Messages in this thread | | | Date | Tue, 27 May 1997 23:11:01 -0500 (EST) | From | James Mastros <> | Subject | Re: per session access to drives |
| |
On Thu, 15 May 1997, Alex Belits wrote:
> On Wed, 14 May 1997, Alan Cox wrote: > > > > I.E. "I can't acutally DO anything on this machine, because I accidentally > > > nuked /bin and /sbin, but I assume that nobody is smart enough > > > to be able to replace them." > > [...] > > Neutralising services is a great strategy. You can't hack a pocket calculator > > much because it has nothing to hack. Unless, of course, your caculator is a HP-48G[X]. Sorry, just had to be done. Fairly large pocket, but still. In any case, HPs have a complete shell burned into ROM, though many run another shell. > > Service != binary. Service that is running, can be vulnerable or not, > can provide access to something that is vulnerable, etc. Binary is just > sitting somewhere on the box, and unless it's usable for breakin while > remote user have not bypassed/altered security of service that can run > executables, (say, telnet/shell or http/cgi), it isn't of any danger, and > once remote access is gained at the extent that arbitrary executable can > run with root privileges, "disabling" executables is useless -- system can > be considered lost regardless of that. If hackers can't get at the binaries untill they have root, they can be considered non-existant. Once they get root, they could just download & compile the binaries in question.
> > -- > Alex > > P.S. Any system has a condition where its functionality is lost and can't > be recovered on its own. It's silly to plan system security of home PC to > survive "denial of service attack" performed with a nuclear bomb. Or any other single system. If you need to survive radioactive cockroaches, go for a massively decentralized system, like the Internet. Thats why we can't just deny routing to those spammers...
-=- James Mastros
1st Rule of Mailinglists --- All threads will eventually end with a statement of this rule, or suguestions of how to purpratrate a counterexample to this rule.
| |