[lkml]   [2008]   [Aug]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRE: [malware-list] TALPA - a threat model? well sorta.
> -----Original Message-----
> From: [mailto:malware-list-
>] On Behalf Of Alan Cox
> Sent: Wednesday, August 13, 2008 3:59 PM
> To: Eric Paris
> Cc:;; malware-
> Subject: Re: [malware-list] TALPA - a threat model? well sorta.
> > > I don't think you need to be blocking if you passed up a file
handle ?
> >
> > Without blocking and waiting how do you deny access? Maybe I needed
> > another thing they do. "They do file scanning and deny access to
> > files."
> Denying access is easy enough - chmod it or set an SELinux label on

I may be missing something about your suggestion, but I don't see how
this would work. Who does the chmod?

Here's a sequence:

- Application opens file
- AV scanner notified in some way without blocking
- Application reads file into memory
- AV scanner determines file is infected.
- AV scanner chmod's file -- oops, too late.
- Application sends file over the wire to another machine with a more
vulnerable OS

How would this be prevented?

Jon Press

 \ /
  Last update: 2008-08-13 23:27    [W:0.102 / U:7.960 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site