Messages in this thread |  | | Date | Fri, 13 Dec 2013 09:20:45 +0100 | From | Vegard Nossum <> | Subject | Re: [PATCH 1/9] Known exploit detection |
| |
On 12/12/2013 08:06 PM, Theodore Ts'o wrote: > On Thu, Dec 12, 2013 at 05:52:24PM +0100, vegard.nossum@oracle.com wrote: >> The idea is simple -- since different kernel versions are vulnerable to >> different root exploits, hackers most likely try multiple exploits before >> they actually succeed. > > Suppose we put put this into the mainstream kernel. Wouldn't writers > of root kit adapt by checking for the kernel version to avoid checking > for exploits that are known not work? So the question is whether the > additional complexity in the kernel is going to be worth it, since > once the attackers adapt, the benefits of trying to detect attacks for > mitigated exploits will be minimal.
Yeah, you could probably avoid detection by being more careful. But I think it would be worth making it harder; I'd argue that the "additional complexity" in this case is minimal, since we are mostly talking about ~1 line added to an error path for each critical vulnerability.
Vegard
|  |