Messages in this thread | | | Date | Thu, 14 Aug 2008 21:02:26 -0400 | From | Rik van Riel <> | Subject | Re: [malware-list] [RFC 0/5] [TALPA] Intro to alinuxinterfaceforon access scanning |
| |
On Thu, 14 Aug 2008 20:43:35 -0400 Theodore Tso <tytso@mit.edu> wrote:
> But Pavel is raising a good question. In Eric's proposed threat > model, he claimed the only thing that he was trying to solve was > "scanning". Just file scanning. That implies no root privileges, but > it also implied that he wasn't worried about malware running with user > privileges, either. Presumbly, that would be caught and stopped by > the file scanner before the malware had a chance to run;
You bring up a very good point - malware does not need to be stored on a filesystem in order to run or cause damage.
-- All rights reversed.
| |