AntiExecutable Is Disingenuous

Antiexecutable software is a new ‘trend’ in security applications aimed at preventing malware from running. Most of the time it’s just hooking some specific functions and then preventing the new payload from running without a check for either a signature or user approval.

The idea that this somehow prevents execution, as the name suggests, is false. While it may prevent a new payload from running execution happens long before that payload even exists.

Exploiting a browser is literally called Remote Code Execution -you leverage some vulnerability in order to get your code to run. It is only long after this that you drop a separate payload.

The reason attacks work this way is because it’s easier for malware as a business to work, and not to the extent that they couldn’t work around it. But with attacks growing in sophistication (look at the recent Reader exploit, which bypasses the sandbox) it’s really silly to ever think that you can rely on something as trivial as AE.

Now if Antiexecutable software came out and said “Hey, this is purely a layer meant for XYZ situations” I wouldn’t have an issue. The problem is how it’s touted as the future of security, or some cool new technique that’ll kill all malware. It isn’t, it’s not the future, and it never could be.