3 ms·
What if your port knocking monitor has a zero day?
by c22 6y ago
What if your port knocking monitor has a zero day?
- flemhans 6y agoThen ssh would protect you. The two having zero days at the same time is unlikely.
- c22 6y agoI guess that sort of depends on the nature of the zero day, huh?
- barbegal 6y agoNot necessarily, imagine a port knocking monitor that stores each port attempt it sees in a large buffer. Imagine you make many attempted connections allowing you to overflow the buffer and write arbitrary data onto the heap.
- cutemonster 6y agoOr the monitor being written in c and analyzing text in the knock messages, e.g. looks and interprets a hash
- rmrfstar 6y agoThat's kind of the idea Moxie had with [1]. Only 15 lines of code run as root, and they basically just tail kern.log. [1] https://moxie.org/software/knockknock/ https://moxie.org/software/knockknock/