Join the discussion
Write your take first — we'll ask for email only when you're ready to publish.
- Hacker News
- That's an impressively tight TOCTOU exploit!by wzdd
- Chalk another one up for "Antiviruses causing more problems than solving them".
They 'worked' when they initially just scanned files for known malicious signatures. Now they're the equivalent of a sledgehammer to a wall with all of the extra bells & whistles strapped to them.
Application whitelisting is the remaining way forward if you actually care about runtime security. That & locking every access point down to the bare minimum.
by x-complexity - I have lost faith in signature AV and CVE feeds for that matter. Attackers test against scanners until they come back clean and avoid known fingerprints. The only way I see to catch things now is behaviour diffing through static analysis.
Disclosure: I build Vigilance, which does this.
by fathermarz