Messages in this thread | | | From | "Michael H. Warfield" <> | Subject | Re: 2.3 wish: integrate pcmcia into mainstream kernel | Date | Sun, 13 Jun 1999 09:18:16 -0400 (EDT) |
| |
Brandon S. Allbery KF8NH enscribed thusly: > In message <199906131254.IAA19346@alcove.wittsend.com>, "Michael H. Warfield" w > rites: > +----- > | > If they can run insmod or trash module objects, they can replace the kernel > | > and run lilo, then force a reboot. I see no security improvement, and it's > | > not *that* much harder. > | > | But a reboot is detectable... > +--->8
> Only if someone's logged in at the time, or actually looking at the machine. > If not, uptime and log entries can be falsified by the new kernel and hacked > utilities.
Not if you are using a remote logging server or a secure log daemon. A secure log daemon uses cryptographic signatures on the log entries to make any tampering detectable. I hate it when the make the claim that the secure log daemons are tamperproof. They are not tamper proof. But they are tamper detectable.
> "Too hard"? You'd be surprised what's in rootkits.
No I wouldn't... It's my business... I'm the senior researcher for Internet Security Systems. :-)
> -- > brandon s. allbery [os/2][linux][solaris][japh] allbery@kf8nh.apk.net > system administrator [WAY too many hats] allbery@ece.cmu.edu > carnegie mellon / electrical and computer engineering KF8NH > We are Linux. Resistance is an indication that you missed the point.
Mike -- Michael H. Warfield | (770) 985-6132 | mhw@WittsEnd.com (The Mad Wizard) | (770) 925-8248 | http://www.wittsend.com/mhw/ NIC whois: MHW9 | An optimist believes we live in the best of all PGP Key: 0xDF1DD471 | possible worlds. A pessimist is sure of it!
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.tux.org/lkml/
| |