New threat from 'suicide' virus

TalkBack 23 of 45:

Next »

« Previous

• Thread View
• Flat View

A suggestion of how to solve these attacks...

In the last couple of years I've played around with several virtualisation tools - and these, IMHO, suggest a route to solve some of the problems created by modern malware attacks. They all (the ones I've tried, anyway) have the concept of a "virtual hard drive". The clever thing is that some allow the updates to the data in the "virtual drive" to be logged (rather than applied straight away - much like M$ SQL Server writes to the log before the lazy writer comes along and "checkpoints" the database to apply the changes). At the end of a session with a virtual machine - you are then presented with the option to throw away any changes made to the drive during the session - or apply them, so the drive comes up with the changes in place next time the machine is rehydrated.

This would allow a savvy user to throw away a session where they knew they had been hit by malware. Less savvy users could store the log - so that if they later found they had been hit, the log might provide an audit trail of all the changes that would need rolling back. I could see anti malware vendors selling heuristic tools to analyse these logs to make a user aware that they have been hit. As the tools improved - users could be guided through applying/rolling back changes selectively (or you'd have AI sentinels trawling the logs to try to fix problems). This could also be useful to many users that have not been hit by malware - but have simply run a process in error (period end in an accounts package - or something like that).

Virtualisation also offers an "overall" solution to malware threats - this was suggested by someone else - I forget where I read it. A guy was running his kids sessions on his PC entirely within a virtualisation environment. When they got hit with malware - he simply rehydrated another copy of their initial PC image and let them carry on (after educating them about what got them into trouble, I hope). He remained totally isolated from anything silly they did. Sort of a computer sandbox... I think this approach might be appropriate for alot of PC users.

Just a few thoughts...

regards

Posted by: dav1dsm1th   Posted on: 08/01/06 You are currently: a Guest | Members login | Terms of Use

Alert moderator to an offensive message

Subscribe to this discussion via Email or RSS

SponsoredWhite Papers, Webcasts, and Downloads

• The Impact of Virtualization Software on Operating Environments VMware Today's use of virtualization technology allows IT professionals to ... Download Now
• Virtualization: Architectural Considerations And Other Evaluation Criteria VMware Of the many approaches to x86 systems virtualization available in the ... Download Now
• Five Steps to Determine When to Virtualize YourServers VMware Server virtualization isn't just for big companies. Entry-level ... Download Now