0

As I know, for antiviruses the VRAM is a blindspot, so casual Windows users like me can't do much about it. They have an antivirus, which doesn't even search for malware in VRAM.

What's the answer for this? "Is it very, very rare, so we just ignore it."? Or they can't do anything about it?

4
  • 1
    Whatever you are trying to point out with the image - it is just a statement taken out of context and the link in it is cut short so that one cannot follow it. All I could find about is some claims of a PoC from end of 2021 - but then nothing more. See bleepingcomputer.com/news/security/… . Also note that antivirus don't and never did offer 100% protection against all kind of attacks, they are just one tool in a broader security strategy. Jul 3, 2022 at 1:57
  • Are you aware that this is very, very new? A proof-of-concept was only released a year ago. So, not only is it "rare" it hasn't been a realised threat yet. Give anti-virus companies time to experience such malware to then know how to defend against it.
    – schroeder
    Jul 3, 2022 at 7:53
  • Jellyfish published in 2015.
    – kiec00
    Jul 3, 2022 at 10:50
  • And from 2015 and last year, there has been 0 references to malware in VRAM. Anti-virus companies don't defend against theoretical attacks, but defend against what is seen in the wild. In 2015 and 2021, they were PoCs, not weaponised attacks.
    – schroeder
    Jul 3, 2022 at 21:09

1 Answer 1

0

Most if not all commercially available AVs are useless against new or advanced malware anyways because they look for signatures. Many nowadays employ behavioral analysis and sandboxing but from my experience both are not really effective and depend on the user being smart enough which is too often not the case.

Speaking of your question: if a new strain of malware decides to store part of its payload in VRAM, what do you think AV should be looking for? What's stored in VRAM cannot be executed directly anyways, it's not RAM, so whatever data is stored in VRAM must be parsed or acted upon which AV knows nothing about.

VRAM is not the only thing AVs don't scan. They also don't scan hardware devices firmware/ROMs, your computer BIOS (EFI) and all of them can contain malware as well.

If you're really paranoid you shouldn't use the x86 platform which is choke full or proprietary things and remote management features running outside of your OS (Intel ME/AMD PSP), so nothing in your OS can even know about it.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .