[lkml]   [2002]   [Mar]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: SSSCA: We're in trouble now
    Petro wrote:

    > > Don't be too sure about that. If a "few" knows how to circumvent,
    > > they'll release circumvention kits that anybody can use.
    > > Few people can use a new buffer overflow exploit, much
    > > more can use a rootkit.
    > That will end when you get a tripwire like system on each system
    > that reports back to Microsoft/Apple when certain critical binaries
    > don't match.

    There is a difference between a circumvention kit and a rootkit.
    The rootkit modifies stuff in order to hide itself.
    The circumvention kit doesn't. It doesn't modify any
    "official" binaries - it provides its own binary and lets
    the other one sit there.

    If this is impossible somehow - replace the tripwire-like system
    as well as part of the circumvention kit. More work,
    still possible. Or firewall the port used to report back
    to vendors...

    There is so many options. They may try - they will fail.

    Helge Hafting
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to
    More majordomo info at
    Please read the FAQ at

     \ /
      Last update: 2005-03-22 13:24    [W:0.023 / U:22.664 seconds]
    ©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site