Attacks/Breaches
9/15/2011
05:02 PM
50%
50%

McAfee DeepSafe Promises Better PC Security

Taking advantage of features in Intel chips, DeepSafe technology uses virtual memory to spot and block otherwise stealthy rootkit infections.

Strategic Security Survey: Global Threat, LocalPain
Strategic Security Survey: Global Threat, Local Pain
(click image for larger view and for full slideshow)
At the Intel Developer Forum this week, McAfee unveiled new technology called DeepSafe, which will be used to underpin hardware-assisted security software. McAfee said that the new technology would not only spot, but also block--in real time--rootkits that can currently embed themselves in operating systems, and which can be extremely difficult to detect.

"McAfee DeepSafe uses hardware features already in the Intel processors to provide security beyond the OS," said Todd Gebhart, co-president of McAfee, in a statement. "From this unique vantage point, DeepSafe can apply new techniques to deliver a whole new generation of protection in real time to prevent malicious activity and not just detect infections."

McAfee said it plans to start including DeepSafe in products to be released later this year.

McAfee's move has caught few industry watchers by complete surprise, since some type of hardware and software hybrid product has been predicted since Intel purchased McAfee last year for $7.7 billion. But that costly acquisition also provoked many questions, not least about whether chip-based security could meaningfully enhance today's software-based approaches.

Interestingly, the DeepSafe announcement was made the same week that Microsoft announced that Windows 8 will ship with built-in antivirus. That announcement illustrates the pressure that's on antivirus vendors, including Symantec and McAfee, to differentiate their products--especially as free antivirus offerings capture more consumers. Intel, meanwhile, faces similar issues with its battle against ARM.

In light of such business concerns, could DeepSafe provide Intel's McAfee with a strong way of enticing businesses to adopt its antivirus and other endpoint security tools? "There's value right now. I think it's fairly limited to rootkits, but in the future it could be applied to a much wider swath of attack vectors," said Lawrence Pingree, a research director at Gartner.

Furthermore, he said, "this is the first step to a wider behavioral detection capability," including potentially monitoring all system behavior. "Is it the most innovative thing in the security industry? No, but it is an incremental innovation. There hasn't been a lot of real innovative things in the security industry for quite some time, in terms of new approaches."

Innovation is needed because of how well malicious operators understand how existing defenses function. Today's tools largely use signature-based detection, meaning they can spot and stop threats that have been previously seen. Accordingly, attackers have turned to code obfuscation and repacking--cheap and easy techniques for producing generations of functionally similar yet technically "never before seen" malware.

One innovation in DeepSafe is its use of virtualization. "One of the things that McAfee DeepSafe does is it virtualizes memory access. Kind of like how a VMware virtualization infrastructure works, it inserts itself between the operating system and memory access, via a virtualization feature," said Pingree. "It lets them look at memory before the memory is accessed, so it can triage all of that information. That's a critical path for discovering these rootkits that exist out there, and that have been very good at avoiding detection via the behavioral OS-level controls that exist."

Interestingly, McAfee won't necessarily be the only security vendor offering DeepSafe-like capabilities. Under the terms of European regulators' approval of Intel's acquisition of McAfee, Intel must share with other security vendors the technology they need to tap into any new security functionality built into its processors or chipsets, one year before its release.

"That evens the playing field. It's really the only way that McAfee could have been purchased, and I was surprised that the United States didn't do similar things," said Pingree.

Attend Enterprise 2.0 Santa Clara, Nov. 14-17, 2011, and learn how to drive business value with collaboration, with an emphasis on how real customers are using social software to enable more productive workforces and to be more responsive and engaged with customers and business partners. Register today and save 30% off conference passes, or get a free expo pass with priority code CPHCES02. Find out more and register.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-1978
Published: 2015-05-21
Multiple cross-site request forgery (CSRF) vulnerabilities in Simple PHP Agenda 2.2.8 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) add an administrator via a request to auth/process.php, (2) delete an administrator via a request to auth/admi...

CVE-2015-0741
Published: 2015-05-21
Multiple cross-site request forgery (CSRF) vulnerabilities in Cisco Prime Central for Hosted Collaboration Solution (PC4HCS) 10.6(1) and earlier allow remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCut04596.

CVE-2015-0742
Published: 2015-05-21
The Protocol Independent Multicast (PIM) application in Cisco Adaptive Security Appliance (ASA) Software 9.2(0.0), 9.2(0.104), 9.2(3.1), 9.2(3.4), 9.3(1.105), 9.3(2.100), 9.4(0.115), 100.13(0.21), 100.13(20.3), 100.13(21.9), and 100.14(1.1) does not properly implement multicast-forwarding registrati...

CVE-2015-0746
Published: 2015-05-21
The REST API in Cisco Access Control Server (ACS) 5.5(0.46.2) allows remote attackers to cause a denial of service (API outage) by sending many requests, aka Bug ID CSCut62022.

CVE-2015-0915
Published: 2015-05-21
Cross-site scripting (XSS) vulnerability in RAKUS MailDealer 11.2.1 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted attachment filename.

Dark Reading Radio
Archived Dark Reading Radio
Join security and risk expert John Pironti and Dark Reading Editor-in-Chief Tim Wilson for a live online discussion of the sea-changing shift in security strategy and the many ways it is affecting IT and business.