lkml.org 
[lkml]   [2002]   [Mar]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: SSSCA: We're in trouble now
Petro wrote:

> > Don't be too sure about that. If a "few" knows how to circumvent,
> > they'll release circumvention kits that anybody can use.
> > Few people can use a new buffer overflow exploit, much
> > more can use a rootkit.
>
> That will end when you get a tripwire like system on each system
> that reports back to Microsoft/Apple when certain critical binaries
> don't match.

There is a difference between a circumvention kit and a rootkit.
The rootkit modifies stuff in order to hide itself.
The circumvention kit doesn't. It doesn't modify any
"official" binaries - it provides its own binary and lets
the other one sit there.

If this is impossible somehow - replace the tripwire-like system
as well as part of the circumvention kit. More work,
still possible. Or firewall the port used to report back
to vendors...

There is so many options. They may try - they will fail.


Helge Hafting
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:24    [from the cache]
©2003-2011 Jasper Spaans