6 ms·
this might be dumb, but why do we even use scanning in this day and age? Why not use kernel callbacks which notify when executables and files load for, say, the
by Sirened 4y ago
this might be dumb, but why do we even use scanning in this day and age? Why not use kernel callbacks which notify when executables and files load for, say, the first time after being modified? Surely that'd be less race-y and waste less battery?
- zibby8 4y agoWhat if the list of known malware changes to include a file already on the computer?
- fomine3 4y agoAnyway it's loaded when it's executed/used
- Sirened 4y agoSure, scan when definitions change, but as the author notes: > Adload for a period of 8 seconds, once or so each day They're scanning daily irrespective of signature updates, which makes no sense.
- Godel_unicode 4y agoCan’t speak to Apple’s solution specifically, but most AV will have several signature updates in a day.
- jokethrowaway 4y agoThey already do it, that's all the notifications when you first run an executable.
- Sirened 4y agoRight, which is why I'm baffled as to why they'd introduce scanning in 2022
- melony 4y agoIn case of zero days, the AV can block the file before it exploits the kernel (or whatever other vector)
- GekkePrutser 4y agoBut this doesn't scan for zero-days, only for several major known malwares. If you want to catch real zero-days, you have to approach things very differently. Do behavioral analytics, seeing what a process is up to and if it's poking into things it shouldn't. Many leading AV suppliers like SentinelOne, Cylance, Crowdstrike do this and are very successful at it. However Apple is just starting in the antimalware market so I forgive them that they're just scanning for some known-bads for now.
- radicaldreamer 4y agoI'm sure it works a lot better when alerts result in a human looking at the issue.
- Sirened 4y agoI'm honestly not convinced any of these vendors are able to do anything about zero days either. They mostly seem to try and catch post exploitation and trying to detect "weird shit" happening post compromise (persistence, exfiltration, etc.). No AI/ML security product is going to stop someone from throwing a kernel exploit a disappearing into the night.
- NateLawson 4y agoA semi-legit app can later drop malicious code and run it. Think of a repackaged OSS project or pirated software that has an auto-updater built in.
- lalopalota 4y agowhich would be a new file, or one that has been modified since it was last run. which would be handled by the first run protection.
- kube-system 4y agoI just 'executed' an eicar test file in a terminal and nothing stepped in.
- simonh 4y agoIf you have XProtect active, it should step in if you try and open the EICAR file in a text editor. It may not if you try and “run” the file because it’s not an executable binary. Have you disabled Gatekeeper?
- SmellyPotato22 4y agoTotally that's why Apple made endpoint security for security vendors. You can even pipe the events from the kernel with "sudo eslogger exec | jq" on the new macOS https://developer.apple.com/documentation/endpointsecurity https://developer.apple.com/documentation/endpointsecurity
- deleted 4y ago[deleted]