lkml.org 
[lkml]   [2008]   [Aug]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [malware-list] TALPA - a threat model? well sorta.
    > I may be missing something about your suggestion, but I don't see how
    > this would work. Who does the chmod?
    >
    > Here's a sequence:
    >
    > - Application opens file
    > - AV scanner notified in some way without blocking
    > - Application reads file into memory

    The discussion has been about scanning on write.

    > - AV scanner determines file is infected.
    > - AV scanner chmod's file -- oops, too late.
    > - Application sends file over the wire to another machine with a more
    > vulnerable OS
    >
    > How would this be prevented?

    I don't think you can. In your case how does your AV scanner deal with
    the case where the application opens the file while another user has it
    open and the other user (or even other task with the same handle) changes
    the content possibly via mmap.

    Content may also directly be shared between users of a file using the
    mmap interfaces so your scan on read model is rather dysfunctional.



    \
     
     \ /
      Last update: 2008-08-13 23:35    [W:4.000 / U:0.392 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site