Slashdot Mirror
Researchers Set To Work On Malware-Detecting CPUs (helpnetsecurity.com)
Orome1 quotes a report from Help Net Security: Adding hardware protections to software ones in order to block the ever increasing onslaught of computer malware seems like a solid idea, and a group of researchers have just been given a $275,000 grant from the National Science Foundation to help them work on a possible solution: malware-detecting CPUs. This project, titled "Practical Hardware-Assisted Always-On Malware Detection," will be trying out a new approach: they will modify a computer's CPU chip to feature logic checks for anomalies that can crop up while software is running. "The modified microprocessor will have the ability to detect malware as programs execute by analyzing the execution statistics over a window of execution," Ponomarev noted. "Since the hardware detector is not 100-percent accurate, the alarm will trigger the execution of a heavy-weight software detector to carefully inspect suspicious programs. The software detector will make the final decision. The hardware guides the operation of the software; without the hardware the software will be too slow to work on all programs all the time."
outstanding product safety record
The software will make the final decision... oh so you mean just like it already does, got it.
You can't make a useful OS completely secure. How would you defend against things like the RowHammer attack? Only run interpreted code in a VM maybe, but it would be slow. That's where this malware detecting CPU comes in.
Anyway, since no one and no software is perfect, the best way to secure a system is in layers. Every extra one helps.
const int one = 65536; (Silvermoon, Texture.cs)
SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
In no way is this a good idea. No software is perfect, doubly so for security software. That includes the microcode this hardware is based on. Go ahead, implement it in hardware, which by definition cannot be upgraded or patched. Soon enough someone will find a vulnerability, and then an exploit, and there's nothing you can do to mitigate it beyond just buying newer hardware.
On the one hand you take life too seriously, and on the other, you do not take playful existence seriously enough. Seth
Since 2014 I've been reading about hardware-based detection. I'm starting to think this is just panacea... like those cloud-based antivirus engines that never picked up anything. Here's a bunch of research on the topic: http://www.ieee-security.org/T... http://caslab.eng.yale.edu/wor... http://www.cs.binghamton.edu/~... http://www.cs.binghamton.edu/~...
Not a panacea (hardware issues, e.g., row-hammer, can still cause problems), but proof carrying code would be a great step forward.
Great minds think alike; fools seldom differ.
The second you make hardware look for a pattern, they will design malware to violate that pattern and go undetected. This is a fool's errand.
Anons need not reply. Questions end with a question mark.
What do you mean? Cake layers or onion layers?
This is the sort of stuff Intel should have developed with their McAfee acquisition.
Companies seem to think innovation starts and ends with 'identifying potential synergies', 'acquisition', then "....profit!!!".
For instance, eBay + Skype. They could have done something snazzy -- say, eBay seller webminars with combining web video+VoIP (downstream), and landline/mobile audio (conversation/questions sent upstream asynchronously. So the landline carries part of the audio spectrum). Instead, they just went 'BAU'.
The Microsoft + Skype business fit isn't that bad - but not that good either -- versions everywhere, with MS office plugins that offer nothing different from the market.
Some form of cartridge system with a flap on the top. Externally flash chip and the user has a read only chip with new definitions and behavioural analysis.
Fast, protected and total over view of all the hardware and software of the computer, network and OS.
Display checksums of every upgradable part of the hardware and software.
Domestic spying is now "Benign Information Gathering"
AC the security services would just go deeper. Alter the storage control chip or other hardware chips, well away from any deep software OS scan by AV.
Every boot would load up gov malware that the OS and AV would give a free pass to. Recall the US keystroke logging software.
https://en.wikipedia.org/wiki/... efforts.
Domestic spying is now "Benign Information Gathering"
In the early days of SElinux on Fedora I got alerts all the time, but it's never been a problem on RHEL7. They seem to have fixed the misbehaving tools and problematic policies some time in between. (I still think SElinix is a horrible hack - adding a layer to fake role-based privileges with massive black/whitelists. It all comes back to POSIX permissions being far too couarse-grained for what they're forced to protect.)
This idea has everything to do with vendor lock-in & DRM; don't let it get outta the gate.
Adding hardware protections to software ones in order to block the ever increasing onslaught of computer malware seems like a solid idea
No it doesn't. Fix the real problem
So are you asserting that Microsoft will never get Windows to run on this CPU ?