This one is the second in a series of the articles that emphasize reasons for which we needed a new model for the solutions the against-virus and the security.

Reason #1: the basic model

the salesmen of the software of the Against-virus still trust the methods of solving today problems yesterday: they wait for the following virus to the damage of wreak and later they produce a solution. That worked during long time in which a virus would take to years the passage the world. But in this express-it established the passage of the Interet-driven crazy world that we lived inside today, this type of solution is not more applicable. Now a virus can cross the world and infect million computers in minutes.

In good the old days a virus traveled by the floppy disk. To put a soft disc in your computer and except certain data to her and to the virus would infect the soft disc. Then involuntarily to put the soft disc infected in another computer and quick the new computer would become infected. (I am skimming to many excessive ones of the detail to make a point here). Progress of the virus el' was so slow and constant. the salesmen of the Against-virus had time in their side. They had the time to obtain a copy of the virus, dissect it, they work it with a series of tests to raise with a sequence of the company/signature (he sees himself down for the definition), they put the sequence in a data base of sequences to the search stops when exploring your impulsion lasts (and the soft discs) and send the new data base to the public. Ten years ago very well this system worked.

But now each one is connected via the Internet. Now, using the email like point of the transport, it does not take to years the impetus of frunce, in place takes a question from minutes. And here it is where the model is broken. The posteriora part of the step and becomes the following question: if the salesmen can take “the virus known and strangers” like their states of Literature, how then is that we to continue having problems of the virus?

The answer lies in the fact that the authors of the virus have been more creative in raising with new ways to infect and damage of wreak and the industry of software has not responded in the class, preferring to the stay fitted in its old-fashioned methodologies.

So that them old ways you do not work more, can be than you request? It is relatively simple. Let us happen with the steps.

An author of the virus destraílla NewVirus via the email. It forms post office his virus to the thousands of people. Some, all, do not open the accessory involuntarily thinking that they are of a friend or the subject is touching so that they are deceived in the opening that without the thought of her is a problem (cf. naked pictures of Ana Kournikova). Of the email of the accessory the beginning immediately emailing each one in its list of the contact and is fitted in its operating system so that it has it activated every time turns his computer.

The people who he them email alternadamente obtains deceived in the thought of the email are valid and open the accessory. All the breakage of hell loosen very quickly. The agencies that supervise traffic of the Internet consider that the problems which the traffic and they of the email appear with the sudden points in begin to obtain calls or email that alert them to the fact that there is a new problem. The samples are obtained and they are sent dull to the salesmen of the against-virus. They pass the email with a series of tests to analyze what the virus does exactly and how it does. The analysis is made in addition to extract a unique sequence of 1 and 0 a

Fast Digresión in “false positives”: if a salesman arrives a unique sequence that as soon as it happens to be fitted in Microsoft Word, later whenever a user works an exploration of his hard impulsion, the Microsoft Word will be identified like being infected with NewVirus. The users want word of uninstall and they are reinstalan to only learn that still they infect. There will be complaints; they will force to again value the sequence of the company/signature and it relaunches its list of sequences and it admits to the salesman the error.

The sequences of the company/signature catch up typically against a whole boatload of current software hardly to protect against this occurrence, but still it happens and the salesmen learn to add the new software to their beds of test.

The AUTHORIZATION, so the salesman has arrived a sequence from the company/signature. Later? To put the sequence in execution in your data base of the sequence so that when their explorers are exploration matches which is in your hard impulsion to which it is in the data base. After it has been bought up to date the data base sends the data base to their clients in what commonly a “push” is called where he sends the updates to his primary users.

If you did not buy in this service, you must know how enough to register in your salesman of the against-virus and to bring up to date your software so that you remain present.

So where we are? The badly individual one - or the adolescent of the problem has destraillado NewVirus. NewVirus has infected thousands of computers; they have alerted to the salesmen; NewVirus continues infecting; the solutions are reached and “they are pushed” the corporative clients; NewVirus continues infecting hundreds and thousands of computers; the corporative clients breathe a sigh of the relevación and alert to their users as far as the new threat.

The thousands, if million, of computers do not become infected and need to be cleaned because the best way to solve the problem of the virus is to hope each new virus to come ahead and to solve case by case.

But you seated behind and you said: what if? What if categorizaras all the things a virus can do (or it could do), constructed a series of computers to allow that accessory or the program of the email has full rein of a computer (as it would have in your own computer - such computer is called “honeypot”) and later analyzes that computer for the uncomfortable behavior?

That would be a strike with true preferred right against all malevolent software. This one is the behavior-based model. Such model would really protect the virus to you not known, along with all the 70,000 virus known.

In part 2 we will discuss to the risks and the lack of the security of distributing software of the salesman in your board of the writing-desk.

Tim Klemmer

CEO, LLC of OnceRed

http://www.checkinmyemail.com

Tim Klemmer has passed the part best of 12 years than they designed and that they perfected the first solution behavior-based patented true to malevolent software.

timklemmer@checkinmyemail.com