Microsoft 'shield' to fight off worms

Researchers at Microsoft have developed a software shield that protects PCs against worm attacks soon after a new threat emerges without requiring a patch or update.

The shield is effectively a generic network filter that is automatically installed once a vulnerability is discovered. It will examine network traffic to and from the application affected by the worm, dropping any traffic that tries to exploit the vulnerability.

Microsoft presented the shield technology at its Research Valley Road Show on the company's Silicon Valley campus.

"In certain cases shields can replace patches," Microsoft researcher Helen Wang told vnunet.com.

Patches would still be necessary, however, because the shields take up computing power. And as exploits and therefore shields pile up over time, this will affect the user experience.

Microsoft's security business unit is looking at the technology, but Wang was unable to say if or when it will become commercially available.

The software shields are an improvement over patches because they do not affect applications or the operating system, eliminating the need for the system to reboot.

Because the shields will protect the PC before a patch is available or has been applied, the technology could very well rid the world of the majority of worm attacks.

Some 90 per cent of worms use known exploits on computers whose owners have failed to apply patches, claimed Wang.

Users tend to put off installing updates because they are considered intrusive and unreliable. In some countries, companies in regulated areas of the economy - such as finance and healthcare - have to file reports for every patch they apply, further delaying the whole process.