In the future, PCs infected with worms or viruses may try to contain the plague by putting themselves in quarantine. Automatic Network Outbreak Containment was one of a number of future technologies shown off on the final day of the Intel Developer Conference in San Francisco.
Post a Comment
Member since:---
Member since:2005-07-09
Agreed.
The key thing is, in order to quarantine the computer, you need to detect the problem and if you could detect the problem, you can prevent it. Given that spyware and viruses still get by antivirus programs that are regularly updated, I really don't see how can be any better.
Member since:
---
Member since:
2005-07-06
Member since:
2005-07-06
Well the article was rather light on specifics.
Here's one guess:
* The system works on traffic profiling, since it doesn't require virus signatures. What might signal a worm outbreak? High bandwidth outgoing traffic indicating a worm attempting to spread or conduct a DDoS attack would be a good metric. This would also not detect normal downloads. Statistic metrics can be devised to filter out "abnormal" patterns for a specific environment.
Here's a bit of technical speculation as to how I'd like to see it done:
* If Intel are into it, it sounds like it sits outside the operating system. You *could* implement this in hardware but this has a number of issues in the flexibility, cost and management aspects.
* A better place to put this would be in a virtual machine monitor: put the OS in a high performance virtual machine (probably using Intel's VT extensions) and have the VMM take care of this sort of maintenance.
* You could even use a separate "locked down" virtual machine to perform the "circuit breaking" for the user's virtual machine. The "circuit breaker" could be accessed remotely by IT staff to assess what's happened.
* Running the Intrusion Detection in a separate virtual machine also means you can use standard IDS systems such as Snort, potentially running several at once.
My 2 Euro cents ;-)
Mark
Member since:2005-07-09
> High bandwidth outgoing traffic indicating a worm
> attempting to spread or conduct a DDoS attack would be
> a good met
Hmmm. High outgoing traffic could also mean that you're trying to upload content, so that wouldn't be a good idea.
IMO, I don't think it could work if it were done by simply analysing the usage. After all, the Linux OOM killer tries to do something like this and has a lot more information to work with, but it still doesn't alway get it right ( http://lwn.net/Articles/104179/ ). So it's not uncommon to just disable the OOM killer and just prevent the problem (by having enough swap space to begin with).
Member since:2005-07-06
I really think this is mostly aimed at corporate customers where the management of the hundreds or thousands of office-worker machines is a big overhead. In those environments you generally won't (or at least shouldn't ;-) be uploading stuff.
For a home machine, or even the workplace machine of a highly technical user I don't really see it doing anything but annoying people - it doesn't help the user, just the machines around him. When those machines are under common management, this could be very helpful to that management even though that user loses his 'net connection.
Member since:
2005-07-06
Member since:2005-07-09
Member since:
2005-08-16
Actually I wouldn't like it a bit if my hardware decided that I am infected or not. My ISP runs (and has more or less invented)
http://www.quarantainenet.nl/?lang=en&page=quarantainenet
. It requires managable switches and a honeypot, and it just works. At the moment an infected a computer tries to infect the honeypot, it is thrown into a very limited network, that consists of the university homepage, windows update, and the virusscan definition update page. The client gets one chance to desinfect his PC and declare himself sane on a simple page (that is the default page the infected computer gets redirected to). Only if he gets reinfected after that, he will have to explain to a helpdesk what he has done to clean himself and only than they will reconnect him. No more easy buttons, but pure patience. This has helped to reduce the workload on the helpdesk significantly and has made it a lot easier for me to remain virus-free.
The conclusion: A smart, well-managed network works, don't know how much PC hardware would help.
Member since:2005-06-29
That's pretty interesting actually. Thanks for sharing!
#
About how hardware will perform a similar job... Maybe the system will just be monitoring computer and trying to relate a degraded performance with a system's port traffic (probably not very good idea for popular webservers due processing usage...), execution code... and similar things... But some *real* information about it would help a lot to understand if it can actually work (or if it depends somehow of software cooperation) or it's just another forgotten "feature" in the future...
Member since:
2005-07-06
Just thinking its not that hard to code a virus to use normal traffic patterns. I think the only reason they are not coded that way now is because Virus writers are lazy and or they don't have too. I would bet there are quite a few Trojans/Virii out there now that does just that.
Member since:---
That's precisely my train of thought. This is just going to cause a revolution in the way worms and virii are written. There is very little probability of success when your defense is a system running fixed analysis and the worm/virii can evolve in so many different directions.
Member since:
---
