16 ms·
Well now we know those agencies are either morons or in on something we don’t know about.
by teeheelol 2y ago
Well now we know those agencies are either morons or in on something we don’t know about.
- hhh 2y agoWhat are they in on? The fact that bad actors are constantly targeting government infrastructure and that this kind of antimalware is a key part of the tools for defending against it?
- zozbot234 2y agoIf you run a properly designed operating system your anti-malware will not need ring-0 access. See mac OS which has now deprecated kexts altogether and will only load them if you explicitly turn off system integrity settings.
- the8472 2y agoI don't think this follows. Those vendors are third parties and reach for whatever they can get. Yes, if microsoft didn't allow kernel extensions then crowdstrike would run as SYSTEM in userspace, but that doesn't tell use whether they need it or not, it only tells us that they want it. Based on other comments it can run as kernel module or as eBPF filters on linux. So I guess to them it's a less invasive/more power tradeoff which they'll take whenever it's available.
- immibis 2y agoMac OS only doesn't need driver loading because they know exactly which hardware it runs on and link those drivers into the kernel. This is not applicable to Windows systems.
- teeheelol 2y agoWindows has DTrace and eBPF available. They chose not to use it.
- DougN7 2y agoI’m wondering if a bar DTrace or eBPF expression/filter could cause a blue screen. I’ll bet it could be done.
- fragmede 2y agoeBPF: > The program does not crash or otherwise harm the system. https://ebpf.io/what-is-ebpf/#verification https://ebpf.io/what-is-ebpf/#verification
- DougN7 2y agoThat’s a pretty big claim. If they have software that can guarantee a program will never crash it would be revolutionary, and could probably solve the halting problem.
- DougN7 2y agoGot my answer from the (currently top) answer here: https://news.ycombinator.com/item?id=41030352 https://news.ycombinator.com/item?id=41030352 eBPF can cause Linux kernel panic
- Kim_Bruning 2y agoThere is a perspective that the architecture of much anti-malware in general and this anti-malware in particular actually introduces new back doors where there weren't any before. So while anti-malware might have some merits, on balance much of it would be a detriment to security, from this perspective. People with this perspective are feeling spectacularly validated today! As often, it's wise to have a nuanced view of course.
- noduerme 2y agoI'm going with option 3, taking money from lobbyists without giving a f** about the consequences to national security.
- Ekaros 2y agoFrom national security perspective this sort of backdoor is extremely great idea as long as you think you are only one with the keys. Get to inject your own stuff any system with approval of some secret court... What is better than that?