18 October 2014
The Trusteer approach to malware protection could be ground-breaking in the defence of zero-day exploits and phishing attacks.
Trusteer analysed millions of applications exposed to the Internet and created lists of valid application states and operations in a database.
For example, saving a web page to OneNote is a legitimate operation when it’s run from a process created by the user. In this case the Windows Explorer is the so-called parent process. If this operation is performed by an internet explorer process that has no valid parent process, it is very likely that a malicious operation is executed.
A watchdog process is monitoring the applications exposed to the Internet. If an application executes a sensitive operation the watchdog process checks its database and approves the operations if it’s valid. Invalid operations are rejected.
Brilliant idea! A watchdog process that checks the state of an application. I would appreciate it to get this for my windows phone. The ‘Here Drive+’ app hangs sometimes, in particular in foreign cities when you need it the most. A watchdog process could check the state and restart the process in such cases. This would be very helpful.
For more details about Trusteer Apex see the Trusteer Apex Product Flyer.
Unfortunately there are some minor flaws.
Trusteer Apex monitors only applications exposed to the Internet like Browsers, Java applets, Flash player or Office applications. Although the technology could also be used for protection against traditional malware like computer viruses, the product does not support this.
This means that Trusteer Apex is only useful in addition to traditional security products like an antivirus product.
Remember that every additional product increases the attack surface of your computer or network. It is not only the continuous patching to mitigate known vulnerabilities. Trusteer Apex receives e.g. application state updates across the internet, which could be tampered by an attacker. Moreover, the Trusteer computer scientists get their raw data from millions of computers operating in untrusted networks. If an attacker tampers some raw data and masks malicious states as valid, the entire installed base could be tampered.
This is the first signs of paranoia. I’m doing definitely too much threat modelling at the moment. But remind the words of Sigmund Freud:
‘The paranoid is never entirely mistaken.’
Just think of the impact of an attack against the master pattern database of a well-known provider of anti-malware software…
Don’t Panic!!
Filed under: New Technology, Opinion Tagged: Attack Surface, Internet Explorer, Malware, malware protection, Phishing, Trusteer Apex, Vulnerability, Zero day exploits Image may be NSFW.
Clik here to view.
