4 ms·

how will AV help against zero-day browser exploit? Zero-day, by their very definition, have no antivirus definition that will catch them yet. On my personal ma

how will AV help against zero-day browser exploit? Zero-day, by their very definition, have no antivirus definition that will catch them yet. On my personal machine, I don't run any anti-virus software, but I also don't use adobe pdf and enable flash only on sites I trust.

freehunter 15y ago
One of the reasons the author is complaining about AV is the very reason an AV will likely catch a browser exploit that runs local code. The program the author tells you to write in C doesn't have a definition either, but the code matches an signature that the AVs will look for, same with browser exploits. Native code running without the OS knowing why will usually end up being flagged.
DanBC 15y ago
Safe Hex is an important part of keeping a machine clean. (See, for example, RSA being hit because someone opened an Excel attachment.[1]) But as malware authors find more holes and use more exploits it becomes harder to know what's safe or not. Having some weird defaults in operating systems (don't show file extensions; perform an action based on the extension and not the type of file; build a web-browser into the OS; use a preview pane that auto-opens a lot of things so you don't need to "open" an email message it's been opened for you by the pre-installed email client etc etc) really didn't help. There's also a problem with users. (This comment in not aimed at you!) Some operating systems have very many users who believe themselves to be clueful but who really really are not. The arrogant 19 year old who can slot together a motherboard and GPU and PSU and put them in a case, who can connect his aunt's computer to the Internet, who can install add-ons to his web browser. These are people who think they know what they're doing, who think that the pirated OS they use is fine because they checked an MD5 hash, and who think the pirated software they use is fine because someone would have said something in the torrent comments if it wasn't. And then, if they have a problem, they'll download a pirate AV and hope that isn't infected. These are the people most mocking of the "wipe and re-install; that's the only safe option" philosophy. They'll spend a day using various bits of anti-malware and scanners and web-searching. And they won't find the infected WMV file and they'll get re-infected a few days later. [1] (http://blogs.rsa.com/rivner/anatomy-of-an-attack/ http://blogs.rsa.com/rivner/anatomy-of-an-attack/)
- freehunter 15y ago
  It drives me crazy when we find an infected computer at work and the solution posited by both the user and the desktop team is "run the corporate AV". No. We have a backup system for a reason. If you don't use it (like the policy mandates you do), that's your fault. The machine gets completely wiped and reimaged. AVs are a first-line and an indication that something is wrong. If you need to run the AV to clean an actual, real virus, you should be reloading the machine.

freehunter 15y ago

One of the reasons the author is complaining about AV is the very reason an AV will likely catch a browser exploit that runs local code. The program the author tells you to write in C doesn't have a definition either, but the code matches an signature that the AVs will look for, same with browser exploits. Native code running without the OS knowing why will usually end up being flagged.

DanBC 15y ago

Safe Hex is an important part of keeping a machine clean. (See, for example, RSA being hit because someone opened an Excel attachment.[1]) But as malware authors find more holes and use more exploits it becomes harder to know what's safe or not. Having some weird defaults in operating systems (don't show file extensions; perform an action based on the extension and not the type of file; build a web-browser into the OS; use a preview pane that auto-opens a lot of things so you don't need to "open" an email message it's been opened for you by the pre-installed email client etc etc) really didn't help. There's also a problem with users. (This comment in not aimed at you!) Some operating systems have very many users who believe themselves to be clueful but who really really are not. The arrogant 19 year old who can slot together a motherboard and GPU and PSU and put them in a case, who can connect his aunt's computer to the Internet, who can install add-ons to his web browser. These are people who think they know what they're doing, who think that the pirated OS they use is fine because they checked an MD5 hash, and who think the pirated software they use is fine because someone would have said something in the torrent comments if it wasn't. And then, if they have a problem, they'll download a pirate AV and hope that isn't infected. These are the people most mocking of the "wipe and re-install; that's the only safe option" philosophy. They'll spend a day using various bits of anti-malware and scanners and web-searching. And they won't find the infected WMV file and they'll get re-infected a few days later. [1] (http://blogs.rsa.com/rivner/anatomy-of-an-attack/ http://blogs.rsa.com/rivner/anatomy-of-an-attack/)

freehunter 15y ago
It drives me crazy when we find an infected computer at work and the solution posited by both the user and the desktop team is "run the corporate AV". No. We have a backup system for a reason. If you don't use it (like the policy mandates you do), that's your fault. The machine gets completely wiped and reimaged. AVs are a first-line and an indication that something is wrong. If you need to run the AV to clean an actual, real virus, you should be reloading the machine.