5 ms·

"Let's unpack malware in the kernel by supporting 127389213 arcane archive formats in kernel code" — Symantec

by blattimwind 8y ago

the8472 8y ago
Microsoft's defender was also guilty of doing various kernel mode/high privilege parsing things.
- blattimwind 8y ago
  Few security software vendors have shown a particular aptitude for actually designing secure software, let alone implementing secure software.
  - krylon 8y ago
    I find this extremely strange. I cannot even come up with a good metaphor to explain to non-technical people how untrustworthy this makes most AV software look to me. I mean, we all make mistakes, but the kind of bugs that have been found in various AV products are so obviously stupid one can easily get a concussion from face-palming. If I were to roll my own crypto, there are all kinds of subtle mistakes that I could, nay: would, make that I might not even understand if someone explained them to me very patiently. Like, redirecting system calls from a "sandboxed" process, but then executing them as SYSTEM? How can I trust a company that allows such dumb mistakes in their code to build software that is supposed to make a system more secure? It is like finding out that the surgeon who is supposed to operate on you lacks basic knowledge of human anatomy.
    - blattimwind 8y ago
      > I find this extremely strange. I don't. AV software is virtually impossible to vet for a customer; it is the literal stone to keep tigers away (do you see any? It must therefore work). So 100 % of selling AV software is marketing, not functionality. "Independent tests", e.g. how much slower the computer is made by AV software disfavour solid design: All else being equal an AV software where the signature engine runs directly in the kernel code intercepting FS calls will always be faster than the properly designed software were the signature engine runs at lower privileges (requiring task switching), and the FS filter driver has to delegate. Tests where well-known malware is fed into engines and the red flag comes up are also pretty meaningless; signature scanning works, that's not the problem of the product. The problem of the product is that the only things a customer can measure disfavour good execution of it and that signature detection is fundamentally inept in countering relevant attacks and therefore no real protection. Heuristics (or ML or whatever) doesn't really work well, either.
- ChrisSD 8y ago
  To be fair they did learn from this. They can now run defender in a sandbox to analyse files. https://www.bleepingcomputer.com/news/microsoft/microsoft-sandboxes-windows-defender/ https://www.bleepingcomputer.com/news/microsoft/microsoft-sa...
  - acqq 8y ago
    "Microsoft was not the first to sandbox Windows Defender. Last year, experts from security outfit Trail of Bits, who also specialize in virtualization, created a framework that could run Windows applications in their own containers. Windows Defender was one of the projects that Trail of Bits was able to containerize successfully and open-sourced it."
stjohnswarts 8y ago
Sounds legit.

"Let's unpack malware in the kernel by supporting 127389213 arcane archive formats in kernel code" — Symantec

the8472 8y ago

Microsoft's defender was also guilty of doing various kernel mode/high privilege parsing things.

blattimwind 8y ago
Few security software vendors have shown a particular aptitude for actually designing secure software, let alone implementing secure software.
- krylon 8y ago
  I find this extremely strange. I cannot even come up with a good metaphor to explain to non-technical people how untrustworthy this makes most AV software look to me. I mean, we all make mistakes, but the kind of bugs that have been found in various AV products are so obviously stupid one can easily get a concussion from face-palming. If I were to roll my own crypto, there are all kinds of subtle mistakes that I could, nay: would, make that I might not even understand if someone explained them to me very patiently. Like, redirecting system calls from a "sandboxed" process, but then executing them as SYSTEM? How can I trust a company that allows such dumb mistakes in their code to build software that is supposed to make a system more secure? It is like finding out that the surgeon who is supposed to operate on you lacks basic knowledge of human anatomy.
  - blattimwind 8y ago
    > I find this extremely strange. I don't. AV software is virtually impossible to vet for a customer; it is the literal stone to keep tigers away (do you see any? It must therefore work). So 100 % of selling AV software is marketing, not functionality. "Independent tests", e.g. how much slower the computer is made by AV software disfavour solid design: All else being equal an AV software where the signature engine runs directly in the kernel code intercepting FS calls will always be faster than the properly designed software were the signature engine runs at lower privileges (requiring task switching), and the FS filter driver has to delegate. Tests where well-known malware is fed into engines and the red flag comes up are also pretty meaningless; signature scanning works, that's not the problem of the product. The problem of the product is that the only things a customer can measure disfavour good execution of it and that signature detection is fundamentally inept in countering relevant attacks and therefore no real protection. Heuristics (or ML or whatever) doesn't really work well, either.
ChrisSD 8y ago
To be fair they did learn from this. They can now run defender in a sandbox to analyse files. https://www.bleepingcomputer.com/news/microsoft/microsoft-sandboxes-windows-defender/ https://www.bleepingcomputer.com/news/microsoft/microsoft-sa...
- acqq 8y ago
  "Microsoft was not the first to sandbox Windows Defender. Last year, experts from security outfit Trail of Bits, who also specialize in virtualization, created a framework that could run Windows applications in their own containers. Windows Defender was one of the projects that Trail of Bits was able to containerize successfully and open-sourced it."

stjohnswarts 8y ago

Sounds legit.