LONDON, UK–September 18, 2013–LynuxWorks, Inc., a technology leader in the cyber threat defense market, today announced at the Gartner Security & Risk Management Summit in London, the RDS5201, a new and unique product to help detect the stealthiest of advanced persistent threats (APT), the rootkit. Built on the LynxSecure 5.2 separation kernel and hypervisor (announced at the RSA 2013 Conference in February), this small form factor appliance has been designed to offer a unique detection capability that complements traditional security mechanisms as they try to protect against the growing number and complexity of cyber threats.
The RDS5201 Rootkit Detection System is a custom-built hardened appliance, which detects low-level, zero-day rootkits–the lethal payload of most APTs. The detection is direct (i.e., not done by statistical analysis or other indirect techniques) and is coupled with immediate, automated, live visual forensic data. The RDS5201 serves as a smart proactive sensor against APT attacks in IT networks and reduces the agonizing detection of APTs from weeks/months to seconds, and is the first and only technology capable of detecting and alerting against such threats in real-time.
“Rootkits are becoming stealthier, more potent and more complex. The threat from them is becoming more prevalent, as exploit kits are commercially available and are easier to use. Recent researches are showing that seven of the top ten threats in 2012 were rootkits and that the number of boot-level rootkits increased dramatically,” said Avishai Ziv, vice president of Cyber Security Solutions at LynuxWorks. “The normal endpoint and network protection mechanisms simply cannot prevent, or even detect, them until it is too late and hence the need for a new type of security product, such as the RDS5201, to help give early warning for these threats as they infect our enterprise networks.”
Rootkits work at the lowest levels of the operating system (OS) they intend to attack. Common detection and prevention mechanisms are part of the “attack target,” allowing rootkits to disable the installed anti-malware client applications. The only way to overcome low-level rootkits is by allowing the security application to execute with a higher security privilege than the attacked OS; provide complete control of the platform hardware; and monitor all activities of the OS and its applications. It must also be self-protecting, non-bypassable and tamper-proof.
The RDS5201 is based on the LynxSecure separation kernel and hypervisor that offers a non-detectable secure platform that is used to exercise potential infections and with the introduction of the patent pending rootkit detection feature from the 5.2 release. These stealthy threats are revealed as they attack their virtual victim. LynxSecure is the most privileged monitor in the RDS5201 platform, and constantly monitors for malicious and irregular activity in key disk areas (MBR, key blocks and sectors); physical memory areas; CPU instructions and data structures; interrupt data structures etc. This detection is completely OS agnostic, as it’s situated below any of the guest OS. Upon detection, the RDS5201 immediately alerts and sends an automated live forensics report to its dashboard. The report contains visual representation (such as the clean and infected disk sectors in-memory data structures), allowing rapid and focused threat response. The RDS5201 can also be connected to other network protection systems such as SIEM and threat management systems, offering an early warning mechanism that complements and enhances existing security solutions.
About LynxSecure
LynxSecure is a “Type-0” hypervisor, which features a new, least privilege architecture that differentiates from type 1 hypervisors by removing the un-needed functionality from the “security sensitive” hypervisor mode. LynxSecure provides the ability to fully virtualize multiple unmodified guest OSs and includes real-time development tools to give developers granular control over hardware platform resources for managing guest OS resource allocation, execution scheduling and intercommunication. By combining the best-of-breed capabilities of the separation kernel technology, virtualization and real-time development tools, LynxSecure provides unmatched capabilities to build advanced integrated solutions on standard commercial-off-the-shelf (COTS) embedded targets.
About LynuxWorks
LynuxWorks, a world leader in the embedded software market, is committed to providing open and reliable RTOS and software tools to embedded developers. The company’s LynxOS family of operating systems offers open standards with the highest level of safety and security features, enabling many mission-critical systems in defense, avionics and other industries. The
latest product in the portfolio, the award winning LynxSecure offers a secure separation kernel and embedded hypervisor that forms a platform for the development of high-assurance systems. Since it was established in 1988, LynuxWorks has created technology that has been successfully deployed in thousands of designs and millions of products made by leading communications, avionics, aerospace/defense and consumer electronics companies. LynuxWorks’ headquarters are located in San Jose, CA. For more information, visit www.lynuxworks.com.
