I thought it was BSOD'ing on boot? I don't understand how this works. It auto-updates on boot? From the internet?
The BSOD is because one of the data files that they previously pushed is horribly mangled, and their driver explodes about it. But if you get lucky, the driver can receive an update notification on boot, connect to the separate file server, and finish overwriting the broken file on disk before the rest of the driver (that would crash) has loaded the broken file
And they do all of that very early on boot. The justification being that you don't want the antivirus to start booting after a rootkit has already installed itself
One might ask whether an anti-virus really needs to run inside the kernel, but the answer might reasonably be yes.
So, this isn't really what's getting on my nerves here. Just how it auto updates and get pushed throughout the organizations without a smidge of quality assurance. Smaller businesses... Sure, I get it. They don't have the resources to set up infra for this, but those... airliners... and hospitals. WTF. I read some org thinking they might not even be able to provide anesthesia. Seriously. What.
It is also possible to access hardware or any other low-level system resources from unprivileged user code, if its process has been granted appropriate access rights by the kernel.
This second solution requires more work, but it is much more secure as the access can be limited to only the strictly-required resources and system crashes become impossible.
The extreme of this solution is a micro-kernel operating system, but there is no need for extremes. Even in a Windows or Linux system you can use this method. You can have a very reduced privileged code in a driver or kernel module, which does nothing except providing access to the permitted resources. Then anything like attempting to access not mapped memory would happen in user code and it would crash only the user process, not the entire computer system.
Yeah, that's a great idea and not at all a huge attack vector.
It is not unreasonable to think that this sort of software could get compromised.
Apparently!
To be honest I prefer that over the #nix way of doing things. In Windows, you have exactly one file any given path can refer to - in Linux or Mac, it may depend on which directory's inode is seen as the root node by your process (e.g. chroot or container), or whether mounts are at play, or a file/directory got deleted and replaced by something else.
Particularly the last scenario keeps tripping me every once in a while.