Trlokom

Website Links

Description

For the origial article in Enterprise Networks & Servers, Click here. By Drew Robb There was a time there a little while back when it seemed that the security software companies finally had the hackers, criminals and unscrupulous businesses on the run. After years of difficulties with viruses, worms, Trojans and spyware, it appeared that maybe, just maybe the anti-virus (AV) and anti-spyware (AS) vendors were at last gaining the upper hand. Such hopes, however, proved to be futile. The malware writers once again have the upper hand and AV/AS vendors have been caught napping. According to CERT, reported vulnerabilities in applications jumped by over 50 percent in 2005 after three years of little or no change. The situation is so bad that none of the AV/AS vendors can remove regenerating malware or detect rootkits. Even the ones that claim rootkit detection capabilities do it almost exclusively based on signatures, something that can be easily bypassed by newer strains of malware that use polymorphism (this means, literally changing into many forms) or incorporate more advanced rootkit technology. And the bad news is that the situation is not expected to get better anytime soon. According to research by AV vendor McAfee, one in seven malware incursions use rootkit technology to obfuscate their actions. By 2008, more than 84 percent of all malware are expected to be disguised by rootkits. That could create havoc in the enterprise unless new tools are brought in to augment today's inadequate security perimeter. Evolving menace of hidden malware While the fundamental approach to malware prevention, detection, and removal has not changed in the past several years, the threats have evolved dramatically. A big driver is the fact that the spyware industry now generates several billion dollars in revenue each year and is backed by organized crime. They harness a variety of covert tools to generate advertising revenue, capture bank account and credit card information, and steal corporate information. The effect can be devastating. In particular, rootkits can make detection near impossible by existing AV/AS products. The best example of a rootkit is one used by Sony to prevent copyright violations. The vendor didn't tell anyone it had placed a hidden policing mechanism on home computers without permission. Yet not a single AV/AS vendor detected it. Rootkits by themselves, however, are not necessarily evil. But the technology can be used by malware to actively hide itself and escape detection. Using the stealth cloak provided by rootkits, spyware can operate undetected. The attacker can then remotely install or modify components, steal locally stored personal information and even use the compromised machine for illegal activities. Another evolving malware menace is a keylogger. As well as recording keyboard strokes, it can steal critical information that is not even stored locally on the computer. For example, a keylogger can steal a person's credit card number when the user enters their credit card number for a legitimate online transaction. It can also steal passwords and use them to gain unauthorized access into the network.

Products & services

Similar companies nearby