Internet Cleanroom: New weapon against drive-by download attacks emerges

Cybersecurity researchers turn PCs into sensors that protect enterprise nets from malware

NEW YORK CITY -- As more employees visit social networking sites while at work, network managers are seeing a rise in accidental malware infections known as drive-by download attacks.

Cybersecurity researchers trying to stop users from inadvertently compromising their machines have come up with a novel idea: Give them PCs running virtual machine software so they can act as sensors that detect malware infections and prevent them from infecting enterprise networks.

The idea was developed by George Mason University's Center for Secure Information Systems (CSIS) in conjunction with Northrup Grumman Information Systems.

This PCs-as-sensors approach was outlined at the Cyber Infrastructure Protection Conference held at the City College of New York last Friday.

Anup Ghosh, Research Professor and Chief Scientist at CSIS, says perimeter security measures such as firewalls and antivirus software fail to catch most drive-by download attacks. He says what works is for users to run their Web browsers on virtual machine (VM) software, which acts as a buffer so that malware is isolated from the host machines.

Ghosh calls turning users into sensors that protect enterprise networks a "game-changing" approach to network security.

"Users get infected by visiting Web 2.0 sites," Ghosh explains. "Trusted Web sites are now compromised. It's about Web 2.0, and it's about sites where users are contributing content. Users can put up Java scripts as easy as HTML. There are lots of infections now coming from Facebook and Blogspot. End users don't need to click on a link and follow a trail. With a drive-by attack, there's no user duping required. You just visit your favorite Web site and get hit by software loaded by someone else."

Ghosh's approach is called Internet Cleanroom, which creates single-use VMs on demand when needed for Web browsing and then deletes after use. Internet Cleanroom is being commercialized through a start-up called Secure Command.

"We're looking at how to take our end users -- who are currently our enemy -- and turn them into sensors," he says. "We're looking at turning every user into a collecting sensor to see what's going on out there. We're using the browser because it's the one piece of software that everyone uses. It's the one piece of software that gets attacked."

Ghosh's approach involves running the browser on a VM that is instrumented to function as a sensor rather than running it natively. The sensors provide information to a database that records malware attacks.

"We see exactly what sites are corrupting that virtual environment," Ghosh explains. "We can look at change detection algorithms that note when a Web site is doing something malicious. This changes the paradigm. Instead of trying to clean up an infected desktop machine, we're turning users into intelligence collection."

Ghosh says the approach requires some overhead since users need to run VM software on their desktops.

Ghosh says Internet Cleanroom is a more promising approach to drive-by download attacks than signature-based approaches used today.

"Every Web site where a user gets infected, we capture the attack. Very rarely is there an existing signature," Ghosh says.

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags malwarecybersecurity

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Carolyn Duffy Marsan

Network World
Show Comments

Father’s Day Gift Guide

Brand Post

PC World Evaluation Team Review - MSI GT75 TITAN

"I need power and lots of it. As a Front End Web developer anything less just won’t cut it which is why the MSI GT75 is an outstanding laptop for me. It’s a sleek and futuristic looking, high quality, beast that has a touch of sci-fi flare about it."

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Luke Hill

MSI GT75 TITAN

I need power and lots of it. As a Front End Web developer anything less just won’t cut it which is why the MSI GT75 is an outstanding laptop for me. It’s a sleek and futuristic looking, high quality, beast that has a touch of sci-fi flare about it.

Emily Tyson

MSI GE63 Raider

If you’re looking to invest in your next work horse laptop for work or home use, you can’t go wrong with the MSI GE63.

Laura Johnston

MSI GS65 Stealth Thin

If you can afford the price tag, it is well worth the money. It out performs any other laptop I have tried for gaming, and the transportable design and incredible display also make it ideal for work.

Andrew Teoh

Brother MFC-L9570CDW Multifunction Printer

Touch screen visibility and operation was great and easy to navigate. Each menu and sub-menu was in an understandable order and category

Louise Coady

Brother MFC-L9570CDW Multifunction Printer

The printer was convenient, produced clear and vibrant images and was very easy to use

Edwina Hargreaves

WD My Cloud Home

I would recommend this device for families and small businesses who want one safe place to store all their important digital content and a way to easily share it with friends, family, business partners, or customers.

Featured Content

Product Launch Showcase

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?