4 ms·
Yes - worms or browsers that scan local data files without accessing the runtime of the parent application.
by libertymcateer 10y ago
Yes - worms or browsers that scan local data files without accessing the runtime of the parent application.
- md_ 10y agoSo your threat model is "malware which has access to memory containing plaintext but is written by idiots"? 0_o
- libertymcateer 10y agoDunno if you are still checking this thread, but I had a followup to this question. It seems to me that certain cryptoviruses function in the following way (e.g. certain variants of ransom_vxlock - I will see if I can find a specific example): * The virus functions like other cryptoviruses, encrypting local data and holding it for ransom * However, in addition to holding your local data ransom, it archives certain files that are likely to hold passwords (e.g., the chrome password store), and then emails them to the C&C server If this is the case, would local encryption of the chrome password store be a protection, or would the decryption of this store be trivial the the virus author? Again, assuming that the virus author is a script kiddy. So, basically, I am asking that if the characterization of the virus described is accurate, doesn't that mean that the threat model I describe also actually occurs in the wild? I'm not trying to be facetious here - I am trying to get to the bottom of this. I will try to find links to support the above.