lkml.org 
[lkml]   [2013]   [Dec]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH 1/9] Known exploit detection
On 12/12/2013 08:06 PM, Theodore Ts'o wrote:
> On Thu, Dec 12, 2013 at 05:52:24PM +0100, vegard.nossum@oracle.com wrote:
>> The idea is simple -- since different kernel versions are vulnerable to
>> different root exploits, hackers most likely try multiple exploits before
>> they actually succeed.
>
> Suppose we put put this into the mainstream kernel. Wouldn't writers
> of root kit adapt by checking for the kernel version to avoid checking
> for exploits that are known not work? So the question is whether the
> additional complexity in the kernel is going to be worth it, since
> once the attackers adapt, the benefits of trying to detect attacks for
> mitigated exploits will be minimal.

Yeah, you could probably avoid detection by being more careful. But I
think it would be worth making it harder; I'd argue that the "additional
complexity" in this case is minimal, since we are mostly talking about
~1 line added to an error path for each critical vulnerability.


Vegard


\
 
 \ /
  Last update: 2013-12-13 09:41    [W:0.351 / U:3.736 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site