Defensive computing: Difference between revisions

Revision as of 07:58, 23 October 2020

Revision as of 00:34, 27 February 2023

Line 18:

The other side of anti malware is that it contains serious vulnerabilities itself.<ref name="eight">[https://googleprojectzero.blogspot.com/2016/06/how-to-compromise-enterprise-endpoint.html https://googleprojectzero.blogspot.com/2016/06/how-to-compromise-enterprise-endpoint.html] Security Products Contain Critical Vulnerabilities</ref> A malware could use vulnerabilities of anti-malware to launch malicious code.

Anti-malware works by scanning files ana network connections for known signatures. Those signatures can never be up to date. To be able to scan network connections, encryptions (SSL/TLS) need to be bypassed or even broken by anti-malware software. When monitoring emails anti-malware opens all attachments for analysis, a bug in this scanner can be used as a starting point for malware. Attackers just need to send malware to a mailbox that is scanned automatically.

It is questionable if malware scanners are even useful at all. Ex Mozilla developer Rober O'Callahan writes in his blog that anti malware software should be disabled (except windows defender)<ref name="nine">[https://robert.ocallahan.org/2017/01/disable-your-antivirus-software-except.html https://robert.ocallahan.org/2017/01/disable-your-antivirus-software-except.html] Disable Your Antivirus Software (Except Microsoft's)