Linux: security through obscurity?

Linux: security through obscurity?

Posted Nov 8, 2004 18:53 UTC (Mon) by rickmoen (subscriber, #6943)
Parent article: Linux: security through obscurity?

Jon wrote: Along these lines, it's worth noting that the white-hat security researchers certainly do not find free software to be too obscure to merit their attention. One need not read Bugtraq for long to see that there is a steady stream of issues with free software being reported there.

Just for context and perspective:

1. Those include DoS attacks (certainly not a good thing, but should not be confused with system compromise), and a huge number of speculative, possible, theoretical vulnerabilities for which no exploit is available and maybe never will be. 2. And many of those would be exploitable only in improbable system configurations, or involve software rarely installed or seldom enabled. 3. And almost all of those turn out to be vulnerabilities at an access level lacking system privilege. 4. And, the way Linux/BSD systems have tended to be maintained over the last few years (apt-get, urpmi, cvsup for BSD ports skeleton update, up2date, etc.), the time-windows of vulnerability have tended to either be incredibly narrow or (more typically) nonexistent.

And you know what? The next time someone unleashes an unexpected, impossible-to-plan-for global attack on a popular Linux/BSD system daemon (and, mind you, even the Morris worm involved a known hole in sendmail configuration) — or on a Web browser, or on a mail client — it'll be a two-day wonder: After OS-reloading where necessary (obviously not required unless there's been root compromise), people would just switch to one of the alternatives to that daemon or userland app not sharing the same failure mode, while waiting for a patched version of the affected one — because, unlike some communities, we seldom either get trapped by non-modular, inflexible systems or make ourselves dependent on Hobson's Choice take-it-or-leave-it system-wide "security packs".

And yes, stupid behaviour like installing untrustworthy apps from dubious sources with root authority (or ditto "security fixes" like the "Red Hat security update phishing attempt") will always subvert and defeat the measures we've implemented to make it difficult for the hapless to hurt themselves.

About that "phishing attempt": I've listed almost much all of the innumerable reasons why only someone both mindbogglingly gullible and also extremely adept with building and installing software with root authority could have fallen for it.

Meanwhile, if you want to be constructively paranoid about something, keep looking over those mailcap entries — and install/configure a proper IDS.

Best Regards,
Rick Moen
rick@linuxmafia.com

---

(Log in to post comments)