Anti-malware efforts move past signatures for new ways to find unwanted code

SAN FRANCISCO — Malicious code is becoming more complex and, as it moves from the hands of hackers and into those of criminals, it has gone from being annoying to downright dangerous.

“Our jobs have become more difficult,” said Kamal Arafeh, chief executive officer of eEye Digital Security, which protects desktops and servers. “It requires substantially more work.”

But signatures are so 20th century. Signature-based anti-malware tools require prior knowledge of the code and the protection is only as good as the latest update, leaving systems exposed to zero-day attacks. Companies exhibiting their wares at this week’s RSA Security conference are looking past signatures toward a variety of techniques to catch unwanted code before it can infect and spread through your network.

Arafeh’s company uses heuristic discovery and profiling to watch for malware. Its Blink desktop protection layers intrusion prevention, firewalls and onboard vulnerability assessment (through eEye’s Retina tool on a client agent) to identify and stop unwanted or malicious traffic. Behavior that is prohibited, is suspicious or that does not match the type of file it purports to be associated with can be flagged or stopped.

The company recently announced its Blink200 for smaller organizations that need to protect from 200 to 2,000 desktops, and a new version of its Blink Server. This layered approach to zero-day protection appeals to government users, Arafeh said.

“The government happens to be our largest customer,” he said.

The government, particularly the Defense Department, also is an important customer for Triumfant Inc. of Rockville, Md. Its Resolution Manager watches more than 200,000 attributes of the machines it protects, watching for suspicious or unauthorized changes in registry keys, port settings, performance statistics and security settings.

“We use a process of granular change detection to spot malicious activity,” said chief marketing officer Jim Ivers.

The problem with this kind of anomaly detection generally is false positives. Resolution Manager counters this by building a baseline of attributes of like machines with which to compare unexpected changes. The analytical engine used to make these comparisons is the tool’s secret sauce, Ivers said.

“We’ve never lost a deal because of false positives,” he said. He does not claim a zero-rate for the tool. “‘None’ is a little absolute,” he said. But the rate is low enough to not be a problem.

What was a problem was the cycle for scanning protected machines. Agents send records of changes in the 200,000 attributes to a server every 24 hours for analyses. Every week a complete scan is done to compile a new baseline of configurations for the population. That 24-hour window was too large for some customers, so the latest release does a continuous scan of a subset of 200 security attributes in a five-minute loop to catch changes soon after they occur.

This secondary scan catches most if not all zero-day attacks, Ivers said. “We don’t believe we’ve missed anything.”

Resolution Manager also can automatically remediate changes due to malicious activity, or it can notify administrators of needed action. Newer customers typically prefer to be alerted so that problems and fixes can be confirmed before the fix is applied. But as the volume of changes that need to be remediated goes up, the tool usually is trusted to make the fixes automatically.

The ability to build policies for specific configurations, such as the Federal Desktop Core Configuration, makes Resolution Manager popular with government, Ivers said. Once that baseline is created, machines can be automatically restored to it when changes are found.

IronKey is another company with a strong government market. Its hardened USB drives were developed with help from the Homeland Security Department to provide a heightened level of trust for the removable devices. A trusted supply chain overseen by the company ensures that nothing unexpected is on a drive when it is delivered to the customer, said marketing Vice President John Jefferies.

“We know the drives are clean when they are created for us,” Jefferies said. “The real challenge is maintaining that state” when they are in use.

The drives can be strongly encrypted and require strong authentication, and a new feature being added is a “read only” switch that can be chosen when a user authenticates to the drive. This lets data be accessed and shared without exposing the drive to malicious code. In future releases that option will be a part of the drive’s policy, so that administrators can specify when, where and under what conditions it will operate in a “read only” only mode.

Although IronKey believes in preventive medicine to ensure that a drive does not become infected, the company acknowledges that no prevention is perfect.

“Some times penicillin still is required at the end of the day” to clean up an infection, Jefferies said. This comes in the form of a McAfee signature-based antivirus scan to find and remove malicious code.

“The signature game is a tough game to play,” he said. But it cannot be ignored.

eEye also came to this conclusion about 18 months ago when it found that many customers were uneasy with a tool that did not use signature scanning.

“When you talk to a customer it is difficult to explain” what heuristics can do without a signature, Arafeh said. “So we added that piece,” in order to be able to check that box on the list of features and compete with Symantec and McAfee.

Signatures are 20th century, but that also are 21st century.