Item — HN Reader

> There is a chance that true behavior based analysis can provide hints towards compromise and all the BPF tooling around that makes it a potentially promising lead, but no anti-virus I'm aware of is doing that while other auditing tools are.

Many Windows AV solutions feature behavioral analysis or sandbox. Even analyzing API calls in many cases is enough to identify something you are not really content with. For instance a simplistic image viewer which opens internet connections and fetches data from the net ... that sounds weird, right? Or calls exec() on some weird strings.

5 comments

> For instance a simplistic image viewer which opens internet connections and fetches data from the net ... that sounds weird, right?

It's interesting that this specific example would've also been caught with a sandbox and permission system. The surface covered between antimalware and sandbox/permssions aren't entirely the same but there's a lot that is shared.

Unpopular opinion perhaps, but I think desktop operating systems need to start including robust sandboxing and permission systems that are turned on by default. We've grown accustomed to desktop apps implicitly having access to everything, but if you think about it it's actually a bit strange that an app can just reach out and use your network, camera, etc as it pleases.

> Unpopular opinion perhaps, but I think desktop operating systems need to start including robust sandboxing and permission systems that are turned on by default.

Very much welcomed but both Windows and Linux were not created with this idea in mind and it entails quite an overhead. Under Windows I love using SandBoxie: https://github.com/sandboxie-plus/Sandboxie/issues Under Linux I use firejail but it's 100% user unfriendly ;-)

It's definitely not ideal as I'm probably going to get compromised through development tools / extensions I acquire or some Firefox exploit/ exploit in some open source tool I use. However, I've made a big effort on my system to put all proprietary software behind flatpak and customize the sandbox via flatseal.

Right now all the non-open source games I play are installed via flatpak. I also use Spotify and Discord which I've both put behind it. In the case of steam+spotify+some other games,they have no reason to be accessing any of my personal files and so they've been cut off accordingly. Discord has a slightly more permissive model but soon I won't need to give it any direct file system access thanks to recent electron changes (the file chooser should be able to selectively grant permission for files I want).

> I think desktop operating systems need to start including robust sandboxing and permission systems that are turned on by default.

https://qubes-os.org

> For instance a simplistic image viewer which opens internet connections and fetches data from the net

How does the AntiVirus know that /usr/bin/mfvwr is supposed to be an "simplistic image viewer"?

Is an simplistic image viewer that allows you to upload images to an image hoster not simplistic, anymore? And is there another category of semi-simplistic image viewers who are allowed to do that but not scan your home directory? What about mfvwr's new feature of finding all your image files?

Who tells the maintainer of the AV that mfvwr became non-simplistic in version 1.5-rc1 and a fully-fledged image manager in version 1.9-beta2?

What about forks that add new, non-simplistic features but keep the name of the binary to be a drop-in-replacement?

Yup, aware of those. Should probably clarify that I'm specifically trying to say that AFAIK there isn't any "anti-virus" that runs on Linux and is performing any level of behavioral analysis. There are a lot of _auditing_ tools that can allow detection of bad behavior like this, and you can alert / remediate based on that behavior though.

How could an AV possibly know that a program is supposed to be a “simplistic image viewer”? Besides, there are several legitimate reasons for even simple apps to fetch data from the net (including simply checking for updates).

I'm beyond convinced that any available “advanced behavioral analysis solutions” are way, way more trouble than anything but.

That they of detection in AV is really rare, because AV (rightfully) optimizes to an extreme for low false positives. Instead you just have slightly more complex signatures that look at syscall ordering or whatever. It's not nearly as powerful as it sounds.