Antispyware veterans launch anti-0day startup

28.04.2006
Bob Bales and Roger Thompson hit it big with their last venture, antispyware company PestPatrol. Now the two have launched a new company. Their target: drive by downloads and zero day exploits, like the recent Windows Meta File (WMF).

The new company, Exploit Prevention Labs, will launch on Monday with a free beta version of the company's first product, SocketShield, which protects computers against exploitation by previously unknown (zero-day) attacks. After helping launch the antispyware market almost ten years ago, the two are hoping they can make lightening strike twice, waking up consumers and the security market to a threat that some call "crimeware."

The new company was Thompson's brainchild and grew out of research on worm propagation.

"I run this distributed honeypot which I set up to spot when new worms were appearing. As time went on, though, I kept seeing these people get nailed by drive by download and they had no idea how," he said, referring to Web site based attacks that use Web browser or other application vulnerabilities to push out malicious programs to the systems of people who visit the site.

Thompson tweaked his honeypot network to start collecting malicious code distributed by the drive by download sites and was amazed at what he found.

"Some of these install script (Web pages) had more than a million hits," he said.