4 ms·

I wonder how secure it would be to put some ancient super obscure system on the internet these days. Ideally with a CPU with an obscure instruction set. All st

by Tepix 6y ago

I wonder how secure it would be to put some ancient super obscure system on the internet these days. Ideally with a CPU with an obscure instruction set. All standard exploits would fail. Just make sure you don't have a shell escape, shell commands would work of course.

chx 6y ago
As the classic https://www.usenix.org/system/files/1401_08-12_mickens.pdf https://www.usenix.org/system/files/1401_08-12_mickens.pdf notes: > Basically, you’re either dealing with Mossad or not-Mossad. Applied here: your system would be quite secure because most attacks are just automated robots trying a known set of exploits. The moment someone actually takes a shine to you, you are doomed as the system will be absolutely rife with all sorts of secholes which can be figured out by obtaining a copy and running a modern fuzzer against it. We follow the same train of thought, on SSE I suggested using a Sunfire machine to examine unknown USB sticks for similar reasons -- even if someone tries to espionage on a company, the chances of them creating a malicious stick which works an exploit on an ancient SPARC machine is extremely small https://security.stackexchange.com/a/103192/2429 https://security.stackexchange.com/a/103192/2429
- kjeetgill 6y ago
  Now that they've read this post I'm sure they're firing up a few Sunfire machines for exploit development as we speak.
  - chx 6y ago
    Sunfire, DEC AlphaStation, SGI Fuel, iMac G3... the list is probably not endless because USB only appeared at the tail end of non-x86 desktop availability, still it's not a small list. Various routers as well...
linker3000 6y ago
Back when I worked with such things, THEOS was one of those ancient-ish obscure OSes. It was used to run a multi-user veterinary clinic management package. I actually quite liked it - it had a feature mix reminiscent of VMS, DOS and UNIX. I wonder what's still out there running it!? * https://en.wikipedia.org/wiki/THEOS https://en.wikipedia.org/wiki/THEOS * http://theos-software.com/ http://theos-software.com/

by Tepix 6y ago

chx 6y ago

As the classic https://www.usenix.org/system/files/1401_08-12_mickens.pdf https://www.usenix.org/system/files/1401_08-12_mickens.pdf notes: > Basically, you’re either dealing with Mossad or not-Mossad. Applied here: your system would be quite secure because most attacks are just automated robots trying a known set of exploits. The moment someone actually takes a shine to you, you are doomed as the system will be absolutely rife with all sorts of secholes which can be figured out by obtaining a copy and running a modern fuzzer against it. We follow the same train of thought, on SSE I suggested using a Sunfire machine to examine unknown USB sticks for similar reasons -- even if someone tries to espionage on a company, the chances of them creating a malicious stick which works an exploit on an ancient SPARC machine is extremely small https://security.stackexchange.com/a/103192/2429 https://security.stackexchange.com/a/103192/2429

kjeetgill 6y ago
Now that they've read this post I'm sure they're firing up a few Sunfire machines for exploit development as we speak.
- chx 6y ago
  Sunfire, DEC AlphaStation, SGI Fuel, iMac G3... the list is probably not endless because USB only appeared at the tail end of non-x86 desktop availability, still it's not a small list. Various routers as well...

linker3000 6y ago

Back when I worked with such things, THEOS was one of those ancient-ish obscure OSes. It was used to run a multi-user veterinary clinic management package. I actually quite liked it - it had a feature mix reminiscent of VMS, DOS and UNIX. I wonder what's still out there running it!? * https://en.wikipedia.org/wiki/THEOS https://en.wikipedia.org/wiki/THEOS * http://theos-software.com/ http://theos-software.com/