linux-kernel - Re: [malware-list] TALPA - a threat model? well sorta.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 15 Aug 2008 14:06:47 -0400
From:	Valdis.Kletnieks@...edu
To:	david@...g.hm
Cc:	"Press, Jonathan" <Jonathan.Press@...com>,
	Peter Zijlstra <peterz@...radead.org>,
	Helge Hafting <helge.hafting@...el.hist.no>,
	linux-kernel@...r.kernel.org, malware-list@...ts.printk.net,
	hch@...radead.org, andi@...stfloor.org, viro@...IV.linux.org.uk,
	alan@...rguk.ukuu.org.uk, Arjan van de Ven <arjan@...radead.org>
Subject: Re: [malware-list] TALPA - a threat model? well sorta.

On Fri, 15 Aug 2008 10:47:15 PDT, david@...g.hm said:

> in any case the vunerability is limited as the next time the signatures 
> are updated the files would get scanned again, so I don't think it's a big 
> problem in practice.

This problem is actually identical to "new file scanned, but you don't have
the signature available yet so malware isn't detected".

Those of us who have seen large mail servers pile up queues in the 10s of
millions in the 45 minutes between when the worm went critical-mass and when
we got a signature might disagree on it not being a big problem in practice.

Of course, if that's considered "outside" the threat model, somebody better
start writing down exactly what small corner of threat model this is actually
helping against...

Content of type "application/pgp-signature" skipped