Maybe running such an old kernel is a bad idea [LWN.net]

Maybe running such an old kernel is a bad idea

Posted Nov 21, 2012 15:10 UTC (Wed) by imgx64 (guest, #78590)
In reply to: Maybe running such an old kernel is a bad idea by robert_s
Parent article: New Linux Rootkit Emerges (Threat Post)

But I think it's more "security through obscurity" than actual "security bugs being accidentally fixed" that may help you there. Running obscure or frequently changing versions of things could give you an amount of invulnerability to opportunistic attackers toolkits of pre-built, version (and often build)-sensitive exploits.

"Security through obscurity" does not mean running uncommon software/software versions. It means that the security mechanisms are a "secret", as opposed to the keys of such mechanisms.

(Log in to post comments)

Maybe running such an old kernel is a bad idea

Posted Nov 21, 2012 15:21 UTC (Wed) by robert_s (subscriber, #42402) [Link]

No, I know that, but the approach I was describing conceptually smells of security through obscurity.

Maybe running such an old kernel is a bad idea

Posted Nov 21, 2012 15:55 UTC (Wed) by alison (✭ supporter ✭, #63752) [Link]

What we typically term "security through obscurity" would more appropriately be termed "security through secrecy." The point that the latest release of a rapidly developed application presents a less attractive target than the version included in widely deployed LTS release is certainly correct. Cliff Stoll's book _Cuckoo's Egg_ was about how true obscurity can have an unintended protective effect. Firefox, for example, now releases frequently enough that attackers may not finding targeting the "latest stable" version worth their effort.

Moving target

Posted Nov 22, 2012 9:06 UTC (Thu) by man_ls (subscriber, #15091) [Link]

A moving target is usually of no help in this situation. As we have seen in kernel vulnerabilities, an unpatched hole in version n is likely to be carried over to n+1, so whatever attack works on one version will work on the next -- until fixed once and for all. So it is 0-day or no-day.

With stable versions, security fixes are backported from latest releases. There is an increased maintenance burden, but otherwise security should be similar. Again, 0-day or no-day. The advantage of quick releases is mostly decreased maintenance.

Moving target

Posted Nov 22, 2012 20:08 UTC (Thu) by redden0t8 (guest, #72783) [Link]

Except as Robert S points out, even if the vulnerability is still there, the actual exploit implementation often has to play catch-up to work on the new version.

Moving target

Posted Nov 23, 2012 9:47 UTC (Fri) by nix (subscriber, #2304) [Link]

So it helps us defend against *badly-written* rootkits? I suppose insofar as most rootkits are badly written (just as most software is badly written), that may be helpful. But it only takes one guy to come out with a well-written rootkit...