dear god how many nerd points do you lose using TPM+ terminology?
enforcing user privileges? But that'd put AV firms out of business! Tough! They can do something else, like fucking grow food.
Political debates have me rolling my eyes so much I think I got optical whiplash. I should sue. - Foamy The Squirrel
The author seems completely non-technical. He probably wants to explain things simple to people, but such article is worthless as it says basically nothing but bullshit.
What exactly is stackable debuggers? There are experimental projects detecting malware from outside of VM, but information from that couldn't be too high-level (probably involves re-assembling memory pages and monitoring of key kernel-space tables/code) or stretched into pure user-space attack like Shellshock. I doubt it could be low-cost enough to monitor real-world applications.
It fails to clarify several key things:
- What exactly is "operation that is not correct"? How do they identify it?
- "stop the virus"? What's the "virus" sending rm -fr / via Shellshock? bash itself?
- Approximate a repair for the damaged...? What's the damage in bash to allow remote command?
Unless they probe the contents sent/received via HTTP, looking for pattern of shell commands. But that'd be too cheap!
Viruses and Malware are not a problem on Linux platforms as unlike the wintel platform, their is a clear differentiation between opening and running a file. As in the Linux desktop is virtually immune from the click-and-run type of malware that is rampant on the windows platform . How can 'computer scientists' even write a paper on malware without once mentioning Microsoft Windows !!!
The software then prevents the invader from ever infecting the computer again.
Does this mean it's going to fix bad SSH/FTP configurations, or change insecure passwords? Didn't think so.
Buck Feta. You know what to do.
A3 prevention-focused defenses are concentrated in the Crumple Zones (CZs). The CZs essentially impose a space-time dilation upon the application’s interaction
oh, my... I'll keep reading the paper, but this is already buzzword-bingo ready.
We use Xen 3.1.4 with Fedora Core 8 (kernel 2.6.18.8) images for both Dom0 and three DomUs in the prototype A3 environment.
2.6.18 ? Seriously ?
What? So on windows, malware is installed through used click, whereas linux is remote exploit?
If you're saying linux doesn't have malware, go fsck yourself.
Double-clicking on a .deb launches a package installer for me. Indeed it is "open" not "run" but I am not far away from installing some shit. If they bothered, porn sites and ads that masquerade as content etc. would make people download an "install this VLC player to view our porn" .deb piece of crap after determining the computer runs Ubuntu (which I guess is what most home linux users have, including Mint)
I've seen it on a semi-old Mac with whatever outdated version of Safari : "fake_VLC_48941.dmg" gets somewhat automatically downloaded, thankfully the OS and browser make it harder to get to the file because Macintosh menus are harder to use.
than it removes systemd also ?
"There are no plans to adapt A3 for home computers or laptops, but Eide says this could be possible in the future."
Exactly, the CIA, NSA, FBI, and everyone else has a vested interest in computers that CAN get infected.