Topic: Kaspersky patents hardware-based anti-virus

[Samker]

Kaspersky has just been granted a patent for a hardware-based anti-virus, something which could potentially revolutionize the way anti-virus software works: http://www.kaspersky.com/news?id=207576021 
The hardware-based anti-virus will be able to work independently or in combination with any software on the computer or machine.

The patented device by Kaspersky will connect inside of the computer or machine between the hard drive (HDD or SSD) and the computing unit, between the CPU and RAM. The device is also connected on the system bus or integrated into the disk controller.

The hardware-based anti-virus will effectively allow or block any writing to the hard disk, preventing viruses from starting in the first place.  Users will be alerted of the potential risk, preventing or denying the infection from being written to disk.

The patent shows that the device will be self-supported with an ARM processor and RAM, so it will not take away from the machines performance.  The device will also have its own database for malicious code and faulty records during definition updates.

Kaspersky did mention this could be sold and used on a consumer based market, but will help prevent miscellaneous code from spreading in servers and specialized machines initially, such as ATMs.

(NeoWin)

[haz]

WOW ! Not bad !
what about the updates ?

[Fireberg]

Will it works effectively?

[Samker]

what about the updates ?

This device "uses its own updateable antivirus databases that are protected from malicious code and faulty records during updates".

Will it works effectively?

I expect that, since "hardware-based antivirus solution has a distinct advantage over conventional AV solutions because it monitors all attempts to access a memory device while remaining inaccessible to malware".

[xtremeboyz]

100% secure??

[hazedaze]

Good Idea but takes us back to the good old dongle days, I cant really see how this can be any more affective that say a software based AV like McAffe AV which can also protect writing to the C:\ or Windows directory's as well as preventing anything to run form the Temp Directory, Providing it's setup properly!!!

It would be interesting to see what little/major impact this has when it comes to comunicating to the HDD/Ram/CPU being that the device is "in-line" compared to the Software versions even though it will have it's own processor there has to be some impact??.

On A side note It's also a good way to stop piracy beacuse you have to purchase a physical item!!

One thing that I would look at is at what level does this thing comunicate to update it's AV database???, Im guessing being Hardware based it would be in some for of Basic possibly?? which means it would be low level communication which YOU the home user would not be able to see and if you did it would be encrypted!! Also what else is this little device doing/would do?? it reminds me of the little black box scheme the goverment want's us UK motorists to have in our cars so they know where you are and what speed your going, (Instant speeding fines) e.t.c e.t.c

One Major Problem, How long befor the Virus Coders take one of these devices reverse engineer it to crack the update method/encryption and deploy there own compromised definitions/code to your machine??? and if they do this and they do get dodgy def's/code on your machine, what could you do about "restoring factory defaults??" if there is such an option??

[Samker]

One thing that I would look at is at what level does this thing comunicate to update it's AV database???, Im guessing being Hardware based it would be in some for of Basic possibly?? which means it would be low level communication which YOU the home user would not be able to see and if you did it would be encrypted!! Also what else is this little device doing/would do?? it reminds me of the little black box scheme the goverment want's us UK motorists to have in our cars so they know where you are and what speed your going, (Instant speeding fines) e.t.c e.t.c

Maybe this is answer for your question "Chuck Norris Botnet Karate-chops Routers Hard": http://scforum.info/index.php/topic,3853.0.html
I suppose, that this kind of devices will prevent infections of hardware components:
"Security experts say that various types of botnets have infected millions of computers worldwide to date, but Chuck Norris is unusual in that it infects DSL modems and routers rather than PCs."

One Major Problem, How long befor the Virus Coders take one of these devices reverse engineer it to crack the update method/encryption and deploy there own compromised definitions/code to your machine???

This is excellent question and good point. 
In my opinion, in this case We'll have infections which is almost impossible to clean. 

[sdwgnr76]

too heavy...