3 ms·
Contrarian stance here: if kernel security is important, the game is over, the attacker has root; they are running code on your server and you've lost because o
by pnathan 11y ago
Contrarian stance here: if kernel security is important, the game is over, the attacker has root; they are running code on your server and you've lost because of one of the innumerable issues that the attacker knows that you don't. Restated, the kernel is defined to be insecure; now play the game. :-)
Design wise, the principle I've adopted is that each server is running an application set; when one of those applications is compromised, the server is immediately rooted, game over, all applications in the set are compromised and the attacker controls those resources and the server. In general, the layer of security I am looking for to control server rooting is an application's security, preceded by network level security. Separation of security regions (domains, whatever you want to call them) is accomplished by having different ephemeral servers; exploitation of one region not rachetable to the next region unless it's prespecified that way.
- mjg59 11y ago> If kernel security is important, the game is over, the attacker has root No - one of the primary mechanisms attackers use to gain root is to exploit kernel vulnerabilities.
- pnathan 11y agoRight.... if you're relying on the kernel to protect you, you're dead in the water as it is, today. So the reasonable defense is to assume the kernel security doesn't exist.
- mjg59 11y agoThe reasonable long-term defence is to improve kernel security.
- pnathan 11y agoHonestly...no. I don't think so.Security is much too much of a cat and mouse game at this level, where you're specifically fixing things to deal with attacks. There will always be another vulnerability, another bad coding practice that someone comes in through. It's not provably secure (it's in C and has le five zillion config options; among other things); it's not secure by design (wasn't designed for security); it's not even secure by effort (Linus is not a religious fanatic about security). So the sane approach until a fully redesigned system comes by is to assume that it only provides a thin layer in the defense game and partition access levels and security controls appropriately.
- mjg59 11y agoI don't want to sound overly hostile here, but have you actually read the post? Many (if not most) kernel bugs can be mitigated with existing technology, and there's ongoing research that will bring this down even further. There are certainly scenarios where assuming that any level of compromise may be significantly deeper than you imagined is the correct response, but that's not a supportable response in the majority of cases. Looking at it another way - if application security is important, the game is over, the attacker has already got in via the network. We're bad at writing applications, so we shouldn't expose them to the internet.
- AnimalMuppet 11y agoAll of the above. Do the best you can at network security, and try to get better. Do the best you can at application security, and try to get better. Do the best you can at kernel security, and try to get better. And do the best you can at intrusion detection, and try to get better.