User: Password:
|
|
Subscribe / Log in / New account

Maybe running such an old kernel is a bad idea

Maybe running such an old kernel is a bad idea

Posted Nov 21, 2012 10:13 UTC (Wed) by robert_s (subscriber, #42402)
In reply to: Maybe running such an old kernel is a bad idea by alison
Parent article: New Linux Rootkit Emerges (Threat Post)

I was considering this the other day in the context of the "safest" version of Firefox to run - deployed exploits often being adapted for a specific _build_, might the ESR version be the most economical version for attackers to target seeing as it will be in use the longest? (the answer is probably no - a relatively small percentage of people run ESR in the first place)

But I think it's more "security through obscurity" than actual "security bugs being accidentally fixed" that may help you there. Running obscure or frequently changing versions of things could give you an amount of invulnerability to opportunistic attackers toolkits of pre-built, version (and often build)-sensitive exploits.

But I think the argument for such a thing is relatively thin, as it will give you little protection against an "advanced persistent threat".


(Log in to post comments)

Maybe running such an old kernel is a bad idea

Posted Nov 21, 2012 15:10 UTC (Wed) by imgx64 (guest, #78590) [Link]

But I think it's more "security through obscurity" than actual "security bugs being accidentally fixed" that may help you there. Running obscure or frequently changing versions of things could give you an amount of invulnerability to opportunistic attackers toolkits of pre-built, version (and often build)-sensitive exploits.
"Security through obscurity" does not mean running uncommon software/software versions. It means that the security mechanisms are a "secret", as opposed to the keys of such mechanisms.

Maybe running such an old kernel is a bad idea

Posted Nov 21, 2012 15:21 UTC (Wed) by robert_s (subscriber, #42402) [Link]

No, I know that, but the approach I was describing conceptually smells of security through obscurity.

Maybe running such an old kernel is a bad idea

Posted Nov 21, 2012 15:55 UTC (Wed) by alison (subscriber, #63752) [Link]

What we typically term "security through obscurity" would more appropriately be termed "security through secrecy." The point that the latest release of a rapidly developed application presents a less attractive target than the version included in widely deployed LTS release is certainly correct. Cliff Stoll's book _Cuckoo's Egg_ was about how true obscurity can have an unintended protective effect. Firefox, for example, now releases frequently enough that attackers may not finding targeting the "latest stable" version worth their effort.

Moving target

Posted Nov 22, 2012 9:06 UTC (Thu) by man_ls (guest, #15091) [Link]

A moving target is usually of no help in this situation. As we have seen in kernel vulnerabilities, an unpatched hole in version n is likely to be carried over to n+1, so whatever attack works on one version will work on the next -- until fixed once and for all. So it is 0-day or no-day.

With stable versions, security fixes are backported from latest releases. There is an increased maintenance burden, but otherwise security should be similar. Again, 0-day or no-day. The advantage of quick releases is mostly decreased maintenance.

Moving target

Posted Nov 22, 2012 20:08 UTC (Thu) by redden0t8 (guest, #72783) [Link]

Except as Robert S points out, even if the vulnerability is still there, the actual exploit implementation often has to play catch-up to work on the new version.

Moving target

Posted Nov 23, 2012 9:47 UTC (Fri) by nix (subscriber, #2304) [Link]

So it helps us defend against *badly-written* rootkits? I suppose insofar as most rootkits are badly written (just as most software is badly written), that may be helpful. But it only takes one guy to come out with a well-written rootkit...


Copyright © 2017, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds