Re:Proton.B: What this Mac malware does
by ecma_horse on Saturday May 13, 2017 @09:15PM
(#14333764)
The problem here is that the file is being scanned without the user even attempting to run it. A similar vector would be file previews (thumbnails) or indexing.
If the user is about to execute a malicious file anyway, then scanning it before only adds protection.
Re:Proton.B: What this Mac malware does
by danieldk on Sunday May 14, 2017 @02:18AM
(#14334501)
The problem is more that the standard model for applications is 'can access the whole filesystem, can write to the user's home directory'. The default model should change to sandboxing an application without any permissions.
If the user is about to execute a malicious file anyway, then scanning it before only adds protection.