4 ms·

> Moreover, the engine runs unsandboxed and as NT Authority\SYSTEM. Is there an antivirus that _doesn't_ parse untrusted input in a process with full system pr

by veeti 9y ago

> Moreover, the engine runs unsandboxed and as NT Authority\SYSTEM. Is there an antivirus that _doesn't_ parse untrusted input in a process with full system privileges? What a joke.

recentdarkness 9y ago
Already years (~7+) ago AVG introduced an out of process scanning implementation that opens the file in question with system rights however transfers the handle to a lower privileged process (restricted with ACLs) that actually performs the actual scan
- landave 9y ago
  That's interesting. Unfortunately, AVG has been acquired by Avast last year [1]. I already looked into the new version of AVG a few months ago, and found that they have replaced AVG's engine with Avast's engine. Since the scanner always runs as NTAuthority\SYSTEM in the current Avast version, I would assume that the same is true for the most recent AVG version. I'm not completely sure, though, so don't quote me on that. [1]: https://press.avast.com/avast-announces-agreement-to-acquire-avg-for-13b https://press.avast.com/avast-announces-agreement-to-acquire...
  - recentdarkness 9y ago
    Well since I am no longer involved with them for a long time, I can't really say how this all went and what is currently the state. However this piece is realtively simple to implement on windows so I can only hope they would implement the same thing for avast eventually at least. This is IMHO the only sane way to do scanning without exposing the system to a huge risk
revelation 9y ago
Having an antivirus installed has so far consistently proven to make a system vastly less secure, degrade performance and reliably break a number of applications you might actually want to use. All of them have just fallen apart at the slightest scrutiny and they are routinely programmed by the last kind of people you want to design and implement them. The whole concept is just useless. Scanning all system IO for 20 year old BIOS viruses is a pure waste of energy.
Asmod4n 9y ago
The Windows Defender Team is working to get it sandboxed.
- RaleyField 9y ago
  So now it's a 10 year race between Mozilla and Defender Team to implement a feature you'd expect them to have from day one. Amazing.

by veeti 9y ago

> Moreover, the engine runs unsandboxed and as NT Authority\SYSTEM. Is there an antivirus that _doesn't_ parse untrusted input in a process with full system privileges? What a joke.

recentdarkness 9y ago

Already years (~7+) ago AVG introduced an out of process scanning implementation that opens the file in question with system rights however transfers the handle to a lower privileged process (restricted with ACLs) that actually performs the actual scan

landave 9y ago
That's interesting. Unfortunately, AVG has been acquired by Avast last year [1]. I already looked into the new version of AVG a few months ago, and found that they have replaced AVG's engine with Avast's engine. Since the scanner always runs as NTAuthority\SYSTEM in the current Avast version, I would assume that the same is true for the most recent AVG version. I'm not completely sure, though, so don't quote me on that. [1]: https://press.avast.com/avast-announces-agreement-to-acquire-avg-for-13b https://press.avast.com/avast-announces-agreement-to-acquire...
- recentdarkness 9y ago
  Well since I am no longer involved with them for a long time, I can't really say how this all went and what is currently the state. However this piece is realtively simple to implement on windows so I can only hope they would implement the same thing for avast eventually at least. This is IMHO the only sane way to do scanning without exposing the system to a huge risk

revelation 9y ago

Having an antivirus installed has so far consistently proven to make a system vastly less secure, degrade performance and reliably break a number of applications you might actually want to use. All of them have just fallen apart at the slightest scrutiny and they are routinely programmed by the last kind of people you want to design and implement them. The whole concept is just useless. Scanning all system IO for 20 year old BIOS viruses is a pure waste of energy.

Asmod4n 9y ago

The Windows Defender Team is working to get it sandboxed.

RaleyField 9y ago
So now it's a 10 year race between Mozilla and Defender Team to implement a feature you'd expect them to have from day one. Amazing.