LynuxWorks announces the first Rootkit Detection System powered by the LynxSecure separation kernel
September 2013 by LynuxWorks
LynuxWorks, Inc. announced the RDS5201, a new and unique product to help detect the stealthiest of advanced persistent threats (APT), the rootkit, at the Gartner Security & Risk Management Summit in London. Built on the LynxSecure 5.2 separation kernel and hypervisor (announced at RSA 2013 in February), this small form factor appliance has been designed to offer a unique detection capability that complements traditional security mechanisms as they try to protect against the growing number and complexity of cyber threats.
The RDS5201 Rootkit Detection System is a custom-built hardened appliance, which detects low-level, zero-day rootkits — the lethal payload of most APTs. The detection is direct (i.e., not done by statistical analysis or other indirect techniques), and is coupled with immediate, automated, live visual forensic data. The RDS5201 serves as a smart proactive sensor against APT attacks in IT networks and reduces the agonizing detection of APTs from weeks/months to seconds, and is the first and only technology capable of detecting and alerting against such threats in real-time.
“Rootkits are becoming stealthier, more potent and more complex. The threat from them is becoming more prevalent, as exploit kits are commercially available and are easier to use. Recent researches are showing that seven of the top ten threats in 2012 were rootkits, and that the number of boot-level rootkits increased dramatically” said Avishai Ziv, Vice President of Cyber Security Solutions at LynuxWorks, “The normal endpoint and network protection mechanisms simply cannot prevent or even detect them until it is too late, and hence the need for a new type of security product like the RDS5201 to help give early warning for these threats as they infect our enterprise networks”
Rootkits work at the lowest levels of the OS they intend to attack. Common detection and prevention mechanisms are part of the “attack target”, allowing rootkits to disable the installed anti—malware client applications. The only way to overcome low-level rootkits is by allowing the security application to execute with a higher security privilege than the attacked OS; provide complete control of the platform hardware; and monitor all activities of the OS and its applications. It must also be self-protecting, non-bypassable and tamper-proof.
The RDS5201 is based on the LynxSecure separation kernel and hypervisor that offers a non-detectable secure platform that is used to exercise potential infections and with the introduction of the patent pending rootkit detection feature from the 5.2 release, these stealthy threats are revealed as they attack their virtual victim. LynxSecure is the most privileged monitor in the RDS5201 platform, and constantly monitors for malicious and irregular activity in key disk areas (MBR, key blocks & sectors); physical memory areas; CPU instructions & data structures; interrupt data structures etc. This detection is completely OS agnostic, as it’s situated below any of the guest OS. Upon detection, the RDS5201 immediately alerts and sends an automated live forensics report to its dashboard. The report contains visual representation (such as the clean and infected disk sectors, in-memory data structures), allowing rapid and focused threat response. The RDS5201 can also be connected to other network protection systems such as SIEM and threat management systems, offering an early warning mechanism that complements and enhances existing security solutions.