4 ms·
You're right about this. Dynamic analysis instance is only useful if the application goes on to the relevant execution path, and static analysis is made quite d
by lgeek 13y ago
You're right about this. Dynamic analysis instance is only useful if the application goes on to the relevant execution path, and static analysis is made quite difficult by dynamic generation and a few other tricks.
However, if hidden behaviour (e.g. backdoors) is a concern, you can implement fine grained access control based on historical activity.
Anyway, my point is that for almost every problem in this area there's a solution. But I think the main issue is that there isn't more pro/consumer software for this kind of auditing / sandboxing. I guess that has to do both with user education (no interest) and industry being afraid of transparency.
- javajosh 13y agoActually, the only interesting behaviors all involve phoning home at some point. That's where a product like Little Snitch comes in handy - whatever it is (including OS updates), you can see what is accessing the outside world. It turns out this is actually pretty good way to detect bad stuff.
- astrodust 13y agoAccess control is going to be pretty hard to implement for something like EFI firmware, CPU microcode, or other forms of embedded software. As much as people whinge about sandboxing, I think it's a great idea and hope there's more of it. Apple's model for OS X where certain kinds of apps come with certain limitations, but there is a switch for people to opt out of those restrictions, is a great compromise. Safe for users with limited technical ability and wide open for those that need it.