10 ms·
I was gonna say much the same thing. Once a machine has been compromised, you've got to format and re-image it. The machine in the article could well still ha
by adwf 12y ago
I was gonna say much the same thing. Once a machine has been compromised, you've got to format and re-image it. The machine in the article could well still have a rootkit installed. Not to mention he doesn't seem to know the initial attack vector, so any security updates are meaningless if someones credentials have been stolen.
Finally, if you're really paranoid, you also have to flash the bios in the machine too as there are rootkits that can potentially survive formatting...
- swombat 12y agoI'd add that you don't even need to have the machine actually be compromised. If you think it might be compromised, if you have reason to believe that perhaps something bad happened, you probably should re-image it. There may be smoke without a fire, but it's not worth the risk, is it?
- juliangregorian 12y agoThis seems like a great reason to virtualize everything possible.
- 0xCMP 12y agoTrue, but even this isn't always perfect. I was told recently that Xen shares the kernel memory space among VMs so if once is compromised at the kernel level all of them could be compromised. This person dislikes using Amazon for this reason because he can't be sure his box isn't popped through another VM.
- deleted 12y ago[deleted]
- DanielDent 12y agoGenerally speaking, Xen-style virtualization is where each VM has their own copy of the kernel and their own memory space. There are new-ish features like transcendent memory which can blur the lines, but I don't think they are widely deployed. Systems like docker, LXC, and virtuozzo are where you run into the issue you describe.