[lkml]   [2008]   [Aug]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRE: [malware-list] TALPA - a threat model? well sorta.
    > -----Original Message-----
    > From: [mailto:malware-list-
    >] On Behalf Of Alan Cox
    > Sent: Wednesday, August 13, 2008 3:59 PM
    > To: Eric Paris
    > Cc:;; malware-
    > Subject: Re: [malware-list] TALPA - a threat model? well sorta.
    > > > I don't think you need to be blocking if you passed up a file
    handle ?
    > >
    > > Without blocking and waiting how do you deny access? Maybe I needed
    > > another thing they do. "They do file scanning and deny access to
    > > files."
    > Denying access is easy enough - chmod it or set an SELinux label on

    I may be missing something about your suggestion, but I don't see how
    this would work. Who does the chmod?

    Here's a sequence:

    - Application opens file
    - AV scanner notified in some way without blocking
    - Application reads file into memory
    - AV scanner determines file is infected.
    - AV scanner chmod's file -- oops, too late.
    - Application sends file over the wire to another machine with a more
    vulnerable OS

    How would this be prevented?

    Jon Press

     \ /
      Last update: 2008-08-13 23:27    [W:0.039 / U:26.880 seconds]
    ©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site