Hacker News Reader

Comment by jokethrowaway | Hacker News Reader

They already do it, that's all the notifications when you first run an executable.

I just 'executed' an eicar test file in a terminal and nothing stepped in.

If you have XProtect active, it should step in if you try and open the EICAR file in a text editor. It may not if you try and “run” the file because it’s not an executable binary. Have you disabled Gatekeeper?

Right, which is why I'm baffled as to why they'd introduce scanning in 2022

In case of zero days, the AV can block the file before it exploits the kernel (or whatever other vector)

But this doesn't scan for zero-days, only for several major known malwares.

If you want to catch real zero-days, you have to approach things very differently. Do behavioral analytics, seeing what a process is up to and if it's poking into things it shouldn't.

Many leading AV suppliers like SentinelOne, Cylance, Crowdstrike do this and are very successful at it. However Apple is just starting in the antimalware market so I forgive them that they're just scanning for some known-bads for now.

I'm sure it works a lot better when alerts result in a human looking at the issue.

I'm honestly not convinced any of these vendors are able to do anything about zero days either. They mostly seem to try and catch post exploitation and trying to detect "weird shit" happening post compromise (persistence, exfiltration, etc.). No AI/ML security product is going to stop someone from throwing a kernel exploit a disappearing into the night.

A semi-legit app can later drop malicious code and run it. Think of a repackaged OSS project or pirated software that has an auto-updater built in.

which would be a new file, or one that has been modified since it was last run. which would be handled by the first run protection.

Browsers can generate machine code and make it executable (for e.g. V8), and so can any other app. So they could download it and put it into newly allocated executable memory pages.

It will catch an infected file that simply passes through the computer without being opened or executed.

What do you mean by "passes"? Unless it's a file on a removable medium or a remote fs, it has to be created, which requires opening it. Scanning removable media upon insertion and remote fses upon mounting is going to look mighty suspicious and, in the latter case, be cover for data exfiltration.

Reply on news.ycombinator.com