Joanna Rutkowska ," detecting file infections was a waste of time".

Hello,

dw, I have read your answer.

Th way you described it, your password-protected system is either:
- a fully audited policy based protection
- very elaborate HIPS with password confirmation to each change

I think this is a super-uber-mega overkill. Not really practical for anything.

Mrk

 

Well, I haven´t read everything but I don´t believe that file signing is the solution. My personal solution is to use a HIPS, it´s very simple, if apps try to modify certain critical system areas, for no good reason, it´s----> Block and terminate!

 

McAfee post on their research blog (Posted by Nishad Herath)

Prevx post on their research blog (Posted by Marco Giuliani)

 

interesting first post

 

Gromozon (here as “Newtech, Inc. Panama”), one of the most notorious pieces of spyware out there, is digitally signed by Thawte (part of Verisign). This isn't the first time spyware has been signed by a certificate authority.
http://sunbeltblog.blogspot.com/2007/09/for-shame-thawte-trusts-gromozon.html

 

Exactly what i wrote on McAfee blog

 

You're right in that it is a form of unnecessary overkill, but the LCF handles the all of passwords so that I am not bothered with password approval. A program must prove itself correct in LCF before it can run and it must know the "dialect" of LCE as well; hence, virii and malware, especially polymorhic garbage, cannot run. LCF uses few system resources and very little RAM, but it's FUN!

BTW, years ago at OU PRG, Chris Strachey, Dana Scot, Rob Milnor and I needed a term which described translations from a combinatory with coersced types to another. The types coersced became known as "polymorhic," and the translations as "polymorphisms" Years later, the IDIOTS at Microsoft used incorrectly the term "extension" for the term "intension" à la Montague semantics! Each one of us who worked with heuristic logics, fairness semantics, etc., and programming systems representing these notions, would have never envisioned their applications to the WWW.

Dave