Re: [malware-list] TALPA - a threat model? well sorta.

[david]

On Fri, 15 Aug 2008, Valdis.Kletnieks@xxxxxx wrote:

> On Fri, 15 Aug 2008 10:47:15 PDT, david@xxxxxxx said:
>
> > in any case the vunerability is limited as the next time the signatures
> > are updated the files would get scanned again, so I don't think it's a big
> > problem in practice.
>
> This problem is actually identical to "new file scanned, but you don't have
> the signature available yet so malware isn't detected".
>
> Those of us who have seen large mail servers pile up queues in the 10s of
> millions in the 45 minutes between when the worm went critical-mass and when
> we got a signature might disagree on it not being a big problem in practice.
>
> Of course, if that's considered "outside" the threat model, somebody better
> start writing down exactly what small corner of threat model this is actually
> helping against...

go back to the beginning of this thread. that is defining the (very 
limited) thread model that they are trying to defend against.

the rest of us are not trying to defend against this threat model. we are 
trying to identify the appropriate infrastructure that could be used by 
the TALPA folks for their work, that can also be reasonable for inclusion 
in the kernel (which includes being suitable for other similar purposes, 
such as filesystem indexing)

we agree that the threat they are trying to defend against is a very small 
portion of the overall threat, but there are other components (including 
SELinux) that are available to deal with other portions of the overall 
threat.

if you want to say that the solution is too limited to be worth while, 
then you need to write a new threat model that you think is what should be 
defended against and then we can start discussing how to defend against 
it.

David Lang
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/