Re:New malware found on 30k Macs has security pros stumped
by tgsovlerkhgsel on Thursday February 25, 2021 @10:08PM
(#26271004)
As I said, exploits are out of scope for binary (i.e. executable) whitelisting and a malicious document could be opened even with binary whitelisting in place and would bypass it - but they're rare in practice.
It raises the bar for the attacker from "trick the user into running your malware" to "have a zero-day for your PDF reader + an escape for whatever sandbox the reader may be put into + fileless malware to actually do something useful after they gained initial execution on the target machine".
Again, not claiming it's unbreakable, but it stops the vast majority of attacks (allowing you to spend time defending against the rest instead of reimaging machines infected with commodity malware).
It raises the bar for the attacker from "trick the user into running your malware" to "have a zero-day for your PDF reader + an escape for whatever sandbox the reader may be put into + fileless malware to actually do something useful after they gained initial execution on the target machine".
Again, not claiming it's unbreakable, but it stops the vast majority of attacks (allowing you to spend time defending against the rest instead of reimaging machines infected with commodity malware).