1

Isolation is a pretty effective method against malware. There are tools to isolate running code in various ways(qubes-os, bromium, fireglass), i.e. using a micro-vm for each task, either locally or remotely.

The other major entry point for malware is protocol vulnerability, like the recent wannacry. Are there any tools that isolate protocols , either on Linux or windows ? Is it a viable option ?

1

An application protocol is just a description of how applications interact with each other. This protocol description might be too vague or inaccurate or have a bad design and thus might lead to security relevant implementation problems. But the description itself is not vulnerable and can not be isolated. Vulnerable instead are the applications and services implementing the protocol, i.e. web browser, file sharing service etc which means that at most these can be isolated in the way you already described: "... isolate running code in various ways(qubes-os, bromium, fireglass), i.e. using a micro-vm for each task, either locally or remotely."

5
  • Of course, I meant protocol implementations. May 20 '17 at 10:46
  • But as per the bromium blog, they don't isolate protocols . Maybe those are part of the kernel ? May 20 '17 at 10:50
  • @hulkingtickets: It is hard to reply to some non-verbatim citation claiming something which is taken out of context. Could you please cite the relevant part of the bromium blog verbatim and add a link so that one can get enough context to understand what they are talking about? May 20 '17 at 12:07
  • Thanks. The context is this: blogs.bromium.com/expect-bromium-application-isolation "The WannaCry crypto-malware variant uses the EternalBlue vector to move laterally in an organization. EternalBlue exploits a vulnerability in Microsoft’s implementation of the Server Message Block (SMB) protocol." May 20 '17 at 15:31
  • 1
    @hulkingtickets: I cannot find anything there which says something like your statement "they don't isolate protocols". Again, protocols can not be isolated because a protocol is just a description. Applications/Services which implement a protocol can be isolated but if a specific solution can do this for a specific service depends on the solution and the service. For example on Linux you could use chroot, containers, different users, VM, ... for different qualities of isolations with different overhead. May 20 '17 at 16:00
0

There is no such thing as protocol isolation because that is not how protocols are used or usable. But to get somewhere near your goal of having a protocol mis-implementation compromise an entire machine; you can isolate the program using a protocol from the rest of the system. Say you had a MTA that uses SMTP. You could run it in a VM or Jail and make a hole in your firewall to allow SMTP traffic for that MTA program. If the program is compromised because of an issue with its use of the SMTP protocol, it should only be compromising its container.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.