Application-level Virtualization for Windows

Application-level Virtualization for Windows
Federico Biancuzzi, 2006-07-12

Federico Biancuzzi interviews Eyal Dotan, who has developed application-level virtualization software that protects Windows hosts from malware. They discuss the architecture, advantages of this design, performance, and how this method could be applied to servers running Windows or be ported to other OSes.

Colapse all | Post comment

Don't need a virus scanner? Not quite.. 2006-07-13
Anonymous (4 replies)

Just because malware is neatly confined into a virtualisation layer doesn't mean you shouldn't try to remove it. Many viruses do nasty things like using all your internet bandwidth (potentially costing money), using 100% cpu to make your computer run like a dog, or spending all their time attacking...

[ more ] [ reply ]

Re: Don't need a virus scanner? Not quite.. 2006-07-13
Anonymous

Maybe I'm wrong, but I think Eyal said that BZ doesn't let unauthorized software use the network.

Eating all the cpu is a problem though. I think BZ could take some measure to avoid that. However I think no software does this on Windows; even on Linux/UNIX you don't find such an application...
...

[ more ] [ reply ]

Re: Don't need a virus scanner? Not quite.. 2006-07-14
Anonymous

Yeah, I agree.

I see this as a "sandbox" like solution that introduces a "permanent-damage" resistant layer for your system. Its technology that should complement and NOT replace existing solutions. There's no harm in using it alongside a free AV or online on-demand AV scanners. Maybe use it like...

[ more ] [ reply ]

Re: Don't need a virus scanner? Not quite.. 2006-07-14
Anonymous

On Linux you can use ulimit to limit %cpu used.
Maybe there is something like that already bundled with Windows? Maybe inside XP PowerTools?...

[ more ] [ reply ]

Re: Don't need a virus scanner? Not quite.. 2006-07-17
Eyal Dotan (1 replies)

Guys, let me clarify some points:

This isn't a discussion about replacing AVs. AVs are good in some areas (precise detection of known malware), and weak in other areas (protection of your system from unknown programs & threats).

Virtualization is necessary for securing P2P, Internet downloads,...

[ more ] [ reply ]

Does this eliminate ability to perform forensics 2006-07-20
Anonymous (1 replies)

I do forensics as part of my security role. How does virtualization effect the way I recover data such as web browser files, etc. Does this mean I cant do any forensics on it, such as for investigations?...

[ more ] [ reply ]

Re: Does this eliminate ability to perform forensics 2006-07-25
Eyal Dotan

Application Virtualization keeps the same file system attributes. It's just that the files are stored somewhere else (C:\Virtual in case of BufferZone).
In other words -- nothing's changed, except you need to look for files & registry in two locations (the virtual and the real)....

[ more ] [ reply ]

Application-level virtualization for Windows 2006-07-19
Anonymous (2 replies)

How compares this product with Softricity's Softgrid and Altiris SVS?
I mean technically, qua virtualization.

Another question now Microsoft bought Softricity the question arises wether BufferZone and Softgrid are expected to work side by side or not....

[ more ] [ reply ]

Re: Application-level virtualization for Windows 2006-07-21
Eyal Dotan

Altiris and Softricity both use virtualization for a different goal: deploying applications over the network.
BufferZone deals with security, for existing applications & their downloads. Since it was designed for security, it can cope with the most dangerous malicious / vulnerable applications in a...

[ more ] [ reply ]

Re: Application-level virtualization for Windows 2006-07-23
Anonymous

The products you mentionned are using virtualization for software *deployment*.
Bufferzone is for security....

[ more ] [ reply ]

chroot 2006-07-20
Anonymous

How this approach is different to chroot? Or to combination of chroot and systrace?...

[ more ] [ reply ]