Re: [PATCH 1/9] Known exploit detection
From: Vegard Nossum
Date: Fri Dec 13 2013 - 03:22:52 EST
On 12/12/2013 08:06 PM, Theodore Ts'o wrote:
On Thu, Dec 12, 2013 at 05:52:24PM +0100, vegard.nossum@xxxxxxxxxx wrote:
The idea is simple -- since different kernel versions are vulnerable to
different root exploits, hackers most likely try multiple exploits before
they actually succeed.
Suppose we put put this into the mainstream kernel. Wouldn't writers
of root kit adapt by checking for the kernel version to avoid checking
for exploits that are known not work? So the question is whether the
additional complexity in the kernel is going to be worth it, since
once the attackers adapt, the benefits of trying to detect attacks for
mitigated exploits will be minimal.
Yeah, you could probably avoid detection by being more careful. But I
think it would be worth making it harder; I'd argue that the "additional
complexity" in this case is minimal, since we are mostly talking about
~1 line added to an error path for each critical vulnerability.
Vegard
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/