Slashdot Mirror
How To Guarantee Malware Detection
itwbennett writes "Dr. Markus Jakobsson, Principal Scientist at PARC, explains how it is possible to guarantee the detection of malware, including zero-day attacks and rootkits and even malware that infected a device before the detection program was installed. The solution comes down to this, says Jakobsson: 'Any program — good or bad — that wants to be active in RAM has no choice but to take up some space in RAM. At least one byte.'"
Not a fair comparison. Malware usually does what it's supposed to.
The hard part is actually finding it.
That reminds me of a signature I've seen around here (Sorry, I don't remember who was using it)
cat /dev/ram | strings | grep llama
OMG, my RAM is full of llamas!
Reminds me of Murphy's 7th law - "Should you ever idiot proof anything God will make a better idiot."
While it might be true that any application will take up at least a byte of memory, there is no reason malware couldn't masquerade as another binary down to the exact number of bytes.
Oh see he didn't finish explaining.
Any program that wants to be resident has to occupy at least one byte of RAM. And that byte should include the Evil Bit, which all malware should set. Then your anti-virus program just checks the Evil Bit and problem solved!
The enemies of Democracy are
Wrong! Abstinence is the one and only preventative answer!