Timeline for Has it been mathematically proven that antivirus can't detect all viruses?
Current License: CC BY-SA 4.0
21 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jan 29, 2019 at 3:13 | comment | added | Nat | The core idea in this answer seems correct, though the framing is off - specifically, it looks like this answer is to a slightly different question, but misframed to match this question. The problem is that this question is about how to analyze a program to determine iff it's a virus based on its specification, e.g. a binary of it, which this answer doesn't even attempt to address. However, I guess that this answer's kind of a frame-challenge in that the reason it doesn't attempt to address the question is that it proposes a better solution than anti-virus: run-time-management. | |
| Jan 25, 2019 at 19:57 | comment | added | Aaron | @R.. I want to reiterate, you are on the right track. My comments are not meant otherwise. Better access controls would make blocking malware way better. What you propose is a huge improvement over modern antivirus. The points being brought against it are merely that, in this specific Q&A, the question asker very specifically asked about mathematical proofs about whether every single possible malware could be detected. We need assume that means with minimal false positives, otherwise the answer is "block everything." So, when "p != q" and "p = q" are both true, our comments suggest it can't. | |
| Jan 25, 2019 at 19:46 | comment | added | Aaron | ... my point is, the exact same, the very same, the same same action can be both malicious and not malicious. Not in the same place at the same time, of course. But at a different place, or a different time. Maybe even on the same computer, with the same access controls defined, doing the same action (same file, same modification, etc.), but Susy considers it a good thing, then a half hour later when her brother uses the PC he considers it malicious. Or Susy considers it malicious at time X but not at Y ("play-me-a-tune-app" is cool during free time, but can easily be used as malware) | |
| Jan 25, 2019 at 19:41 | comment | added | Aaron | @R.. wrote "choosing the suitable access control..." If it is that simple, then you should write up a paper on it. Because, with the specific example I provided, if you actually can write such an access control or definition to differentiate between "Action A is ok" and "(the very exact same) Action A is malicious", then you would become a millionaire. No, better yet, because you would have completely defied logic itself and discovered an entirely new kind of logic to make that possible, you may well become a billionaire, or be able to defy physics with the new logic and become superman. | |
| Jan 25, 2019 at 15:59 | comment | added | R.. GitHub STOP HELPING ICE | @forest: Malware is just a program that does something you don't want it to do. | |
| Jan 25, 2019 at 4:37 | comment | added | forest | This answer explains how to prevent unauthorized programs from running, not viruses in particular. The question is about malware specifically. | |
| Jan 23, 2019 at 23:56 | comment | added | R.. GitHub STOP HELPING ICE | BTW aside from tone, my answer here is basically the same as James_pic's answer which appeared later and isn't so ridiculously downvoted by people who haven't read the comments. | |
| Jan 23, 2019 at 23:51 | comment | added | R.. GitHub STOP HELPING ICE | @Aaron: For the nth time, that is a matter of choosing the suitable access control model/defining malicious. | |
| Jan 23, 2019 at 21:07 | comment | added | Aaron | While good, it will not prevent all viruses. @Ray allowed you to side-step the issue with that specific example, but that will not always be the case. What about where the exact same software can be viewed in one use case as useful but another use case as malicious? Consider software that allows remote control of your computer, written and used initially for good. Then others abuse it. The gamer calls it awesomeware when his buddy gets him XP while he sleeps, and their neighbor considers it malware when their enemy blasts obnoxious white-noise. One person's trash is another's treasure. | |
| Jan 23, 2019 at 20:36 | comment | added | R.. GitHub STOP HELPING ICE | @Joshua: That depends on the nature of the interpreter. It most certainly can't be exploited on an interpreter that permutes physical and virtual addresses via a strong cryptographic cipher (without also breaking the cipher), or just one that throttles memory access in a suitable way. If your physical machine is subject to such bugs, then your access control must include measures to preclude access to the mechanisms of triggering those bugs. This is not rocket science, people. | |
| Jan 23, 2019 at 20:34 | comment | added | R.. GitHub STOP HELPING ICE | @Ray: The access control allows write/delete on one set of files and not on another. This is how normal filesystem permissions work. | |
| Jan 23, 2019 at 20:32 | comment | added | R.. GitHub STOP HELPING ICE | @ulidtko: Yes. Formal methods people do stuff like that all the time with verification of logic designs. But it depends on a formalization of your rules for what's allowed and what's not. Lots of people don't even have in mind a model for what is and isn't malicious, and expect a machine (or another person) to read their mind and apply social norms from inside it to make the determination. Of course that seems unlikely to happen. | |
| Jan 23, 2019 at 20:09 | comment | added | Ray | Suppose you have two programs: a legitimate program that cleans up old temporary files that match certain criteria, and a malware program that deletes important files that match certain criteria. How do runtime access controls reliably distinguish between these cases? | |
| Jan 23, 2019 at 18:24 | comment | added | ulidtko | Can you prove the presumed existence of that suitable runtime environment ? | |
| Jan 23, 2019 at 18:21 | comment | added | Joshua | Unlike spectre (so far), rowhammer can be exploited through an interpreter. | |
| Jan 23, 2019 at 17:13 | comment | added | R.. GitHub STOP HELPING ICE | @Joshua: The runtime environment can fully detect or prevent that. For example by running the program under an interpreter. See "suitable access control model". In this case the hardware is buggy and allowing any direct low-level access to that part of the system (making requests to the memory bus) is insufficient access control. | |
| Jan 23, 2019 at 17:02 | comment | added | Joshua | Shall I get out the virus that uses rowhammer to overwrite the kernel security checks? | |
| Jan 23, 2019 at 16:59 | history | edited | R.. GitHub STOP HELPING ICE | CC BY-SA 4.0 |
added 354 characters in body
|
| Jan 23, 2019 at 16:55 | comment | added | R.. GitHub STOP HELPING ICE | The no is a direct answer to the question subject line. I'll elaborate. | |
| Jan 23, 2019 at 16:41 | comment | added | schroeder♦ | "No" what? Not it has not been proven? But read the other answers that show that it has been proven? A very confusing start to your answer. Can you clarify? | |
| Jan 23, 2019 at 16:24 | history | answered | R.. GitHub STOP HELPING ICE | CC BY-SA 4.0 |