[ news_security_news ]
CyberGuard Against Zero Day
SecurityProNews
Staff Writer
2004-11-19
 Insider Reports RSS Feed
A dangerous mass-mailing worm that uses its own SMTP engine to spread itself threatens to be a dreaded zero day attack.
"Zero day" refers to an exploit, either a worm or a virus, that arrives immediately following or even before there is a public announcement of a vulnerability in a computer system. Customers using the newest versions of Webwasher Content Security Management (CSM), Antivirus or Content Protection solutions from CyberGuard are protected from Sober.I infections through Webwasher's "proactive filtering" capability.
"Many antivirus vendors do not yet recognize the new worm, which is why proactive filtering is so critical," explained Horst Joepen, president of CyberGuard's Webwasher division. "Traditional antivirus technology must first identify new viruses and worms before they can develop and release protection, but proactive filtering identifies anomalies so users can prevent infiltration from brand-new worms and viruses in the first place."
The mass-mailing worm - W32.Sober.I -is a variant of the Sober worm which caused worldwide havoc in early 2003. The worm arrives as a .com, .bat, .scr, .pif or .zip attachment in e-mails with various subject lines - in English or German - and various text bodies in the e-mails. It also hides in innocent looking .doc-, xls- and txt-files that are, in reality, executable attachments. Sober.I propagates by sending itself from infected desktops as a ZIP archive to addresses it gathers from the infected computer. Webwasher's proactive content filtering recognizes and blocks the corrupted format.
How Proactive Content Filtering Works
Similar to how medical researchers protect against new viruses that spread throughout a population by first identifying the composition of the virus and then developing an anti-virus, anti-virus security vendors traditionally detect new viruses and develop protection based on patterns in those viruses. The process from detection to developing protection and making it available can take several hours. Highly publicized worms such as Blaster, MyDoom and Bagel infected computers worldwide in just a few hours. By contrast, proactive technologies analyze Web and e-mail traffic looking for certain abnormalities, objects or combination of objects and code, thus protecting against worms and viruses whose patterns are not yet known and preventing Zero Day attacks. Proactive filtering technology in Webwasher version 5.1 protects against malicious files and is part of Webwasher Antivirus and Webwasher Content Protection products.
About the Author:
SecurityProNews is a daily online and email publication focusing on internet security issues.
More news_security_news Articles
Insider Reports RSS Feed
|
|
iEntry 10th Anniversary
RSS
Archive
