Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Malvuln – Malware Vulnerability Research

malvuln.com

Post reply on HN
Print view View original

11–16 of 16 posts

Re: Malvuln – Malware Vulnerability Research

#11

Post by magicconch »

__jf__ wrote: post #3

I like the fact that malware authors also seem to have trouble setting up a (secure) software development lifecycle. On the other hand if they were to threat model it, expoiting weaknesses in the agent does not cross a trust boundery so why bother. Imagine this would be different for their command and control infrastructure.

I’ve been trying to gain an understanding of threat modeling and one thing I’m struggling with is the definition of trust boundary - none of the descriptions I’ve read really clicked for me. Could you describe what it means?

Re: Malvuln – Malware Vulnerability Research

#12

Post by eugenekolo »

Minus the lulz, what is the point of this? It seems there's some possibility of remotely disabling malware... and then some more possibility of malicious piggy backing on already installed malware.

It's an interesting point that malware is typically poorly developed, but not sure what the point of this research is.

Re: Malvuln – Malware Vulnerability Research

#13

Post by spzb »

arghwhat wrote: post #10
spzb wrote: post #9

Earlier quoted context omitted.

It's possibly the lighting or the monitor but I don't have a problem with using any other websites in this configuration. The orange on gray has a 2.5:1 contrast ratio, the main body text (dark gray on gray) is 4.1:1, both of which are below the WCAG 2.1 AA accessibility minimum of 4.5:1

Orange on gray is not great, but that's only the headlines, which are also much larger which takes care of the worst problems. Based on those numbers it would appear to me that the main text is only slightly below perfect accessibility in the contrast department, so it shouldn't be a problem at all unless you have bigger problems.

The 4.5:1 ratio is a minimum not a perfect score.

Re: Malvuln – Malware Vulnerability Research

#14

Post by arghwhat »

spzb wrote: post #13
arghwhat wrote: post #10

Earlier quoted context omitted.

Orange on gray is not great, but that's only the headlines, which are also much larger which takes care of the worst problems. Based on those numbers it would appear to me that the main text is only slightly below perfect accessibility in the contrast department, so it shouldn't be a problem at all unless you have bigger problems.

The 4.5:1 ratio is a minimum not a perfect score.

The guidelines are for accessibility—minimum/recommended score would presumably be set so that someone with moderate vision disability would not at all be troubled.

That puts it way above what someone with good eyesight should need for comfortable reading.

I am mostly questioning it being hard to read, with good color/font rendering, for someone with good eyesight. Mine is pretty bad, and while ugly, it wasn't hard to read at all.

Re: Malvuln – Malware Vulnerability Research

#15

Post by SeriousM »

spzb wrote: post #9
arghwhat wrote: post #8

Earlier quoted context omitted.

Wait how? It's quite contrasty, plenty for comfortable readability, more so than many other sites. Even without my glasses (strong astigmatism and near sightedness), this is not a bad site. The font differs, as usual, significantly between platforms and browsers though. Is it possible that you have poor black levels and maybe an overly blurred font rendition? Astigmatism could also contribute here, as it leads to lin…

It's possibly the lighting or the monitor but I don't have a problem with using any other websites in this configuration. The orange on gray has a 2.5:1 contrast ratio, the main body text (dark gray on gray) is 4.1:1, both of which are below the WCAG 2.1 AA accessibility minimum of 4.5:1

I love HN for this, thank you for teaching me about contrast space in a vuln thread!

Re: Malvuln – Malware Vulnerability Research

#16

Post by __jf__ »

magicconch wrote: post #11
__jf__ wrote: post #3

I like the fact that malware authors also seem to have trouble setting up a (secure) software development lifecycle. On the other hand if they were to threat model it, expoiting weaknesses in the agent does not cross a trust boundery so why bother. Imagine this would be different for their command and control infrastructure.

I’ve been trying to gain an understanding of threat modeling and one thing I’m struggling with is the definition of trust boundary - none of the descriptions I’ve read really clicked for me. Could you describe what it means?

Trust boundaries make most sense when used in a data flow diagram, where for every flow between processes you ask yourself: “what could go wrong here?”

That question deserves additional attention if these flows reach processes controlled by different people, or are running under different privileges. That’s when they cross a trust boundary.

So a db server with local storage: single trust boundary around db and storage. But! But! What about the kernel!?

At this point it becomes important ask to another question: does the current abstraction level of the model help you think better about risk? It depends. Perhaps not if the db is part of a larger infrastructure with a global CDN, loadbalancers, webservers and some in memory caching layer.

Post reply on HN