3 ms·
The reason for doing so is minimising the risk if an attacker breaks into a server. This is also why systems like ATMs should be patched. Untrusted code executi
by ZenoArrow 9y ago
The reason for doing so is minimising the risk if an attacker breaks into a server. This is also why systems like ATMs should be patched. Untrusted code execution on servers and ATMs may not be the norm, but it's far from impossible.
- lsd5you 9y agoOk, sure, but we have to consider whether that is worth it, and if they can run unpriveleged code, there is a good chance there is a software privelege escalation available anyway. Of course on shared servers this is going to be a nightmare.
- randyrand 9y agocouldn't they just use a myriad of other priveledge escalation bugs? there have been ~4600 privledge escalation bugs found since 1999. 250 a year. Almost one every day. https://www.cvedetails.com/vulnerabilities-by-types.php https://www.cvedetails.com/vulnerabilities-by-types.php At this point we still won't have security and now we won't have performance either. It's putting the cart before the horse.
- ZenoArrow 9y ago> "couldn't they just use a myriad of other priveledge escalation bugs?" The idea is to patch all known privilege escalation bugs. It's rare for an attacker to rely on a single attack vector. They may get to the point where they only have limited access to running code, and want to break out of that sandbox. Spectre/Meltdown may be the route they take to do so.