On Tue, 19 Feb 2008 21:14:46 EST, Jon Oberheide said:
> I'm not sure how n.runs implements their system, but our system uses Xen
> VMs for the detection engines. When it is determined that a piece of
> malware has exploited the AV software (through non-whitelisted process
> spawning, any network activity, or other unexpected system behavior),

That is, of course, assuming you don't get blue-pilled before you realize that
it's been exploited. Running in a VM helps a *lot*, but it does *not*
guarantee that nothing will get loose (and notice that a clever malware can
simply redpill detect that it's running in a VM, and do nothing malicious until
it detects that it's on a real machine - malware has a *long* tradition of
detecting and evading if it's running under a debugger...

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.8 (GNU/Linux)
Comment: Exmh version 2.5 07/13/2001

iD8DBQFHvF82cC3lWbTT17ARAjr1AKC42BzHR6UfeSjvuHcaXB2nlrj5MACfQ78k
MaJtIWSdjS83ApwHWrKlaus=
=57kD
-----END PGP SIGNATURE-----

[ reply ]