9 ms·
Reminds me of the time I was looking after a SECURE system: One of the tasks was the daily update of the antivirus. So I would grab the blessed stick, insert it
by lolc 2y ago
Reminds me of the time I was looking after a SECURE system: One of the tasks was the daily update of the antivirus. So I would grab the blessed stick, insert it into the Internet-PC, and using FTP would download the latest antivirus update. Then I'd walk over to the SECURE system, insert the stick, and run the exe from the stick. There, system SECURED for today!
Norton, trust no other!
- elcritch 2y agoThat sounds like an ideal attack vector! Norton and other AV have elevated privileges with an opaque data format ready to be exploited.
- matrix2003 2y agoI’m of the opinion that 3rd party security software is malware. If it isn’t today, a future acquisition or enshittification ensures that it will be.
- b112 2y agoWhile true, the future is the future, and not entirely relevant. Or do you eschew using a fork, because in 12 weeks in will fall on the floor? Certainly, the problem is secret falls on the floor. The ones we can see can be handled. This problem even happens with brand names, with hardware. You buy a fridge, and a decade later go to buy another. Meanwhile, megacorp has been bought by a conglomerate, and brand name is purposefully crap.
- im3w1l 2y agoImagine, if you will a bed of gold embroidered and wrought with the most excuisite works. Above the bed however is a sharp sword suspended on a single hair of a horse's tail. Would you avoid relaxing on the the bed because the sword may fall and kill you at some point in the future?
- matrix2003 2y agoWhat’s wrong with the brand-name AV engines and security controls shipped with the OS? To me, it’s mostly just a lack of trust on the part of management.
- hermitdev 2y agoKaspersky is/was a brand-name AV. Look at what happened on their way out after the US ban...
- londons_explore 2y agoHave fun running your business with no third party software. You'll have to start by writing your own OS. Speaking of which... it's remarkable that Microsoft Windows probably has code from 50,000 people in it. Yet there haven't been any (public) cases of people sneaking malicious code in. How come?
- robertlagrant 2y agoIf Windows had malicious code in it, would we be able to tell the difference?
- bee_rider 2y agoSure, I’m sure somebody who is going to go through the effort of slipping malicious code into Windows would also make sure to do some QA on it. So it would be suspiciously unbuggy.
- mensetmanusman 2y agoEveryone should build their own security software?
- matrix2003 2y agoAll the major desktop OS have AV engines built by excellent teams. I do trust this more than McAfee or Norton. I also trust it not to take my machine down as much as CrowdStrike.
- mensetmanusman 2y agoYou trust native Windows security? I’m hoping it’s not, but what if a hospital’s decision looks like a choice between ransomware and a root system like crowd strike?
- elric 2y agoI believe that was exactly the other commenter's point.
- lolc 2y agoThe funniest part is that the update was an exe to be run from the USB stick. The one thing you should not ever do on any system. Unfortunately I wasn't prepared to broach the subject in a way that didn't have me say "you'd be safer without the AV". So I got nowhere.
- elcritch 2y agoOh even worse! Yeah, you likely wouldn't have made any headway.
- oneshtein 2y agoYou forgot that you need to use read-only media to transfer data from Internet-connected system to air gapped system, such as CD-ROM, or destroy writeable media after use in an air-gapped system.
- beAbU 2y agoIf the purpose of the attack is to bring something into the network, to e.g. destroy something (Stuxnet), or blink an LED that faces a window, then RO media will be pretty useless, and will probably cause a false sense of security.
- lucianbr 2y agoLikely that is the point. The initial process with the stick is security theater, and adding the RO requirement is just more theater. Both comments are sarcastic, imo.
- bflesch 2y agoThe read-only requirement makes sense because otherwise confidentiality of the airgapped system can be easily compromised (data extraction). If one's role is to only update AV on the airgapped machine then their data transfer to the airgapped machine should be only going into one direction.
- 1oooqooq 2y agoi think the joke requires knowledge that, if the exe is compromised, there's zero ways in hardware you can enforce read only mode on a USB stick, so it's probably done in software and is moot. and also, if it's air gapped, why even have an antivirus. ... for air borne ones?
- some_random 2y agoIt's incredibly easy to enforce read only on a USB stick when you destroy it after bringing it into a classified environment. As for antivirus, aren't we talking _right now_ about bringing potentially infected drives into an network?
- some_random 2y agoThat makes complete sense if your threat model is preventing data from leaving a secure network, assuming the USB drive stayed in the secure network or was destroyed after entering it.
- greener_grass 2y agoWhy would you need A/V on an air-gapped system?
- meowster 2y agoAir-gapped doesn't mean no data transfer. If there is data transfer, then viruses could get on it which will use up system resources.
- lolc 2y agoI didn't expand on that but actually that system was part of a global network; entirely separate from the Internet. There was MS Outlook installed on the terminal nodes. One can see how somebody could become nervous about not having AV on the nodes and come up with a "protection" scheme like the one I described.