News for hackers. Stuff that matters.

A comment on Windows Defender is enough, if you harden it. Parent comment

Re:Windows Defender is enough, if you harden it by XorNot on Sunday March 06, 2022 @06:59PM (#30582527)
No way to tell if it's changed if you don't store a hash as metadata.

Something like ZFS where hashing is baked into the cost of the FS operation could optimise this.

[ Parent | on HN ]
Re:Windows Defender is enough, if you harden it by londons_explore on Sunday March 06, 2022 @07:14PM (#30582635)
But if you control the kernel and all the code that runs in the kernel, you know exactly who has written to disk and when. So if nobody wrote that data, then it hasn't changed.
[ Parent | on HN ]
Re:Windows Defender is enough, if you harden it by wombatpm on Sunday March 06, 2022 @08:10PM (#30583001)
Removable media, network drives, low level disk operations? I don't think you can know with 100% certainty on a window machine
[ Parent | on HN ]
Re:Windows Defender is enough, if you harden it by wingmanjd on Sunday March 06, 2022 @08:06PM (#30582960)
Would the currently running OS know if another OS changed the file?
[ Parent | on HN ]
Re:Windows Defender is enough, if you harden it by Siira on Monday March 07, 2022 @03:51AM (#30585578)
Can assume a single OS.
[ Parent | on HN ]