Hi all, my name is Josep! Glad to meet you all.

New Members Introduction
15 Replies 2,363 Views
Thread details
Region
Europe
Age group
51 and over
Last known PC infection
Over 5 years ago or never
Favorite web browser
Google Chrome
Favorite mobile OS
Android
Hobbies
    • Computers and technology
    • Malware and threat analysis
    • Travel
Victor M said:
Welcome to MT ! Good luck on your venture !

EDIT: Your software is kind of like Comodo. They have what they call 'autocontainment'.
Click to expand...
Hi Victor, yes, the principle behind our product is somewhat similar to Comodo's auto-containment rules (Rules For Auto-Containment, Sandbox Security Software | Comodo Client Security), but our approach is more fine-grained and comprehensive. Let me substantiate my claim :)

1. Our product does not check a file reputation when an executable file is launched, but when a process memory space is created by the operating system and also for each image loaded such process' memory space continuously, not just at launch time. This catches the very common malware scenarios of i) injected DLLs on the fly and ii) the loading of compromised system DLLs. Comodo's approach misses this.

2. We do not take just a go/no-go decision at launch time, but continuously monitor the process (if a malicious DLL is loaded/injected, that process will be demoted).

3. Running an application in 'containment' as Comodo does prevents it from accessing the file system, for instance, which often would render that application useless. For instance, imagine a free (digitally unsigned) game downloaded from the web. It needs to store some cache data and likely store some game status info to your hard drive. If you try to run it in Comodo 'containment', it will likely crash and/or not keep your game session history. Our real-time sandboxing is more fine-grained, for instance allowing 'contained'/non-trusted processes to create (non-executable) files on a file system but, mot importantly, not allowing modification of any files it does not 'own' (this required quite a complex implementation in the filesystem mini-filter driver, but it works!).

If case it helps, you may want to take a look at a technical blog we posted in our website that explains all this in a bit more detail: Technical Blog: The FinalAV Security Framework | FinalAV Security

Anyway, we do not claim to be the only ones attempting this approach, but certainly each product has its own techniques and nuances, and we think our design choices should be valuable to some people 🙏
 

Recently browsing

Members who viewed this thread in the last 5 minutes

You may also like...

Back
Top