3 ms·
On another note, I know nothing about cybersec, is there a reason for which antivirus on windows run at ring 0 while I read that on Linux and Mac they don't hav
by amarcheschi 2y ago
On another note, I know nothing about cybersec, is there a reason for which antivirus on windows run at ring 0 while I read that on Linux and Mac they don't have kernel level access?
- tastroder 2y agoThe Linux version of CS sensor defaults to being installed as a kernel module as well.
- anothernewdude 2y agoWho would trust that?
- fragmede 2y agoyour employer's IT department
- pdw 2y agoAnd especially their auditors
- braiamp 2y agoThis is a management move. IT probably wasn't in the loop, since this effectively reduce the responsibilities of IT in terms of compliance.
- inkyoto 2y agoThe cyber unit within IT is more likely, those ones are besotted with ticking compliance checkboxes, the delegation of responsibility and a game of musical chairs at any cost. It is even more likely that IT was at loggerheads with cyber, but nowadays cyber seems to be able to trump everything and everyone.
- nopcode 2y agoI work in a customer-facing role for a similar product. The handful of customers that asked about kernel modules / drivers saw it as a plus not a con.
- cnotv 2y agoI complained specifically about that and they bounced it back to me like this was safe and cannot use the machine as I want.
- quickthrowman 2y agoA business that is party to a contract that requires the use of such software.
- fifteen1506 2y agovia Reddit, don't know where so can't credit: Kernel panic observed after booting 5.14.0-427.13.1.el9_4.x86_64 by falcon-sensor process -- https://access.redhat.com/solutions/7068083 https://access.redhat.com/solutions/7068083 -- 1 month ago
- fp64 2y agoIt's not an anti-virus, it's intended to monitor all and everything on the machine. You^WAn attacker might want to hide what you're doing and thus it runs at that level.
- geor9e 2y agoYou may be right but they do market it as "Next-Generation Antivirus (NGAV)"/"Antivirus with Threat Intelligence" probably because it's a word people are familiar with [CrowdStrike Falcon® Pro: Antivirus with Threat Intelligence](https://www.crowdstrike.com/products/bundles/falcon-pro/ https://www.crowdstrike.com/products/bundles/falcon-pro/)
- denisdamico 2y agoI understand that these "NGAV" must be in ring 0 (device driver) because they want to inspect more things directly. And be more protected there, avoiding being attacked. I'm not sure they can achieve this.