Reply to thread

Message

<blockquote data-quote="Trident" data-source="post: 1045290" data-attributes="member: 99014">Scanning can be achieved in few ways. It can be done by using a service (accessibility permission required as well as permission to draw over the app). The service should be light, as light as possible and also, battery optimisations for it should he disabled. Even though the service can check various data such as DNS records (location, time of registration and others) and take a decision this way, it will be unable to scan the content using heuristics the way it will be done on Windows. The service doesn’t have access to the browser cache. Hence, it can’t scan HTTPS traffic even if it performs MITM.The second way scanning could be done is via VPN tunnel in which case the product can easily intercept all traffic from anywhere. In this case it may be possible to implement some heuristic analysis, but it will be too expensive on battery life.HTTPS scanning is possible in this case.Third way is via autofill extension (Norton patent about to be implemented). In this case, the extension can read the page as soon as the keyboard is brought up and detect brand impersonation/phishing. On iOS the same can be done via Safari extension and ZoneAlarm is already doing it. HTTPS scanning is not needed in this case.There is also the option of replacing your default browser with a fictional one that both sends the link for real-time analysis in the cloud and brings up your real default browser. This is performed by Avast and it looks like Sophos does the same, at least on iOS.</blockquote>

[QUOTE="Trident, post: 1045290, member: 99014"] Scanning can be achieved in few ways. It can be done by using a service (accessibility permission required as well as permission to draw over the app). The service should be light, as light as possible and also, battery optimisations for it should he disabled. Even though the service can check various data such as DNS records (location, time of registration and others) and take a decision this way, it will be unable to scan the content using heuristics the way it will be done on Windows. The service doesn’t have access to the browser cache. Hence, it can’t scan HTTPS traffic even if it performs MITM. The second way scanning could be done is via VPN tunnel in which case the product can easily intercept all traffic from anywhere. In this case it may be possible to implement some heuristic analysis, but it will be too expensive on battery life. HTTPS scanning is possible in this case. Third way is via autofill extension (Norton patent about to be implemented). In this case, the extension can read the page as soon as the keyboard is brought up and detect brand impersonation/phishing. On iOS the same can be done via Safari extension and ZoneAlarm is already doing it. HTTPS scanning is not needed in this case. There is also the option of replacing your default browser with a fictional one that both sends the link for real-time analysis in the cloud and brings up your real default browser. This is performed by Avast and it looks like Sophos does the same, at least on iOS. [/QUOTE]

Verification