lkml.org 
[lkml]   [2000]   [Jul]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: TO HELL WITH IT THEN......(re: disk-destroyer.c)

On Fri, 21 Jul 2000, Andre Hedrick wrote:
> On Fri, 21 Jul 2000, Ove Ewerlid wrote:
>
> > I like Andre's perfectionist approach at the protocol level.
>
> Thanks,
>
> Now to restate that it is possible to push the shellstack with the
> mini-code that is called disk-destroyer.c with out being root and wax your
> system. I hate having to expose everything, but now the hackers of the
> world know now to take down Linux Boxes one by one.
>
> You now have no choice, the security issue is exposed.
>
> Andre Hedrick
> The Linux ATA/IDE guy

...damn... I'm a bit tired of this discussion...

Andre, are you trying to say that you don't need to have r00t to make
some hdd-barbecue? If so wouldn't Linus have applied the patch? It's
obvious that you can make silly things mixing some holes and d-destroyer.c
Your patch is helpful, but it's "security through obscurity", you can
still fry hdd after getting r00t, only diffirence will be a bigger exploit
and more time wasted on writing it... you are exaggerating or you can't
clearly explain what do you mean... but patch should go in anyway...

BTW: software may (but don't have to) damage BIOSes, firmwares, CPUs
(programming PLL on mobo), older monitors, ISA/PCI cards (programming
southbridge to get ISA/11Mhz and PCI/41.5Mhz)... etc...
just imagine advanced worm (similar to the one discribed in some
lcamtuf's project) making use of all hardware "features"... ugh...

The ONE and ONLY solution is r00t without direct access to hardware...


cheers
--
Bartlomiej Zolnierkiewicz
<bkz@linux-ide.org>


-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:57    [W:0.511 / U:0.116 seconds]
©2003-2014 Jasper Spaans. Advertise on this site