lkml.org 
[lkml]   [1997]   [May]   [28]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: per session access to drives
On Thu, 15 May 1997, Alex Belits wrote:

> On Wed, 14 May 1997, Alan Cox wrote:
>
> > > I.E. "I can't acutally DO anything on this machine, because I accidentally
> > > nuked /bin and /sbin, but I assume that nobody is smart enough
> > > to be able to replace them."
> >
[...]
> > Neutralising services is a great strategy. You can't hack a pocket calculator
> > much because it has nothing to hack.
Unless, of course, your caculator is a HP-48G[X]. Sorry, just had to be
done. Fairly large pocket, but still.
In any case, HPs have a complete shell burned into ROM, though many run
another shell.
>
> Service != binary. Service that is running, can be vulnerable or not,
> can provide access to something that is vulnerable, etc. Binary is just
> sitting somewhere on the box, and unless it's usable for breakin while
> remote user have not bypassed/altered security of service that can run
> executables, (say, telnet/shell or http/cgi), it isn't of any danger, and
> once remote access is gained at the extent that arbitrary executable can
> run with root privileges, "disabling" executables is useless -- system can
> be considered lost regardless of that.
If hackers can't get at the binaries untill they have root, they can be
considered non-existant. Once they get root, they could just download &
compile the binaries in question.

>
> --
> Alex
>
> P.S. Any system has a condition where its functionality is lost and can't
> be recovered on its own. It's silly to plan system security of home PC to
> survive "denial of service attack" performed with a nuclear bomb.
Or any other single system. If you need to survive radioactive
cockroaches, go for a massively decentralized system, like the Internet.
Thats why we can't just deny routing to those spammers...

-=- James Mastros

1st Rule of Mailinglists --- All threads will eventually end with a
statement of this rule, or suguestions of how to purpratrate a
counterexample to this rule.


\
 
 \ /
  Last update: 2005-03-22 13:39    [W:0.034 / U:0.020 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site