Full Disclosure mailing list archives
Re: AV scan on read vs write debate....
From: Carlos P <charly_en_el_trabajo () yahoo com>
Date: Mon, 30 Jun 2014 07:40:44 -0700
I agree with you, but from the outside, running "macintosh virus list" on google makes me share their point of view, why should I burn cycles for such a tiny threat? They are right if they only think in terms of their own platform. I would concentrate my effort in solidarity, perhaps you can agree on a lighter read scanning or an scheduled one. Yes, windows virus landscapes sucks, I wish a had a mac, please help me. Show them that linux share the same scenario with mac and that you run AV in linux despite the low threat. My only doubt is about word macro virus in macintosh: http://support.microsoft.com/kb/187243 (i see it in spanish) Hope it helps you. Carlos Pantelides @dev4sec http://seguridad-agile.blogspot.com/ El día lunes, 30 de junio de 2014 3:19, Reindl Harald <h.reindl () thelounge net> escribió: Am 30.06.2014 01:38, schrieb Exibar:
I see a war a-brewing in our Macintosh area, they're pushing for AV scanning on Write only... I'm pushing back, hard and winning so far.... They don't seem to get it no matter how much they say they understand the dangers,
they're still stuck in the world where "Mac viruses just don't
exist", and apparently they don't care if they have a Windows virus dormant on their machines either.... they claim they have a huge performance improvement with scan on read turned off... It always comes back to performance in their argument.... Does anyone have any white papers or any links or even any off the cuff thoughts that I can bring to these folks that will help prove my point that only having scan on write is a *very* bad idea and a huge security hole?
easy - ask them what the scan of a download helps if it's executed later while due download there was no matching signature first comes the malware and then the signature to detect if the dumb folk scan only once while store the malware on a central fileserver that will greatly multiply damage everytime a client opens the file with no scanning again but if you are talk with Apple "the OS is secure" priests forget it, they are learning resistent _______________________________________________ Sent through the Full Disclosure mailing list http://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/ _______________________________________________ Sent through the Full Disclosure mailing list http://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/
Current thread:
- Re: AV scan on read vs write debate.... Yoann Gini (Jul 01)
- Re: AV scan on read vs write debate.... Joe Brown (Jul 01)
- Re: AV scan on read vs write debate.... Reindl Harald (Jul 01)
- Re: AV scan on read vs write debate.... Victor Aguilar (Jul 05)
- Re: AV scan on read vs write debate.... Reindl Harald (Jul 01)
- <Possible follow-ups>
- Re: AV scan on read vs write debate.... Carlos P (Jul 01)
- Re: AV scan on read vs write debate.... Joe Brown (Jul 01)