| |||||||||||||
Maybe running such an old kernel is a bad ideaMaybe running such an old kernel is a bad ideaPosted Nov 21, 2012 15:55 UTC (Wed) by alison (✭ supporter ✭, #63752)In reply to: Maybe running such an old kernel is a bad idea by imgx64 Parent article: New Linux Rootkit Emerges (Threat Post)
What we typically term "security through obscurity" would more appropriately be termed "security through secrecy." The point that the latest release of a rapidly developed application presents a less attractive target than the version included in widely deployed LTS release is certainly correct. Cliff Stoll's book _Cuckoo's Egg_ was about how true obscurity can have an unintended protective effect. Firefox, for example, now releases frequently enough that attackers may not finding targeting the "latest stable" version worth their effort.
(Log in to post comments)
Moving target Posted Nov 22, 2012 9:06 UTC (Thu) by man_ls (subscriber, #15091) [Link] A moving target is usually of no help in this situation. As we have seen in kernel vulnerabilities, an unpatched hole in version n is likely to be carried over to n+1, so whatever attack works on one version will work on the next -- until fixed once and for all. So it is 0-day or no-day.With stable versions, security fixes are backported from latest releases. There is an increased maintenance burden, but otherwise security should be similar. Again, 0-day or no-day. The advantage of quick releases is mostly decreased maintenance.
Moving target Posted Nov 22, 2012 20:08 UTC (Thu) by redden0t8 (guest, #72783) [Link]
Except as Robert S points out, even if the vulnerability is still there, the actual exploit implementation often has to play catch-up to work on the new version.
Moving target Posted Nov 23, 2012 9:47 UTC (Fri) by nix (subscriber, #2304) [Link]
So it helps us defend against *badly-written* rootkits? I suppose insofar as most rootkits are badly written (just as most software is badly written), that may be helpful. But it only takes one guy to come out with a well-written rootkit...
|
|||||||||||||