[ news_security_news ]
CWSandbox Automates Malware Analysis
David Utter
Staff Writer
2006-10-25
 Insider Reports RSS Feed
The manual demands of analyzing a piece of malware and developing a signature to defend against it have been sped up dramatically with Sunbelt's latest product.
Sunbelt Software CEO Alex Eckelberry said in a phone chat with us that the internal demos of CWSandbox turned some skeptical heads. The speed of the new product in assessing malware forced some double-takes.
CWSandbox recently debuted from Sunbelt. Its approach removes the manual work and observations needed to effectively build a signature that will thwart a particular attack. Considering the nature of some sophisticated Trojans like the SpamThru malware making the rounds, and the continued trend that sees more exploits arriving as zero-day ones.
Instead of exposing a physical system to the execution of malware, CWSandbox uses a virtual machine approach. Eckelberry said only a couple of firms use this approach. CWSandbox runs the malware in the VM, and dutifully records its observations.
 | | "CWSandbox architecture" |
When completed, CWSandbox returns its findings in a report, which Eckelberry said can be delivered in a selection of file formats. Instead of painstakingly churning through the observation and reporting process manually, CWSandbox does the heavy lifting.
Eckelberry noted a couple of other features of interest. People who have received a file that they suspect could be malware can submit that online to CWSandbox at Sunbelt for analysis.
While the company does license CWSandbox to security companies, Internet service providers, and corporations, they do make a kinder, gentler option available for students. Eckelberry said student licensing for the product is available for free, so researchers in the making can use it alongside their coursework.
---
Tag: CWSandbox
Add to  Del.icio.us |  Digg |  Reddit |  Furl
Bookmark SecurityProNews 
About the Author:
David Utter is a business and technology writer for SecurityProNews and WebProNews.
More news_security_news Articles
Insider Reports RSS Feed
|
|
iEntry 10th Anniversary
RSS
Archive
