Re:StrongPity: Advanced Persistent Threat
by arkem on Monday October 10, 2016 @11:28AM
(#12677595)
This exists, it's not 100% effective because it's generally implemented as a UI flow change where less trusted binaries get scarier "are you sure?" popups and only the most obviously malicious files are blocked.
Edge has Microsoft SmartScreen[1], Chrome has CAMP[2] / Safe Browsing and Firefox has a system that also uses Google's data[3].
Edit: I missed that part where you were meant pro actively check against publisher provided signatures. The above systems do that only via looking at the code's embedded signature and indirectly via "wisdom of the crowds" style reputation.
Edge has Microsoft SmartScreen[1], Chrome has CAMP[2] / Safe Browsing and Firefox has a system that also uses Google's data[3].
[1] https://technet.microsoft.com/en-us/itpro/microsoft-edge/sec...
[2] https://www.cs.jhu.edu/~moheeb/aburajab-ndss-13.pdf
[3] https://wiki.mozilla.org/Security/Features/Application_Reput...
Edit: I missed that part where you were meant pro actively check against publisher provided signatures. The above systems do that only via looking at the code's embedded signature and indirectly via "wisdom of the crowds" style reputation.