Reply to thread

Message

<blockquote data-quote="ForgottenSeer 92963" data-source="post: 968948">That is my point also <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite109" alt=":)" title="Smile&nbsp; &nbsp; :)" loading="lazy" data-shortname=":)" /> but nearly everything you download from the internet or mail lands in user land. User land processes are allowed to modify other user land processes (called a side by side infection*). Therefor it is better for a security program to have higher rights, because lower rights objects can&#039;t modify higher rights objects.After XPoff (forgot his exact nickname) made behavioral protection program Cyberhawk blind (decades ago in a Poc) by unhooking its userland controls, the general consensus is that security should be enforced at kernel level (DanB has a point with his critism). it is not the fact that it is &quot;game over&quot; when intrusions reach system level, but lower rights objects can not touch higher level objects and more important can&#039;t disable them (with a side-by-side attack in user land).* This is why Microsoft and Google started to render webpages in untrusted processes (pushing them to lower rights processes and preventing them to infect processes running with medium rights).&nbsp; Same applies for opening PDF&#039;s in the the browsers and running Windows mail app in a lower rights sandbox.</blockquote>

[QUOTE="ForgottenSeer 92963, post: 968948"] That is my point also :) but nearly everything you download from the internet or mail lands in user land. User land processes are allowed to modify other user land processes (called a side by side infection*). Therefor it is better for a security program to have higher rights, because lower rights objects can't modify higher rights objects. After XPoff (forgot his exact nickname) made behavioral protection program Cyberhawk blind (decades ago in a Poc) by unhooking its userland controls, the general consensus is that security should be enforced at kernel level (DanB has a point with his critism). it is not the fact that it is "game over" when intrusions reach system level, but lower rights objects can not touch higher level objects and more important can't disable them (with a side-by-side attack in user land). * This is why Microsoft and Google started to render webpages in untrusted processes (pushing them to lower rights processes and preventing them to infect processes running with medium rights). Same applies for opening PDF's in the the browsers and running Windows mail app in a lower rights sandbox. [/QUOTE]

Verification