AV products rooted by obfuscated exploits

When it comes to rootkit and Trojan protection, don't rely on anti-virus (AV) or intrusion detection systems (IDS) as both products are dead, according to security experts.

Anti-virus programs struggle to detect rootkits and Trojans once they are inside the network, according to Peter Allor, director of intelligence for the Internet Security Systems (ISS) research team X-Force.

Not surprisingly, the vendor said organizations should look to intrusion prevention systems (IPS) as the ideal solution.

"Once inside, rootkits can erase installation files allowing them to migrate and hide deep within the system; AV and IDS solutions can't distinguish them from the operating system," Allor said.

"Once you have a rootkit, the ability to remove it and its registry edits becomes almost impossible. It is easier to re-image the machine, reinstalling your OS and applications if you have been hit by a Trojan or rootkit.

"Users need network, host and client level intrusion prevention to find rootkit installers before malware can be downloaded from multiple sources."

In its 2006 Trend Statics report, ISS revealed a global exponential rise in utilization of encryption and obfuscated exploits, and found remote exploitation had risen from 43.6 to 88.4 percent from 2000 - 2006, overtaking local access which dropped from 56.4 to 11.6 percent in the same period.

Analyst at research firm Hydrasight, Michael Warrilow, said the reactive nature of AV products is their downfall.

"Web threats change far too rapidly for a reactive solution to work; malware variants are produced constantly," Warrilow said.

"Hackers have evolved from working for notoriety to profitability so threats are more professional and are using obfuscated techniques and SQL injections."

Security vendor WebSense A/NZ country manager, Joel Camissar, agreed IPSs are the most effective solutions because they prevent users accessing malicious sites.

"Users are the weakest point in a network so inhibiting their access to malicious Web sites will help close vulnerabilities to the network," Camissar said.

"Hackers are becoming professionals now; they work in groups that operate like a business and their attacks are more aggressive and professional."

Microsoft Vista has responded to the increasing vulnerabilities by prompting authentication for access to administrative features, while Internet Explorer runs by default in a protected mode with limited permissions.