Schneier on Security

Christoph Zurnieden • May 1, 2007 3:48 PM

Finjan may be part of the solution for links as a plugin for Firefox and IE.

Well, let’s take a look at http://securebrowsing.finjan.com/about.html

“Q. How Is Finjan SecureBrowsing Unique?
A. Finjan SecureBrowsing is based on patented behavior-based content inspection technology, which is the only solution that proactively detects both known and unknown web threats.”

“patented”, “only solution”, “proactively”, “both known and unknown”? Ok, that might be the result of the PR department. It goes on:

“This unique real-time technology sets SecureBrowsing apart from other products on the market, most of which rely on database updates. ”

“unique real-time technology”? OK, that might be still the rubbish of a PR-department. But the next sentence hit it:

“Finjan SecureBrowsing analyzes and understands the actual intent of the code on each web page”

Congratulations! You just proved Goedels Incompletenes Theorem wrong! Expect the Field Medal in your next mail!

But don’t be too disappointed if it is just a voucher for a room at the doghouse.

CZ

PS:
“Q. How does it work?
A. Finjan SecureBrowsing performs real-time code analysis of the current content on each of the rated web pages.”

Oh, I didn’t see it the first time, you solved the Halting Problem too?

Christoph Zurnieden • May 1, 2007 5:03 PM

@ Anonymous at May 1, 2007 04:26 PM

Learn from history, don’t repeat it!

Would you please explain what you mean by citing that adage?
I prefer simple words and short sentences for I do not speak English natively.

CZ

Christoph Zurnieden • May 2, 2007 4:35 PM

@Paeniteo

Using modern program analysis techniques, it is possible to achieve “conservative approximations” about a program’s intent.

Please define “conservative approximations” .

In other words: If you like, you can detect all malicious code.

No, you can’t, and even …

You will receive false positives, though.

… won’t help you, the set of malicious code is always larger than the set you are able to test.

The art is to reduce them to a manageable number while still retaining the conservativeness-properties of the approximation.

I do not know if a bit of Voodoo helps, but I must admit I never tried

Trivial approach (as proof-of-concept): Mark any code as malicious.

You can’t do that. The set of all machines you can use to “mark” is at most countable infinite, but the set of all code (if you take “code” as another name of “algorithm” of the form f(x)=y with x,y subsetequal \mathbb{N}) is the powerset and thus larger.

But there’s theory and there’s practice and it works in practice for a very small set of malicious code e.g. for virusscanners if you know the malicious code in advance. But what’s about something like that:

decode(password, encodedText){
/* results in malicious code */
return some_innocent_code xor password
}
variable var = “some_innocent_code”
variable pass = “password”
eval(decode(var))

You can’t detect such kind of malicious code with static tests, you have to run it. What do you do? Ban eval()? OK, but it’s something more sophisticated next time, so ban that too?

No, all of that antivirs and similar kinds of anti-malicious-code-software are nothing more than band-aids, necessary if you have not full controll over your software (this includes: binary-only software and restrictions in time and money).

Every COTS-software I stumbled upon had been developed by some more or less sophisticated Trial&Error methods with an EULA which basically says “this software may or may not work, but that’s your problem and no, you can’t get your money back”, so what can one expect?

No, these anti-malicious-code-programs exist because of the crappy software not because of the viruses.

Oh, that’s nice: an example for “conservative approximations” on thedailywtf.com today:
http://worsethanfailure.com/Articles/Poor-Mr-Gookin.aspx
Coincidence?

CZ