5 ms·

Idle speculation -- perhaps they run it in the sandbox to see if it appears to be malicious? I mean, it's kind of like doing crash-tests with live passengers i

Idle speculation -- perhaps they run it in the sandbox to see if it appears to be malicious? I mean, it's kind of like doing crash-tests with live passengers instead of dummies, but I could maybe see somebody deciding this was a good idea.

viraptor 10y ago
This is the most likely reason. Moving it to a lower privilege amount was just either missed, or is still on someone's Todo.
- acdha 10y ago
  I'd expect surprised if it wasn't just the daunting compatibility work: it's a complex legacy codebase and if you make a mistake you impact security or performance on every Windows box in the world.
statictype 10y ago
Yeah - that kind of makes sense - maybe using mock objects for filesystem access and seeing what it was doing - but that feels to me a bit like trying to solve the halting problem - putting yourself into the process really seems like it will prevent you from trying to figure out what it actually does. Maybe I'm just wrong about that and this is a standard technique for evaluating security.
- wfunction 10y ago
  > but that feels to me a bit like trying to solve the halting problem that's literally what every antivirus is already doing though.
- mikeash 10y ago
  Running the program to see if it ever stops is an easy way to solve the halting problem. The trick, of course, is that you need infinite time to be sure of a "never halts" answer. Turing's proof essentially says that there is no way to be sure of knowing what an arbitrary program will do except for running it and seeing what it does. It's an imperfect technique for real-world programs, but so is everything. Think of it as being like static code analysis versus runtime "sanitizer" tools. Both are useful, and both can detect problems the other can't.
  - zAy0LfpBZLC8mAC 10y ago
    > It's an imperfect technique for real-world programs, but so is everything. No, it's mostly a bullshit technique. The thing is that the malware author can see "how much" of the halting problem AV software "solves", and then deliberately hide their bad/suspicious actions just out of reach of that limit. Simple everyday heuristics are good for a lot of things, but the one thing that they are mostly ineffective against is intentional deception.
mikeash 10y ago
It's like doing crash tests with live passengers, but it's OK because you have a machine that can duplicate people and you just kill the duplicates. Except one day you get it mixed up and kill the originals, whoopsie. I greatly enjoy this analogy.
- Ivoah 10y ago
  You should watch The Prestige[1] [1] http://www.imdb.com/title/tt0482571/ http://www.imdb.com/title/tt0482571/
  - JetSpiegel 10y ago
    Or read the book, if you like framing devices that are flimsy excuses to describe sexy ladies.
  - tormeh 10y ago
    It's so good.
  - moomin 10y ago
    (Spoilers) But yes, watch The Prestige.
  - mikeash 10y ago
    Yes, I keep meaning to, just haven't gotten around to it.
  - lfowles 10y ago
    And if you enjoyed that, you'll probably also enjoy: Think Like a Dinosaur https://www.goodreads.com/book/show/13582015-think-like-a-dinosaur https://www.goodreads.com/book/show/13582015-think-like-a-di...
- rbanffy 10y ago
  If the copies cannot be distinguished from the originals, there is no problem.
wglb 10y ago
From the article: MsMpEng runs as NT AUTHORITY\SYSTEM without sandboxing

viraptor 10y ago

This is the most likely reason. Moving it to a lower privilege amount was just either missed, or is still on someone's Todo.

acdha 10y ago
I'd expect surprised if it wasn't just the daunting compatibility work: it's a complex legacy codebase and if you make a mistake you impact security or performance on every Windows box in the world.

statictype 10y ago

Yeah - that kind of makes sense - maybe using mock objects for filesystem access and seeing what it was doing - but that feels to me a bit like trying to solve the halting problem - putting yourself into the process really seems like it will prevent you from trying to figure out what it actually does. Maybe I'm just wrong about that and this is a standard technique for evaluating security.

wfunction 10y ago
> but that feels to me a bit like trying to solve the halting problem that's literally what every antivirus is already doing though.
mikeash 10y ago
Running the program to see if it ever stops is an easy way to solve the halting problem. The trick, of course, is that you need infinite time to be sure of a "never halts" answer. Turing's proof essentially says that there is no way to be sure of knowing what an arbitrary program will do except for running it and seeing what it does. It's an imperfect technique for real-world programs, but so is everything. Think of it as being like static code analysis versus runtime "sanitizer" tools. Both are useful, and both can detect problems the other can't.
- zAy0LfpBZLC8mAC 10y ago
  > It's an imperfect technique for real-world programs, but so is everything. No, it's mostly a bullshit technique. The thing is that the malware author can see "how much" of the halting problem AV software "solves", and then deliberately hide their bad/suspicious actions just out of reach of that limit. Simple everyday heuristics are good for a lot of things, but the one thing that they are mostly ineffective against is intentional deception.

mikeash 10y ago

It's like doing crash tests with live passengers, but it's OK because you have a machine that can duplicate people and you just kill the duplicates. Except one day you get it mixed up and kill the originals, whoopsie. I greatly enjoy this analogy.

Ivoah 10y ago
You should watch The Prestige[1] [1] http://www.imdb.com/title/tt0482571/ http://www.imdb.com/title/tt0482571/
- JetSpiegel 10y ago
  Or read the book, if you like framing devices that are flimsy excuses to describe sexy ladies.
- tormeh 10y ago
  It's so good.
- moomin 10y ago
  (Spoilers) But yes, watch The Prestige.
- mikeash 10y ago
  Yes, I keep meaning to, just haven't gotten around to it.
- lfowles 10y ago
  And if you enjoyed that, you'll probably also enjoy: Think Like a Dinosaur https://www.goodreads.com/book/show/13582015-think-like-a-dinosaur https://www.goodreads.com/book/show/13582015-think-like-a-di...
rbanffy 10y ago
If the copies cannot be distinguished from the originals, there is no problem.

wglb 10y ago

From the article: MsMpEng runs as NT AUTHORITY\SYSTEM without sandboxing