4 ms·
I think it's instructive to consider the smallest possible malicious program of this type, which involves only the use of a basic control structure and the abil
by javajosh 11y ago
I think it's instructive to consider the smallest possible malicious program of this type, which involves only the use of a basic control structure and the ability to initiate a request. The control structure could be setInterval, a while or for loop; the request initiation can be an ajax call, or certain dom manipulations (like altering img.src or script.src).
Questions: did I miss something? Can you write a program that either a) detects these cases or b) provides a reasonable sandbox?
- mox1 11y agoYes, I'm sure you could pretty easily write said program. Then the people who did this would obfuscate their code and you could probably then detect that...and the game whack-a-mole will continue. Eventually as this cycle continues you will end up with something that looks a lot like today's anti-virus programs, (aka a pattern recognition engine...). It's the (theoretical?) software that can detect these types of attacks before or as they are happening that is of interest to lots of people now a days.
- javajosh 11y agoI don't see how code obfuscation would help you defeat sand-boxing.