3 ms·
A naive approach could be defining that the software stack to use is under /opt/twitter/ and everything under /usr/bin/ and /bin/ is just a honeypot, so any leg
by pronik 12y ago
A naive approach could be defining that the software stack to use is under /opt/twitter/ and everything under /usr/bin/ and /bin/ is just a honeypot, so any legitimate developer using those would also trigger a notification. But anyhow, it smells like overkill, the wrong place and not worth the extra mileage. The only case I can think of where this would be useful is when management or timing problems prevent proper and secure development -- which is not a problem ops should solve. Would still be interesting if someone actually does this.
- nknighthb 12y agoWell, it would shield against simplistic attempts at exploiting setuid binaries, certainly, but beyond that its effectiveness would probably be limited, especially as it became more widely known. Another interesting strategy, particularly in the age of widespread use of VMs and containers, might be to extend the basic idea of ASLR beyond address space. Randomize paths and filenames and system call numbers, for example. You'd need to build all your binaries yourself, of course, and run scripts through some sort of mangler (for maximum effectiveness, do this per-VM/container). You'd want to encrypt non-user-visible strings, too. There'd be a lot of tooling work necessary to make this practical in the real world, of course. (Edit: Just found this, which looks relevant: http://research.microsoft.com/en-us/um/people/helenw/papers/randsys.pdf http://research.microsoft.com/en-us/um/people/helenw/papers/... )