7 ms·

> Kali Linux, which is a Debian derivative that is focused on penetration testing and security auditing. Kali Linux does not have the same restrictions on downl

> Kali Linux, which is a Debian derivative that is focused on penetration testing and security auditing. Kali Linux does not have the same restrictions on downloading during builds that Debian has The security auditing distribution has less auditable requirements around building packages?

luch 6y ago
This is the magic of "offensive" security, where you don't really bother with your own security posture :D you know what they say, the cobbler's children are the worst shod ...
- erik_seaberg 6y ago
  I think Kali is trying to offer the latest versions of each tool, because a pentest box that randomly breaks isn’t as serious as prod servers.
  - raesene9 6y ago
    yeah but the challenge that's being referred to (I think) is that having an unauditable supply chain on a security distribution is, in itself a security risk. You've got to imagine that Kali linux is a very tempting target for supply chain attacks, if you can compromise a load of security testers, you might get access to all sorts of information....
    - PeterisP 6y ago
      It's not supposed to have any information or allow compromising security testers - it's never supposed to be used as someone's personal machine, it is intended to be used as a read-only live image or a disposable VM; you spin it up, launch a tool, note the results and wipe the machine, going back to a known state. As you say, supply chain attacks are very much possible especially because you're intentionally running various third party exploits and malware which you are not going to be able to vet - so you don't expect it to be secure, you don't even bother trying to secure it or trying to verify if it's been broken - you always treat it as something toxic that should be isolated and have limited, transient access to any data.
      - raesene9 6y ago
        Gotta say I've seen many many long lived Kali VMs or laptops over the years. Whilst ideally ephemeral OS images would be great, not just for Kali, but for testing environments in general, that doesn't always meet reality. This (pentest tooling) is one of the areas that seems a good fit with containerization (podman, Docker, lxc etc), as their use case fits nicely (single use ephemeral images with some isolation)
Blikkentrekker 6y ago
Of course. Kali is generally booted as a live image, and one runs the entire system as root. It is most certainly not designed to be secure. This is expecting a battering ram to be resistant against being battering.
- erik_seaberg 6y ago
  raesene9 has a point about someone getting malware into your bleeding edge pentest tool.

luch 6y ago

This is the magic of "offensive" security, where you don't really bother with your own security posture :D you know what they say, the cobbler's children are the worst shod ...

erik_seaberg 6y ago
I think Kali is trying to offer the latest versions of each tool, because a pentest box that randomly breaks isn’t as serious as prod servers.
- raesene9 6y ago
  yeah but the challenge that's being referred to (I think) is that having an unauditable supply chain on a security distribution is, in itself a security risk. You've got to imagine that Kali linux is a very tempting target for supply chain attacks, if you can compromise a load of security testers, you might get access to all sorts of information....
  - PeterisP 6y ago
    It's not supposed to have any information or allow compromising security testers - it's never supposed to be used as someone's personal machine, it is intended to be used as a read-only live image or a disposable VM; you spin it up, launch a tool, note the results and wipe the machine, going back to a known state. As you say, supply chain attacks are very much possible especially because you're intentionally running various third party exploits and malware which you are not going to be able to vet - so you don't expect it to be secure, you don't even bother trying to secure it or trying to verify if it's been broken - you always treat it as something toxic that should be isolated and have limited, transient access to any data.
    - raesene9 6y ago
      Gotta say I've seen many many long lived Kali VMs or laptops over the years. Whilst ideally ephemeral OS images would be great, not just for Kali, but for testing environments in general, that doesn't always meet reality. This (pentest tooling) is one of the areas that seems a good fit with containerization (podman, Docker, lxc etc), as their use case fits nicely (single use ephemeral images with some isolation)

Blikkentrekker 6y ago

Of course. Kali is generally booted as a live image, and one runs the entire system as root. It is most certainly not designed to be secure. This is expecting a battering ram to be resistant against being battering.

erik_seaberg 6y ago
raesene9 has a point about someone getting malware into your bleeding edge pentest tool.