4 ms·
Things are not insecure or secure. Things are secure to varying degrees; nothing is perfectly so and few things are totally not. (... and anyone who claims anyt
by api 11y ago
Things are not insecure or secure. Things are secure to varying degrees; nothing is perfectly so and few things are totally not. (... and anyone who claims anything is totally secure is delusional.)
Making it hard buys you some resistance to less skilled attackers. Since skill tends to obey a power law distribution, this is most attackers. Make it as hard as possible and you get more and more protection from more and more attackers, and so on.
Your average attacker doesn't know enough to bust out x86 assembly language to inject root code into the kernel and dump a VM's RAM. So make it so you have to do this, and you've ruled out your average attacker. The average attacker will only 'dd' the VMs' disks, which if they've encrypted data at rest will not get them the crown jewels. But make it easy to dump VM RAM and you've exponentially increased the damage from the average attacker (due to power law distribution of skill).
- hueving 11y agoWhatever stupid barriers you put up will just be automated away in common tools. Then all you have is something more complex than it needs to be that probably has bugs and vulnerabilities because you made it convoluted.
- blibble 11y agoevery piece of vm software has a save/snapshot button which will save the state of the ram/cpu to disk.
- geofft 11y agoIt only takes one attacker (or curious college student) to figure it out and post it on GitHub, and then your average attacker can bust out all the assembly language required without actually knowing it. For comparison -- does your average Windows attacker know how to cryptanalyze the LM hash function? No, but they can run the tool just the same. There are absolutely places where your the general argument holds water: "no security by obscurity" is a simplistic framework, and ignores a much more reasonable and also simpler framework of costs and incentives. In several cases, the costs of figuring out something obscure outweigh the potential incentives of breaking it. But in this particular case, there are no marginal costs to the attacker. Once someone somewhere invests the time to figure it out, for any motivation including curiosity, the defense is immediately worthless for everyone.
- DasIch 11y agoThe name script kiddie isn't an accident. The average attacker uses an exploit developed by a more experienced one. You're trying to protect yourself from an imaginary class of attacker that just doesn't exist.