News for hackers. Stuff that matters.

A comment on RedSun: System user access on Win 11/10 and Server with the April 2026 Update. Parent comment

Re:RedSun: System user access on Win 11/10 and Server with t... by labelbabyjunior on Thursday April 16, 2026 @02:41AM (#47789467)
They kind of have to, though.

If malware exploits a privilege escalation vuln, what's the AV going to do about it when it's reduced to the software equivalent of a UK police officer? Observe and report? Stop or I'll say "stop" again?

AV requires great power, which requires great responsibility. The second part is what often eludes AV developers.

[ Parent | on HN ]
Re:RedSun: System user access on Win 11/10 and Server with t... by EvanAnderson on Thursday April 16, 2026 @02:49AM (#47789515)
The OS should do the SYSTEM-level lifting and scanning processes and behavior analysis should run sandboxed as low priv processes. It would require a clearly defined API and I feel like MSFT was always reticent to commit, leaving AV manufacturers to create hacky nightmares.
[ Parent | on HN ]
Re:RedSun: System user access on Win 11/10 and Server with t... by labelbabyjunior on Thursday April 16, 2026 @02:52AM (#47789541)
Well the OS should do nothing—remember MS was taken to court over that—but better privsep on the part of the AV, sure.

Technically, Defender can be replaced with 3rd party AV.

[ Parent | on HN ]
Re:RedSun: System user access on Win 11/10 and Server with t... by bux93 on Thursday April 16, 2026 @04:51AM (#47790403)
Windows has separate SeBackupPrivilege for backup software, so why not for AV?
[ Parent | on HN ]
Re:RedSun: System user access on Win 11/10 and Server with t... by arcfour on Thursday April 16, 2026 @04:10PM (#47798836)
What would this privilege look like that is meaningfully different from SYSTEM while being properly protected from/able to deal with malware that has an LPE?
[ Parent | on HN ]
Re:RedSun: System user access on Win 11/10 and Server with t... by formerly_proven on Thursday April 16, 2026 @05:10AM (#47790550)
“Because the remediation component requires SYSTEM, the entire AV needs to run as SYSTEM and we have to unpack malware in the kernel”
[ Parent | on HN ]