Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

9/13/2010
01:34 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Product Watch: New Tool Moves Browser Into Virtual Environment For Security

Shields Windows machine from Web-borne attacks

Invincea, a security firm originally funded by the Defense Advanced Research Projects Agency (DARPA) to build a prototype virtualized browser, today rolled out a Windows application that places Internet Explorer (IE) into a virtual environment in order to protect the underlying system from Web-based attacks.

The new Invincea Browser Protection automatically separates the browser's activities from the desktop's operating system in a way that's transparent to the end user. The application also runs behavior-based detection via sensors that alert the user about an attack and terminates any malicious activity. It also restores the browser session to a safe and untainted place, according to Invincea.

Invincea executives say the application can stop zero-day, targeted, and man-in-the-browser attacks, as well as advanced persistent threat attacks.

"Typically, when an APT hits, for example, it lodges in the operating system, usually in the kernel, beneath the radar of existing defense. But with Invincea Browser Protection, the threat impacts the isolated layer, but the virtual environment is disposable, so once the infection occurs, the environment is thrown out along with the malware," according to an Invincea whitepaper (PDF) about the technology.

The application also logs forensics intelligence about any attacks. Unlike sandboxing, where the browser runs natively in the host's OS, Invincea Browser Protection runs the browser as a virtual appliance on the desktop. The idea is to take security choices out of the hands of end users and to build in security, according to Invincea execs.

"Perimeter and cloud-based Web hygiene solutions are useful, but for complete layered protection, organizations also need non-intrusive ways to protect against browser-borne malware on the host systems themselves," said Diana Kelley, partner and analyst with SecurityCurve, in a statement.

Browser Protection is priced at $60 per seat, and Invincea offers volume discounts.

Meanwhile, while the initial version of the software is for IE, Invincea plans to later extend its Browser Protection tool to other browser types, including Firefox.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Tor Weaponized to Steal Bitcoin
Dark Reading Staff 10/18/2019
Data Privacy Protections for the Most Vulnerable -- Children
Dimitri Sirota, Founder & CEO of BigID,  10/17/2019
State of SMB Insecurity by the Numbers
Ericka Chickowski, Contributing Writer,  10/17/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
2019 Online Malware and Threats
2019 Online Malware and Threats
As cyberattacks become more frequent and more sophisticated, enterprise security teams are under unprecedented pressure to respond. Is your organization ready?
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-18387
PUBLISHED: 2019-10-23
Sourcecodester Hotel and Lodge Management System 1.0 is vulnerable to unauthenticated SQL injection and can allow remote attackers to execute arbitrary SQL commands via the id parameter to the edit page for Customer, Room, Currency, Room Booking Details, or Tax Details.
CVE-2019-18212
PUBLISHED: 2019-10-23
XMLLanguageService.java in XML Language Server (aka lsp4xml) before 0.9.1, as used in Red Hat XML Language Support (aka vscode-xml) before 0.9.1 for Visual Studio and other products, allows a remote attacker to write to arbitrary files via Directory Traversal.
CVE-2019-18213
PUBLISHED: 2019-10-23
XML Language Server (aka lsp4xml) before 0.9.1, as used in Red Hat XML Language Support (aka vscode-xml) before 0.9.1 for Visual Studio and other products, allows XXE via a crafted XML document, with resultant SSRF (as well as SMB connection initiation that can lead to NetNTLM challenge/response cap...
CVE-2019-18384
PUBLISHED: 2019-10-23
An issue was discovered on TerraMaster FS-210 4.0.19 devices. An authenticated remote non-administrative user can read unauthorized shared files, as demonstrated by the filename=*public*%25252Fadmin_OnlyRead.txt substring.
CVE-2019-18385
PUBLISHED: 2019-10-23
An issue was discovered on TerraMaster FS-210 4.0.19 devices. An unauthenticated attacker can download log files via the include/makecvs.php?Event= substring.