Re: [malware-list] TALPA - a threat model? well sorta.

[Helge Hafting <helge.hafting@aitel.hist.no>]

Press, Jonathan wrote:
>> -----Original Message-----
>> From: malware-list-bounces@dmesg.printk.net [mailto:malware-list-
>> bounces@dmesg.printk.net] On Behalf Of Peter Zijlstra
>> Sent: Friday, August 15, 2008 6:37 AM
>> To: Helge Hafting
>> Cc: linux-kernel@vger.kernel.org; malware-list@lists.printk.net;
>>     
> hch@infradead.org;
>   
>> andi@firstfloor.org; viro@ZenIV.linux.org.uk;
>>     
> alan@lxorguk.ukuu.org.uk; Arjan van
>   
>> de Ven
>> Subject: Re: [malware-list] TALPA - a threat model? well sorta.
>>
>> On Fri, 2008-08-15 at 12:07 +0200, Helge Hafting wrote:
>>     
>>> It seems to me that this "scan on file open" business is the
>>> wrong way to do things - because it reduces performance.
>>>
>>> If you scan on file open, then your security sw is too late and
>>> getting in the way.
>>>       
>
> The problem is that you have to account for the cases where the malware
> made it onto the system even if you were trying to catch it ahead of
> time.  For example:
>
> - Administrator turns off or reduces AV protection for some reason for
> some period of time.  It happens all the time.
>   
Everything is "dirty" again when AV sw restarts.
> - New infection makes it onto the machine before the signatures have
> caught up with it.  This also happens.  There is an ongoing PR race
> among AV vendors about who was faster on the draw to get out signatures
> to detect some new malware.  The fact that this race exists reflects
> that reality that there is some window during which new malware will
> make it onto some number of machines before the scanners catch up.
>   
And when new signatures arrive, everything is dirty again. Well, you can 
optimize
and say that everything only need to be checked with the new signatures,
since they passed the old ones already. Maybe that helps performance a 
little.

The "clean" concept works fine, just make sure dirtying happens in all these
extra cases.


Helge Hafting