Comment by initplus
4 years ago
The feature needs to be implemented using some kind of regularly updated local database, rather than requiring a phone home every time.
4 years ago
The feature needs to be implemented using some kind of regularly updated local database, rather than requiring a phone home every time.
A program signature database, perhaps? We could even call it: antivirus! No, that’s a bad name...
In seriousness though, the problem with offline databases that are changed a lot is a problem antivirus programs always had: they need updating. You can’t have the “latest and greatest” protection if you don’t know about the newest threat. That’s probably what Apple is doing here: using a database on their end that they wouldn’t have to distribute to end users. It’s not the best way around it, but there isn’t really a “best” way.
I think it's an exaggeration to say that it's impossible to keep local AV databases up to date in a meaningful way.
Use compressed probabilistic data structures and ship minimal diffs to save bandwidth and storage; you can fall back to phoning home if there's a possibility of a collision with a known-bad hash. Apple's solved push messages at scale; it could piggyback an update mechanism on that, or use the techniques Dropbox uses to notify about file updates. It can do this at the OS level so there's no threat of a user process not being active to pull updates. And the check is already soft-failing (per the OP) so it won't break if the system is offline, so they're already not caring about threats that are so new, they were found while the computer was offline.
You need to solve a lot of timing diagrams and race conditions (and, if we're being snarky, maybe it's for the best that Apple isn't trying to do this!) but it should be doable.
A local database with a hash of every possible non-official Apple app in it? Sounds like something maybe only storage manufacturers will like.
The thing is, this is not a new security problem/challenge. It essentially can not be properly solved if you don't have a tightly controlled environment. If it's a general purpose environment, where you can't fully control what ends up running on it, this particular approach to "security" is pretty much doomed, no matter how you address it.
No, a database with the hash of every program you ever started on that computer. The Apple server should be contacted when a program is installed/run for the first time. And of course, the system software should handle network problems more gracefully. If everything "works" when offline, network problems should quicker lead to the offline behavior. There should be one daemon process which handles the signature checking which changes its behavior once requests to the server are not answered.
Pretty sure you just described how it already works. IIUC it only checks new hashes.
There are solutions for this like bloom filters etc. Google Safe Browsing system tackles a somewhat similar problem.