3 ms·

Uh, reprovision the VMs, reinstall your packages, QA everything and be back up and running in a couple hours. At least that's what they could do if they had a c

• beagle3 14y ago
  If you believe that, than you are not part of a competent team, and do not understand enough to evaluate anyone's competence. See, e.g. http://en.wikipedia.org/wiki/Blue_Pill_%28software%29 http://en.wikipedia.org/wiki/Blue_Pill_%28software%29 - despite the (justified) criticism listed there, the principle holds. According to the Wikipedia article, tptacek / matasano says he can detect it, and if tptacek says, I'll take his word for it. (And yes, timing attacks are inherently hard to fake, though -- since this is a targeted attack, there could be a blue pill version that targets a specific matasano detector version. Continues ad absurdum) Regardless - the advice given by parent is useless against a BIOS or deepest-level hypervisor rootkit. A note to all armchair security people: Security is not just another engineering field like (say) networking, UI or databases: It is pervasive and very different: Engineering is the practice of making sure that whatever is in the spec, works. Security is the practice of making sure that anything outside the spec, doesn't work (unless it is desirable for some reason, in which case it should be added to the spec).