Intel Debut New "Worm Circuit Breaker" technology at Forum

[exclamation55]

http://www.techworld.com/networking/news/index.cfm?NewsID=4291

designed to monitor the number of connections being made by a PC, and assess the integrity of the machine’s security software.


If it detects a higher than normal number of external connections being made, and this can be related to other software anomalies, the PC is then automatically disconnected to stop it becoming a platform from which to infect further machines

:hotouch:

 

[Vigilante]

I can just see it now. 20 calls a day "um, my computer suddenly can't go online any more". ugh.

All I know is, I hope you will be able to disable it!

 

[RealBlackStuff]

One more reason to go AMD.

 

[Liquidlen]

I don't see this as a bad thing ,but I agree with Vig.. as long as the end user can have some configuration control.
How many 'false positives, etc" have you seen with common anti bug programs?

 

[Vigilante]

There is a difference between "bug finders" and heuristic programs like this technology. Programs like Adaware and Spybot are only looking for known-bad software to remove. So there is no false positives. But that doesn't mean using them can't have consequences, such as breaking LSP software so you can't go online etc...

But the Intel thing is just a sort of, "if it kinda behaves bad, then we'll stop it". I would assume a lot more false positives. Especially on a server, of course, where you have a lot of traffic, E-mail going in and out, etc.

I'm interrested, but I just hope it can be turned off, at least for troubleshooting purposes anyway. We'll see.

 

[zephead]

ahh, this kind of stuff could go either way...

 

[Liquidlen]

There is a difference between "bug finders" and heuristic programs like this technology. Programs like Adaware and Spybot are only looking for known-bad software to remove. So there is no false positives. But that doesn't mean using them can't have consequences, such as breaking LSP software so you can't go online etc...

But the Intel thing is just a sort of, "if it kinda behaves bad, then we'll stop it". I would assume a lot more false positives. Especially on a server, of course, where you have a lot of traffic, E-mail going in and out, etc.

I'm interrested, but I just hope it can be turned off, at least for troubleshooting purposes anyway. We'll see.

I was speaking in vague generalities ,anti spam software > blocks a number of good emails. Anti virus stops any number of good script files etc. Not to mention the numerous conflicts Anti virus can cause with many other good programs on a system . All in the name of self protection.(I give you Symantec, Ehhh)My Adware and Spybot have stop a number of good things from running ,until I release the item.( and that's OK with me,But none are automatic)

I doubt very much if this program is any different .In the long run if it is "end user configurable" it should have some positive benifit.

 

[Vigilante]

I agree.

But software is software (i.e. change, remove etc) but a hardware solution? I remember back to the Pentium Serial number thing people got all upset about until they allowed you to turn it off.
Hardware forces you into their design. As such, it needs to be turned off.

Anyhoo, it's a redundant conversation. I highly doubt they will NOT let you turn it off in the BIOS or whatever. I'm sure they would.

cheers