Self-repairing software tackles malware

Re:Self-repairing software tackles malware by xyzzy123 on Friday November 14, 2014 @05:27AM (#8606520)

In the general case, if you have deployed software which has to work in the face of an arbitrary, integrity damaging attack, you're going to lose.

That's because the attackers get to test their arbitrary code execution against your widely deployed countermeasure (e.g. AV with heuristics, EMET, whatever) until they win. You are the Maginot Line, and they are XYZ.

Funnily enough though, security through obscurity / unusual security measures do beat a lot of canned attacks.

Regehr does cool work on software validation though - it might do what it says. I hope he jumps into this thread and tells us what's actually up :)

[ Parent | on HN ]

Re:Self-repairing software tackles malware by JoeAltmaier on Friday November 14, 2014 @10:26AM (#8607532)

That sounds like giving up - no well-known defense can possibly work. So the attackers always win? I don't believe it.

[ Parent | on HN ]

Re:Self-repairing software tackles malware by unclebucknasty on Friday November 14, 2014 @08:15PM (#8610491)

I don't know about giving up, but it is very much cat and mouse. Over a long enough timeline, the bad guys will generally score, prompting another round of counter-measures.

So, it's not that the defenses can't possibly work. It's actually that they do, until they don't.

[ Parent | on HN ]