On Sun, Aug 17, 2008 at 6:58 PM, <david@lang.hm> wrote:
That is called a HIDS. Network form even has central databases of
hashes of applications that should be on the machine. Its tampering
detection.
Exactly why I am saying the lower level needs work. Everything the
file system driver can process needs to go to Hids for most effective
detection of tampering. Ok not 100 percent but the closest to 100
percent you can get. 2 causes of failure are hash collisions that
can happen either way and data hidden outside the drivers reach. All
execute data leading into the OS will be covered by a TPM chip in time
so that will only leave non accessible data not a threat to current
OS.
With out a clear path were user space tools can tell that its the same
files they have no option bar to mark the complete lot dirty.
Hands are tied that is the issue while only in the inode and vfs
system. To untie hands and allow most effective scanning the black
box of the file system driver has to be opened.
You missed it part of that was a answer to Ted saying that we should
give up on a perfect system due to the fact current AV tech fails
there is other tech out there that works.
In answer to the small enough set of files idea. The simple issue is
that one time cost of black list scanning gets longer and longer and
longer as the black list gets longer and longer and longer. Sooner
or latter its going to be longer than the amount of time people are
prepared to wait for a file to be approved and longer than the time
taken to white list scan the file by a large margin. It is already
longer by a large margin to white list scanning. CPU sizes not
expanding as fast on Linux kind brings the black list o heck problem
sooner. Lot of anti-virus black lists are embeding white lists
methods so they can operate now inside the time window. The wall is
coming and its simply not avoidable all they are currently doing is
just stopping themselves from going splat into it. White list methods
will have to become more dominate one day there is no other path
forward for scanning content.
Most common reason to need to be sure disks are clean on a different
machine is after a mess. Anti-Virus and protection tech has let you
down. Backups could be infected before restoring scanning those
backups to sort out what files you can salvage and what backups
predate the infection or breach. These backups of course are
normally not scanned on the destination machine. Missing anything
scanning those backups in not acceptable ever.
By the way for people who don't know the differences. TPM is a HIDS
hardware support it must know the files its protecting exactly.
White list scanning covers a lot more than just HIDS. White List
scanners that knows file formats themselves sorts the files by unknown
format, damaged ie not to format like containing buffer oversize and
the like, Containing executable parts unknown, Containing only
executable parts known safe and 100 percent safe. First 3 are blocked
by while list scanners last 2 are approved. Getting past a white
list scanner is hard. White list scanning is the major reason we
need all formats to documents used in business so they can be scanned
white list style. White List format style does not fall pray to
checksum collisions. Also when you have TB's and PB of data you don't
want to be storing damaged files or viruses. Most black list
scanners only point out viruses some viruses so are poor compared to
what some forms of white list scanning offer of trust able clean and
undamaged.
Peter Dolding
--
