lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon Aug  1 19:14:02 2005
From: jasonc at science.org (Jason Coombs)
Subject: Cisco IOS Shellcode Presentation

Bart.Lansing@...ls.com wrote:
> It occurs to me that your solution is flawed as well.  What assurance do 
> we have that your "protected storage" is future-proof (i.e. unbreachable 
> by an means whatsoever)?

It doesn't have to be unbreachable by any means whatsoever, it has to be 
unbreachable from a remote location. This is easy to accomplish by not 
connecting the protected storage to a network interface.

The box can still be owned by an attacker who gains physical access to 
the device, but so what? The protected storage will never be owned by a 
JPEG and the CPU will never ignore its built-in machine code 
authentication logic because it would not be implemented in software or 
firmware.

Regards,

Jason Coombs
jasonc@...ence.org

Powered by blists - more mailing lists