full-disclosure - Re: Linux's unofficial security-through-coverup policy

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20080716220146.GB16371@grsecurity.net>
Date: Wed, 16 Jul 2008 18:01:47 -0400
From: spender@...ecurity.net (Brad Spengler)
To: Valdis.Kletnieks@...edu
Cc: full-disclosure@...ts.grok.org.uk, dailydave@...ts.immunitysec.com
Subject: Re: Linux's unofficial security-through-coverup
	policy

Valdis,

Please try to stay consistent with your own arguments.  If you defeat 
them yourself barely into your third paragraph, you don't give me much 
to do!

To summarize:

> have any untrusted local users - for instance, my laptop.  The only users
> on it are me, myself, and I<, and the guy that owned my webserver, or 
the guy that owned my email client, or the guy that owned my audio 
player, or the guy that owned my video player, or the guy that owned my 
web browser, or the guy that owned my FTP client, or the guy that owned 
my PDF reader, or the guy that owned my office application>

You're a very trusting individual!

This is exactly why telling someone to update if they have any 
"untrusted local users" just doesn't make any sense since it misleads a 
majority of users.  A better replacement would be "if your machine is 
network-connected."  How do you own a website if you can't break into it 
directly?  Find out what other websites are hosted on the same machine, 
break into one of them, then locally escalate privileges, giving you 
access to all the websites hosted on the machine.  If you don't think 
this happens, you've got your head in the sand and honestly should just 
give up having anything to do with security.

-Brad

Download attachment "signature.asc" of type "application/pgp-signature" (190 bytes)

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/