lkml.org 
[lkml]   [2008]   [Aug]   [14]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRE: [malware-list] TALPA - a threat model? well sorta.
From
Date
Jonathan Press wrote on 14/08/2008 13:03:40:

> > Hm, maybe by implementing a facility with which a client can register
> it's
> > interface usage intent? Something like:
> >
> > register(I_HAVE_NO_INTEREST_IN_CONTENT);
> > register(I_WANT_TO_EXAMINE_CONTENT);
> >
> > All former ones would run first because they only want to have the
> > opportunity to block and do something unrelated to file content (like
> > HSMs), and later group would be ran last since they want to examine
> the
> > content.
> >
> > Ordering inside those two groups is not important because I don't see
> how
> > a model other than restrictive can make sense with content security
> > scanning.
>
> I'm not sure I understand why "interest in content" means not blocking,
> and vice versa. However, I think this is a good idea if made more
> explicit, i.e.:

Small misunderstanding because both would block. If you go back to Ted's
original post I was replying to, he was worried about how would
anti-malware scanning interact with HSM since both may end up using the
same interface. HSM, as far as I understand it, needs to block on open and
"plant" the right file in place, while anti-malware also needs to block
and examine the right content. That is why ordering matters, anti-malware
needs to run after the content is put in place. And that is what my idea
solves (slight overstatement since I spent only seconds on it) by
separating them in two groups of clients. First which has no interest in
content and second which does.

--
Tvrtko A. Ursulin
Senior Software Engineer, Sophos

"Views and opinions expressed in this email are strictly those of the
author.
The contents has not been reviewed or approved by Sophos."


Sophos Plc, The Pentagon, Abingdon Science Park, Abingdon,
OX14 3YP, United Kingdom.

Company Reg No 2096520. VAT Reg No GB 348 3873 20.



\
 
 \ /
  Last update: 2008-08-14 14:31    [W:0.152 / U:0.160 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site