3 ms·
It's not said that they (the vendors code) downloaded that code. If they have a remote code execution elsewhere it can download more. Does anybody check the si
by usr1106 5y ago
It's not said that they (the vendors code) downloaded that code. If they have a remote code execution elsewhere it can download more.
Does anybody check the signature of all DLLs they are loading (into memory, not downloading) and all executables they are a calling? I have not seen such system in real life. The Linux kernel can check the modules it loads, but that's a different level. And I am not sure how widely it is used in practice. Anyway if you can inject a bad kernel module you are already root and have many more options.
- fmajid 5y agomacOS does with notarization.
- usr1106 5y agoGood point, I am not a MacOS user. Users can authorize unnotarized executables to be run according to a quick Web search. So what would prevent malware from authorizing its unnotarized binaries? In the Kaseya case it seemed to have elevated privileges already, because it was able to install bad binaries.