4 ms·
Right, which is why I'm baffled as to why they'd introduce scanning in 2022
by Sirened 4y ago
Right, which is why I'm baffled as to why they'd introduce scanning in 2022
- melony 4y agoIn case of zero days, the AV can block the file before it exploits the kernel (or whatever other vector)
- GekkePrutser 4y agoBut this doesn't scan for zero-days, only for several major known malwares. If you want to catch real zero-days, you have to approach things very differently. Do behavioral analytics, seeing what a process is up to and if it's poking into things it shouldn't. Many leading AV suppliers like SentinelOne, Cylance, Crowdstrike do this and are very successful at it. However Apple is just starting in the antimalware market so I forgive them that they're just scanning for some known-bads for now.
- radicaldreamer 4y agoI'm sure it works a lot better when alerts result in a human looking at the issue.
- Sirened 4y agoI'm honestly not convinced any of these vendors are able to do anything about zero days either. They mostly seem to try and catch post exploitation and trying to detect "weird shit" happening post compromise (persistence, exfiltration, etc.). No AI/ML security product is going to stop someone from throwing a kernel exploit a disappearing into the night.
- NateLawson 4y agoA semi-legit app can later drop malicious code and run it. Think of a repackaged OSS project or pirated software that has an auto-updater built in.
- lalopalota 4y agowhich would be a new file, or one that has been modified since it was last run. which would be handled by the first run protection.
- cma 4y agoBrowsers can generate machine code and make it executable (for e.g. V8), and so can any other app. So they could download it and put it into newly allocated executable memory pages.
- simonh 4y agoIt will catch an infected file that simply passes through the computer without being opened or executed.
- robryk 4y agoWhat do you mean by "passes"? Unless it's a file on a removable medium or a remote fs, it has to be created, which requires opening it. Scanning removable media upon insertion and remote fses upon mounting is going to look mighty suspicious and, in the latter case, be cover for data exfiltration.