Hacker News Reader

Comment by Sirened | Hacker News Reader

this might be dumb, but why do we even use scanning in this day and age? Why not use kernel callbacks which notify when executables and files load for, say, the first time after being modified? Surely that'd be less race-y and waste less battery?

View on HN

Totally that's why Apple made endpoint security for security vendors. You can even pipe the events from the kernel with "sudo eslogger exec | jq" on the new macOS

https://developer.apple.com/documentation/endpointsecurity

What if the list of known malware changes to include a file already on the computer?

Sure, scan when definitions change, but as the author notes:

> Adload for a period of 8 seconds, once or so each day

They're scanning daily irrespective of signature updates, which makes no sense.

Can’t speak to Apple’s solution specifically, but most AV will have several signature updates in a day.

Anyway it's loaded when it's executed/used

They already do it, that's all the notifications when you first run an executable.

I just 'executed' an eicar test file in a terminal and nothing stepped in.

If you have XProtect active, it should step in if you try and open the EICAR file in a text editor. It may not if you try and “run” the file because it’s not an executable binary. Have you disabled Gatekeeper?

Right, which is why I'm baffled as to why they'd introduce scanning in 2022

In case of zero days, the AV can block the file before it exploits the kernel (or whatever other vector)

But this doesn't scan for zero-days, only for several major known malwares.

If you want to catch real zero-days, you have to approach things very differently. Do behavioral analytics, seeing what a process is up to and if it's poking into things it shouldn't.

Many leading AV suppliers like SentinelOne, Cylance, Crowdstrike do this and are very successful at it. However Apple is just starting in the antimalware market so I forgive them that they're just scanning for some known-bads for now.

I'm honestly not convinced any of these vendors are able to do anything about zero days either. They mostly seem to try and catch post exploitation and trying to detect "weird shit" happening post compromise (persistence, exfiltration, etc.). No AI/ML security product is going to stop someone from throwing a kernel exploit a disappearing into the night.

I'm sure it works a lot better when alerts result in a human looking at the issue.

A semi-legit app can later drop malicious code and run it. Think of a repackaged OSS project or pirated software that has an auto-updater built in.

which would be a new file, or one that has been modified since it was last run. which would be handled by the first run protection.

Browsers can generate machine code and make it executable (for e.g. V8), and so can any other app. So they could download it and put it into newly allocated executable memory pages.

It will catch an infected file that simply passes through the computer without being opened or executed.

What do you mean by "passes"? Unless it's a file on a removable medium or a remote fs, it has to be created, which requires opening it. Scanning removable media upon insertion and remote fses upon mounting is going to look mighty suspicious and, in the latter case, be cover for data exfiltration.

Reply on news.ycombinator.com