Skip to Content
Uncategorized

Norman Sandbox Won’t Work

Scott Fulton at BetaNews just published an uncritical puff piece about computer-security firm eEye’s new antivirus product, Blink.

The main thrust of the article is that Blink will be able to find and detect brand-new viruses by running suspect programs in a virtual machine and observing their behavior:

The Norman SandBox, Maiffret described, is a fast, stand-alone virtual machine, which tests the code of executables to see whether they’ll do interesting things, such as changing the Windows System Registry startup keys, or some very interesting things, such as connect to an IRC chat server somewhere in Russia.

Rather than scan everything all the time, however, the new Blink will scan newly discovered executables, and may perhaps rescan them if, for instance, their patterns or file size appears to have changed. But if it’s the same executable, by default, Blink will only scan it once.

Unfortunately, this approach is pretty easy for a would-be virus writer to avoid. For example, the “virus” could perform its malicious activity only if it receives user input (which it is unlikely to receive in a virtual machine but likely to receive if it pops up a window). Or the virus could check to see if it is running in a virtual machine using technology that is now readily available.

Of course, the real problem with this approach is that it’s theoretically impossible to look at a program and figure out what it’s going to do. This is just another recasting of Turing’s famous “halting problem.” Even running the program in a virtual machine won’t tell you what it’s going to do once you run it in the wild.

Keep Reading

Most Popular

Large language models can do jaw-dropping things. But nobody knows exactly why.

And that's a problem. Figuring it out is one of the biggest scientific puzzles of our time and a crucial step towards controlling more powerful future models.

OpenAI teases an amazing new generative video model called Sora

The firm is sharing Sora with a small group of safety testers but the rest of us will have to wait to learn more.

Google’s Gemini is now in everything. Here’s how you can try it out.

Gmail, Docs, and more will now come with Gemini baked in. But Europeans will have to wait before they can download the app.

This baby with a head camera helped teach an AI how kids learn language

A neural network trained on the experiences of a single young child managed to learn one of the core components of language: how to match words to the objects they represent.

Stay connected

Illustration by Rose Wong

Get the latest updates from
MIT Technology Review

Discover special offers, top stories, upcoming events, and more.

Thank you for submitting your email!

Explore more newsletters

It looks like something went wrong.

We’re having trouble saving your preferences. Try refreshing this page and updating them one more time. If you continue to get this message, reach out to us at customer-service@technologyreview.com with a list of newsletters you’d like to receive.