5 ms·
Containers are portability tools, that can partially control a benign application, but in no way will contain a Trojan. The community warns such tools give a fa
by drtgh 3y ago
Containers are portability tools, that can partially control a benign application, but in no way will contain a Trojan. The community warns such tools give a false sense of security.
As long as the Trojan is moderately advanced, there is nothing to stop it (currently, mouse and cat).
The only thing one can do is to detect signs of its activities, just routine.
When the least unexpected day one detect the signs, one notify to the work circle that the machine has been compromised for to rescind our permissions, it is tried to find out how entered and get an idea of the time during which the data leak has occurred, as anything relevant you did in that machine is on some public page on internet.
- samus 3y agoThat was exactly what I was referring to. One would have to at least use a VM to mitigate that danger, or completely airgap the system. Logging suspicious accesses for forensic purposes is surely useful, but expecting the user to review all these notifications won't improve security, unless this is intended to become their job.
- drtgh 3y agoI ask kernel support for this kind of monitoring, and you have twice recommended tools that you know will not accomplish the task, even assuring it is not possible to bypass them, just in case in a big hypothetical ten or twenty years (Linux) an unformal petition in a forum were implemented, and just in case much later you were asked to use it in your job, knowing it is unlikely and that it is an operative system where all the services can be customized and disabled. I surrender.
- samus 3y agoI never suggested that it's not possible to bypass them by exploits. In an environment where security matters to such a degree, employees don't have for rights and are not given a choice whether to use such monitoring tools. The (non-)existence of such mechanisms is an important criterion in software selection in such environments. But these places actually have the resources to do this and to actually make use of the forensic data. The basic infrastructure exists. Whether it is sufficient is another question. But it is surely an important use case for a lot of companies. For example, Google added a knob to turn off io_uring because the existing security infrastructure around it was found lacking. Commercialization of such a solution would be difficult due to the GPL though. One would have to get it as part of appliances (like IBM or Teradata do). Places like Google and Meta could have their own. As you say, we are reliant on someone eventually upstreaming theirs.
- samus 3y ago> don't have for rights should be > don't have root rights
- drtgh 3y agoI have been using this security matters to such a degree in my home computers since Windows7 through Antivirus and Firewalls with HISP. It is just a feature that the Windows Kernel provides. People relies in Matryoshka dolls as tooling, I also do til some degree, but what happens latter when the trojan scapes the Matryoshka ? nobody land, time endless. I use HISP in manual mode because I want to detect signs, and also because I want to limit and to know what benign programs want to access. And I'm talking about this even for simple domestic computers at home! Needed to say in case a manager who has never used Windows read that: For to use HISP in manual mode the user really have to want to do it above everything else, literally it is painful and very time-consuming. I've been doing it for more than ten years and even now requires to keep to want it. It is like the difference between walking on sand dunes and walking on pavement when I use other people's computers, so the moment you have no desire for it, the technique is more dangerous than automated mode by far. I mean, in Windows most of the people use it in automated mode (no pop-up), the default mode in antivirus. My last words, mostly to the rest of the community, The matter is, the Windows Kernel provides this option of security matters to everyone, and due this the tooling around it, is I guess. (Although certainly it is mostly through commercial products developed by dedicated teams. And so on.)