Expanding Malware Defense by Securing Software Installations

Software installation provides an attractive entry vector for malware: since installations are performed with administrator privileges, malware can easily get the enhanced level of access needed to install backdoors, spyware, rootkits, or "bot" software, and to hide these installations from users. Previous research has been focused mainly on securing the execution phase of untrusted software, while largely ignoring the safety of installations. Even security-enhanced operating systems such as SELinux and Vista don't usually impose restrictions during software installs, expecting the system administrator to "know what she is doing." This paper addresses this "gap in armor" by securing software installations. Our technique can support a diversity of package managers and software installers. It is based on a framework that simplifies the development and enforcement of policies that govern safety of installations. We present a simple policy that can be use...

• Type: Conference
• Year: 2008
• Where: DIMVA
• Authors: Weiqing Sun, R. Sekar, Zhenkai Liang, V. N. Venkatakrishnan
• Keywords: Computer Networks, DIMVA 2008, Software Installations, Software Packages, Untrusted Software