CVE-2025-13032: Entering and Breaking the Avast Antivirus Sandbox Part 2

x-complexity•about 1 hour ago

Chalk another one up for "Antiviruses causing more problems than solving them".

They 'worked' when they initially just scanned files for known malicious signatures. Now they're the equivalent of a sledgehammer to a wall with all of the extra bells & whistles strapped to them.

Application whitelisting is the remaining way forward if you actually care about runtime security. That & locking every access point down to the bare minimum.

Batman8675309•20 minutes ago

I'm a firm believer that hardware virtualization is the way forward for security. Qubes OS has the right idea, but running an entire OS for every application is demanding.

IMO it would make more sense to run every app in its own scaled down VM, like Microdroid for Android. Windows 10 had Microsoft Defender Application Guard for Microsoft Edge, and as far as security goes it was a fortress.

Too bad they discontinued it, and that performance was subpar. I would have loved to see them develop the idea more.

stingraycharles•12 minutes ago

Aren’t you then just moving the responsibility from OS (process isolation) to the CPU ? And doesn’t this whole thing break with practical realities, such as processes needing to interact with each other ?

How would you deal with a password manager or a clipboard in these cases, for example, without increasing friction for users ?

codedokode•23 minutes ago

Antivirus is not a bad thing. Imagine running a company where there are 100 employees that click every link and open every attachment. Definitely safer with an antivirus.

master-lincoln•16 minutes ago

I imagined it with employees on Linux and it wasn't clear to me it's definitely safer with an antivirus software. You are just stating things without explaining yourself...

oblio•about 1 hour ago

I would say white listing will have to happen for everything in the near future: applications, ports, URLs (including fragments!), filesystem hierarchies, basically everything.

I'm not sure it's doable with current OS architectures, though.

ulimn•about 1 hour ago

Isn't the model of AppArmor or SELinux a good approach to tackle this problem?

codedokode•24 minutes ago

No, it is unfit for this purpose. The reason is:

- you need to specify the rules before starting an application. How one is supposed to guess what application will do? Figuring out the correct rules may take lot of time and is impossible for non-programmers. Imagine I want to install 10 apps per day and they should work perfectly, how much time will I be spending writing rules?

- the rules cannot be changed in runtime, for example, giving access to a camera for 1 minute

- the rules are too limited. You can restrict access to a file, but can you restrict access to a DBUS bus? Can you restrict access to audio, video, GPU etc? To /proc filesystem? To a DNS domain? The rules feel like they were written for computers with teletypes from 70s and not for modern machines.

- they do not allow providing fake data, for example, a fake list of WiFi points so that the app thinks it has the access to your geolocation while in reality is doesn't.

So it is some outdated technology unfit for modern day.

What does a user want? The user wants to be able to run anything without any risk and without writing any config files. Obviously it takes a skill to write such OS, and there is definitely a lack of people with this skill among Linux distribution creators.

A system where installation is done using "curl + sudo bash" is the opposite of a safe OS.

CVE-2025-13032: Entering and Breaking the Avast Antivirus Sandbox Part 2

⚡ Community Insights

Discussion (9 Comments)Read Original on HackerNews