| |||||||||||||
Moving targetMoving targetPosted Nov 22, 2012 9:06 UTC (Thu) by man_ls (subscriber, #15091)In reply to: Maybe running such an old kernel is a bad idea by alison Parent article: New Linux Rootkit Emerges (Threat Post) A moving target is usually of no help in this situation. As we have seen in kernel vulnerabilities, an unpatched hole in version n is likely to be carried over to n+1, so whatever attack works on one version will work on the next -- until fixed once and for all. So it is 0-day or no-day. With stable versions, security fixes are backported from latest releases. There is an increased maintenance burden, but otherwise security should be similar. Again, 0-day or no-day. The advantage of quick releases is mostly decreased maintenance.
(Log in to post comments)
Moving target Posted Nov 22, 2012 20:08 UTC (Thu) by redden0t8 (guest, #72783) [Link]
Except as Robert S points out, even if the vulnerability is still there, the actual exploit implementation often has to play catch-up to work on the new version.
Moving target Posted Nov 23, 2012 9:47 UTC (Fri) by nix (subscriber, #2304) [Link]
So it helps us defend against *badly-written* rootkits? I suppose insofar as most rootkits are badly written (just as most software is badly written), that may be helpful. But it only takes one guy to come out with a well-written rootkit...
|
|||||||||||||