Risk
1/29/2009
02:30 PM
Connect Directly
LinkedIn
Google+
Twitter
RSS
E-Mail
50%
50%

Startup Of The Week: FireEye

FireEye deploys virtual victims to uncover new malware.

FireEye aims to protect enterprises from Web-based security threats, including malware and botnets. The company deploys an appliance on the customer premises that runs suspicious Web and network traffic against a set of virtual computers. It alerts administrators if a virtual computer gets compromised. It also can help IT find PCs that might have malware trying to contact a control server or botnet.
--Andrew Conry-Murray

FIREEYE


Ashar Aziz, founder and CEO, FireEye

Aziz brings the virtual heat against Web-based malware

HEADQUARTERS: Milpitas, Calif.

PRODUCT: FireEye 4200 security appliance, Malware Analysis & Exchange Network

PRINCIPALS: Ashar Aziz, founder and CEO; Bahman Mahbod, VP of engineering; Zane M. Taylor, VP of operations

INVESTORS: Sequoia Capital, Norwest Venture Partners, Jafco, SVB Capital, DAG Ventures, Juniper Networks

EARLY CUSTOMERS: University of California, Berkeley; Canaras Capital

BACKGROUND: Founder Aziz also founded Terraspring, a data center automation and virtualization company. Terraspring was acquired by Sun Microsystems and became Sun N1, with Aziz as the technology leader for N1.


Real-Time Detection
"The browser is the new target for malware," says founder and CEO Aziz. "Legitimate Web sites are being compromised and downloading malware onto computers that come to visit them." He also says malware is highly dynamic, making it hard for traditional signatures and URL databases to keep up with changing attacks and compromised Web sites. FireEye employs several different technologies, including heuristics and virtual machines, to detect real-time attacks against PCs while also keeping false positives to a minimum.

How It Works
FireEye deploys an appliance at customer sites. The appliance sits out of band but monitors all inbound network traffic. The company combines signatures and heuristics to examine inbound traffic for evidence of suspicious behavior. "We have tuned these algorithms to be highly sensitive, which increases the rate of potential false positives," says Aziz.

To counteract false positives, it captures and replays suspect traffic against a set of virtual machines that run inside the appliance. These VMs imitate full PCs, including operating systems and applications. If a virtual victim gets compromised, the system knows there was an attack on the wire and will alert administrators.

Administrators can share information with FireEye's Malware Analysis & Exchange Network. This network automatically updates other FireEye appliances so that they can identify exploit code without having to run traffic through a virtual machine.

The FireEye system can't block attacks.

Our Take
FireEye combines concepts from intrusion detection, honeypots, and virtualization to create a new wrinkle for protecting against dynamic malware.

The product's inability to stop attacks may appeal to customers that don't want a startup to be responsible for blocking traffic. However, companies must be prepared to invest the resources into chasing down alerts and remediating exploits. The 4200 isn't a set-it-and-forget-it product.

We'd like to see FireEye more tightly integrate with URL-blocking technology and trouble-ticket systems.

TIMELINE

URL: www.fireeye.com

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-4467
Published: 2015-01-30
WebKit, as used in Apple iOS before 8.1.3, does not properly determine scrollbar boundaries during the rendering of FRAME elements, which allows remote attackers to spoof the UI via a crafted web site.

CVE-2014-4476
Published: 2015-01-30
WebKit, as used in Apple iOS before 8.1.3; Apple Safari before 6.2.3, 7.x before 7.1.3, and 8.x before 8.0.3; and Apple TV before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulner...

CVE-2014-4477
Published: 2015-01-30
WebKit, as used in Apple iOS before 8.1.3; Apple Safari before 6.2.3, 7.x before 7.1.3, and 8.x before 8.0.3; and Apple TV before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulner...

CVE-2014-4479
Published: 2015-01-30
WebKit, as used in Apple iOS before 8.1.3; Apple Safari before 6.2.3, 7.x before 7.1.3, and 8.x before 8.0.3; and Apple TV before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulner...

CVE-2014-4480
Published: 2015-01-30
Directory traversal vulnerability in afc in AppleFileConduit in Apple iOS before 8.1.3 and Apple TV before 7.0.3 allows attackers to access unintended filesystem locations by creating a symlink.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
If you’re a security professional, you’ve probably been asked many questions about the December attack on Sony. On Jan. 21 at 1pm eastern, you can join a special, one-hour Dark Reading Radio discussion devoted to the Sony hack and the issues that may arise from it.