It must be good! Armand Assante says "I wouldn't use my computer without GuardedID", and he's doing Blue Steel while he says it
First, I don't work for that company, its competitors, or anybody in that industry. Hence, my comments will be free from commercial bias, if not free from personal prejudice. I've never used the product, and up until 90sec ago I'd never heard of it either.
Having said that, in my opinion the product is far more marketing than substance. This is based on their architecture diagram:
http://www.guardedid.com/images/GID_Graphic_r2.gif
As presented, the operation of the product can be summarised as replacement of the standard keyboard driver with an alternative which communicates with an in-app plug-in via a secure 128-bit SSL channel. Good enough. No malware is going to bother doing on-the-fly brute force crypto attacks to compromise that secure link.
What they don't mention is that just as they've replaced the keyboard driver and/or "layered" themselves above or below it in the keyboard hierarchy, so too can any malicious driver that finds itself on the system do the same to the GuardedID driver. In kernel-mode, all drivers are equal in terms of privilege. Each of them can implant itself in such a way as to inspect info being passed to or from any other driver. Hence, assuming an infected machine (why else use the product?), it is relatively trivial for the malware driver do simply go through this decision:
IF ( GuardedID detected ) THEN { layer myself underneath it }
The malware driver gets each stroke first, records it, then dutifully passes it on to the GuardedID driver so the (by now utterly pointless) work of spending processor cycles on keystroke encryption and decryption can commence.
Up at the application layer, their driver's encrypted messages are received and processed by the driver's counterpart component whose job is decryption. Should any malware manage to infiltrate the (say) browser process, it can simply wait until after the keystroke is decrypted to grab it in plain text.
Some of their other marketing "heifer dust" comments are downright misleading too:
- "
Eliminates time-consuming hard disk or memory scans." No, it does nothing of the sort, given it does not replace anti-virus software or make it redundant.
- "
Protects against 'NEW' and 'EXISTING' keyloggers." No, as per the rant above, a GuardedID-aware keylogger would make mincemeat of it.
- "
CryptoColor - visually displays all browser ecrypted fields." It cannot do that, for the simple reason that it really has no idea what happened to the data within the browser process
after it was decrypted, or underneath its driver.
The fundamental problem is that they're aiming to fight against malware which is already on the machine and running with administrative privileges - as a driver no less. From a security theory standpoint, that's a nonsense.
Still, it's relatively cheap, and if you don't mind sacrificing a bit of performance (for its SSL tunnel), it'll probably make the box a little more secure against some forms of malware which are not aware of its presence. It is certainly not the security panacea touted by the marketing department.
