8 ms·

With most types of software, if you're stuck with C/C++, you want to keep the development to a high standard where there aren't any bugs like this. But anti-vir

With most types of software, if you're stuck with C/C++, you want to keep the development to a high standard where there aren't any bugs like this. But anti-virus software is unusual in that it needs to handle malicious input of an unusually wide variety of file formats, which makes completely eliminating file-format vulnerabilities basically unfeasible without some sort of broadly-applicable fix. That fix could be a memory-safe language, or it could be sandboxing. But the assumption should be that for any antivirus product which does its file-parsing in C or C++, and which doesn't sandbox is scanning engine, there's going to be at least one critical vulnerability in the scanner. Bitdefender is still unsandboxed, so fixing this particular vulnerability is only of limited use; there are almost certainly other, similar vulnerabilities in it, so users running it are vulnerable to anyone with the resources to find one. AV companies have mostly gotten away with this sort of thing in the past, because individual AV scanners tend to have low enough market share that they aren't as desirable targets as web browsers. But Windows Defender recently broke that trend by being present on every Windows system, and having a critical vulnerability, so now there are a lot more researchers looking at unsandboxed AV scanning engines and finding problems.

QAPereo 9y ago
What would you recommend instead for a Win platform?
- lucian1900 9y ago
  Nothing. There is no need for anything.
  - throwaway613834 9y ago
    I hope you don't get downvoted through the floor for saying this, because that's the kind of reaction I've gotten the past n > 8 years for suggesting people don't run an antivirus on Windows.
    - jessaustin 9y ago
      You've been right for n > 8 years...
  - thephyber 9y ago
    > There is no need for anything. This is a bit of a broad brush. It assumes that all people always act with the best security hygiene. I detest traditional AV as snake oil and realize that there is additional risk added by using AV, but it does have its place in many threat models, especially for those who are not internet+security literate.
    - QAPereo 9y ago
      In particular I'm thinking of my very non-techie mother.
      - copperx 9y ago
        Is there a way to lock down Windows 10 nowadays, so that you can only install software from the Windows store?
        avtar 9y ago
        That seems to be the main feature of Windows 10 S, Microsoft's Chrome OS alternative.
        0xfeba 9y ago
        Windows 10S will do just that, whenever it is released.
    - ktRolster 9y ago
      AV will make those people who are not internet+security literate more vulnerable. There have been vulnerabilities found in all major anti-viruses, some of them were really bad. You're better off not using an antivirus. See for example: https://arstechnica.com/information-technology/2017/06/latest-high-severity-flaw-in-windows-defender-highlights-the-dark-side-of-av/ https://arstechnica.com/information-technology/2017/06/lates... Staying up to date on your updates is the best advice you can give.
      - FreakLegion 9y ago
- gamad 9y ago
  I use Microsoft's own "Windows Defender" combined with Malware Bytes to catch any PUPs. While I'm a very careful user, this combination, to the best of my knowledge, has kept me safe. (MalwareBytes caught a piece of commercial software that I paid $59 for -- a Blu-Ray player -- that tried to install a browser add-on that would have presented alternate advertising.)
blub 9y ago
The fix could be a memory safe language in theory, but in practice it's very unlikely. A lot (all?) of the parsers for various formats are written in C or C++. Two small exceptions: I've seen that there's a Rust image library available, however it's part of another larger project and has almost zero documentation or comments. There's also a Rust lib for zip files, but it wraps a significant amount of C. It looks to me that Mozilla aside the industry has given up and decided to sandbox. Considering the amount of crap code out there, it's understandable. I like to read the details about vulnerabilities when updating Ubuntu. Most of those could be easily avoidable in C++ if one knows how to write secure code. The fixes are usually adding some checks, an extra if, an initialisation, etc - treating the symptom. e.g: the Bitdefender team missed that a 64 bit uint was passed to a function taking a 32 bit parameter. They likely have all casting warnings disabled - a lot of C library code spews a ton of warnings. "Fixed" by changing the parameter to 64 bit.
- duneroadrunner 9y ago
  Have to mention SaferCPlusPlus[1] here - basically a memory-safe subset of C++ with (fairly) low migration cost. For example, here[2] is an open source png encoder/decoder that was ensured to be free from buffer overflow vulnerabilities via automated (partial) translation to SaferCPlusPlus. [1] Shameless plug: https://github.com/duneroadrunner/SaferCPlusPlus https://github.com/duneroadrunner/SaferCPlusPlus [2] https://github.com/duneroadrunner/SaferCPlusPlus-AutoTranslation/tree/master/examples/lodepng https://github.com/duneroadrunner/SaferCPlusPlus-AutoTransla...
  - bluejekyll 9y ago
    I keep seeing people say C++ can be "safe", but yet to see something with as much safety as Rust. So, question, is this subset you speak of as safe as Rust?
    - duneroadrunner 9y ago
      Technically, you would need to unambiguously define what you mean by "safe" and "Rust", but in the way that I think you mean it, the answer is essentially yes. "SaferCPlusPlus" does not refer to "modern" C++ programming practices that can help avoid many traditional classes of bugs. It, in theory, refers to the avoidance/prohibition of any C++ element that can access unallocated/deallocated or uninitialized memory. That means for example, no native pointers (including the implicit "this" pointer in member functions), references, arrays, unions, etc.. It also means no unsafe standard library elements like std::vector, std::array, std::shared_ptr, std::unique_ptr, etc.. In order to make this practical, there is a SaferCPlusPlus library that provides largely compatible (memory) safe substitutes for the most commonly used of these elements. The implementation of SaferCPlusPlus as a language/dialect is not yet complete. For example, there is not yet a proper compile-time "enforcement" tool to verify that your code is actually free from unsafe elements. But as a programmer, you basically know what those potentially unsafe elements are, and the SaferCPlusPlus library already makes it practical to write C++ code that avoids the vast majority of them. That said, I would say that, at the moment, SaferCPlusPlus is not a direct alternative to Rust. If you have the resources to do a rewrite of your project in Rust and memory safety is paramount, then that's probably the way to go. On the other hand, if you need a more expedient way to address code safety or have some other issue with using Rust, SaferCPlusPlus may be a more attractive choice. https://github.com/duneroadrunner/SaferCPlusPlus#safercplusplus-versus-rust https://github.com/duneroadrunner/SaferCPlusPlus#safercplusp...

QAPereo 9y ago

What would you recommend instead for a Win platform?

lucian1900 9y ago
Nothing. There is no need for anything.
- throwaway613834 9y ago
  I hope you don't get downvoted through the floor for saying this, because that's the kind of reaction I've gotten the past n > 8 years for suggesting people don't run an antivirus on Windows.
  - jessaustin 9y ago
    You've been right for n > 8 years...
- thephyber 9y ago
  > There is no need for anything. This is a bit of a broad brush. It assumes that all people always act with the best security hygiene. I detest traditional AV as snake oil and realize that there is additional risk added by using AV, but it does have its place in many threat models, especially for those who are not internet+security literate.
  - QAPereo 9y ago
    In particular I'm thinking of my very non-techie mother.
    - copperx 9y ago
      Is there a way to lock down Windows 10 nowadays, so that you can only install software from the Windows store?
      - avtar 9y ago
        That seems to be the main feature of Windows 10 S, Microsoft's Chrome OS alternative.
      - 0xfeba 9y ago
        Windows 10S will do just that, whenever it is released.
  - ktRolster 9y ago
    AV will make those people who are not internet+security literate more vulnerable. There have been vulnerabilities found in all major anti-viruses, some of them were really bad. You're better off not using an antivirus. See for example: https://arstechnica.com/information-technology/2017/06/latest-high-severity-flaw-in-windows-defender-highlights-the-dark-side-of-av/ https://arstechnica.com/information-technology/2017/06/lates... Staying up to date on your updates is the best advice you can give.
    - FreakLegion 9y ago
gamad 9y ago
I use Microsoft's own "Windows Defender" combined with Malware Bytes to catch any PUPs. While I'm a very careful user, this combination, to the best of my knowledge, has kept me safe. (MalwareBytes caught a piece of commercial software that I paid $59 for -- a Blu-Ray player -- that tried to install a browser add-on that would have presented alternate advertising.)

blub 9y ago

The fix could be a memory safe language in theory, but in practice it's very unlikely. A lot (all?) of the parsers for various formats are written in C or C++. Two small exceptions: I've seen that there's a Rust image library available, however it's part of another larger project and has almost zero documentation or comments. There's also a Rust lib for zip files, but it wraps a significant amount of C. It looks to me that Mozilla aside the industry has given up and decided to sandbox. Considering the amount of crap code out there, it's understandable. I like to read the details about vulnerabilities when updating Ubuntu. Most of those could be easily avoidable in C++ if one knows how to write secure code. The fixes are usually adding some checks, an extra if, an initialisation, etc - treating the symptom. e.g: the Bitdefender team missed that a 64 bit uint was passed to a function taking a 32 bit parameter. They likely have all casting warnings disabled - a lot of C library code spews a ton of warnings. "Fixed" by changing the parameter to 64 bit.

duneroadrunner 9y ago
Have to mention SaferCPlusPlus[1] here - basically a memory-safe subset of C++ with (fairly) low migration cost. For example, here[2] is an open source png encoder/decoder that was ensured to be free from buffer overflow vulnerabilities via automated (partial) translation to SaferCPlusPlus. [1] Shameless plug: https://github.com/duneroadrunner/SaferCPlusPlus https://github.com/duneroadrunner/SaferCPlusPlus [2] https://github.com/duneroadrunner/SaferCPlusPlus-AutoTranslation/tree/master/examples/lodepng https://github.com/duneroadrunner/SaferCPlusPlus-AutoTransla...
- bluejekyll 9y ago
  I keep seeing people say C++ can be "safe", but yet to see something with as much safety as Rust. So, question, is this subset you speak of as safe as Rust?
  - duneroadrunner 9y ago
    Technically, you would need to unambiguously define what you mean by "safe" and "Rust", but in the way that I think you mean it, the answer is essentially yes. "SaferCPlusPlus" does not refer to "modern" C++ programming practices that can help avoid many traditional classes of bugs. It, in theory, refers to the avoidance/prohibition of any C++ element that can access unallocated/deallocated or uninitialized memory. That means for example, no native pointers (including the implicit "this" pointer in member functions), references, arrays, unions, etc.. It also means no unsafe standard library elements like std::vector, std::array, std::shared_ptr, std::unique_ptr, etc.. In order to make this practical, there is a SaferCPlusPlus library that provides largely compatible (memory) safe substitutes for the most commonly used of these elements. The implementation of SaferCPlusPlus as a language/dialect is not yet complete. For example, there is not yet a proper compile-time "enforcement" tool to verify that your code is actually free from unsafe elements. But as a programmer, you basically know what those potentially unsafe elements are, and the SaferCPlusPlus library already makes it practical to write C++ code that avoids the vast majority of them. That said, I would say that, at the moment, SaferCPlusPlus is not a direct alternative to Rust. If you have the resources to do a rewrite of your project in Rust and memory safety is paramount, then that's probably the way to go. On the other hand, if you need a more expedient way to address code safety or have some other issue with using Rust, SaferCPlusPlus may be a more attractive choice. https://github.com/duneroadrunner/SaferCPlusPlus#safercplusplus-versus-rust https://github.com/duneroadrunner/SaferCPlusPlus#safercplusp...