4 ms·
Can antimalware suites remain effective if they are sandboxed ? Seems to me that the "system police", as it were, needs access to the system it is policing.
by na85 9y ago
Can antimalware suites remain effective if they are sandboxed ?
Seems to me that the "system police", as it were, needs access to the system it is policing.
- opie34 9y agoIt is my opinion that the author's primary concern is that Windows Defender (or any antimalware suite [1][2]) has a huge attack surface, due to the high privileges assigned, and the huge amounts of file formats supported (which require custom or 3rd party parsing libraries.) Sandboxing substantially reduces that attack surface, by placing the parsing engines, and the untrusted executable in protected environments. I agree with your sentiment that sandboxing will require more complex interactions between sandboxes for antimalware suites to act on pre-existing threats (and minimizing the required privileges for the 'SYSTEM'-level process that must act on those threats.) [1]: https://www.engadget.com/2016/06/29/google-symantec-antivirus-flaws-are-as-bad-as-it-gets/ https://www.engadget.com/2016/06/29/google-symantec-antiviru... [2]: https://www.engadget.com/2016/01/13/trend-micro-security-password-risk/ https://www.engadget.com/2016/01/13/trend-micro-security-pas...
- tptacek 9y agoThe scanning engine of an AV system is like the render process of a browser. The browser itself has tentacles all over the system, but most of the danger is in parsing and executing untrusted code, and that subsystem doesn't have a lot of tentacles.
- tyoma 9y agoThe browser and renderer is a perfect analogy. Only the scanning code that contains the format parsers, emulators, etc, needs to be sandboxed.
- kevin_b_er 9y agoTo use an analogy, this is the police laboratory that can be zombified by a virus not having access to guns.