From: Brad Spengler (spendergrsecurity.net)
Date: Wed Jul 16 2008 - 17:01:47 CDT

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Valdis,

Please try to stay consistent with your own arguments. If you defeat
them yourself barely into your third paragraph, you don't give me much
to do!

To summarize:

> have any untrusted local users - for instance, my laptop. The only users
> on it are me, myself, and I<, and the guy that owned my webserver, or
the guy that owned my email client, or the guy that owned my audio
player, or the guy that owned my video player, or the guy that owned my
web browser, or the guy that owned my FTP client, or the guy that owned
my PDF reader, or the guy that owned my office application>

You're a very trusting individual!

This is exactly why telling someone to update if they have any
"untrusted local users" just doesn't make any sense since it misleads a
majority of users. A better replacement would be "if your machine is
network-connected." How do you own a website if you can't break into it
directly? Find out what other websites are hosted on the same machine,
break into one of them, then locally escalate privileges, giving you
access to all the websites hosted on the machine. If you don't think
this happens, you've got your head in the sand and honestly should just
give up having anything to do with security.

-Brad

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFIfm/KmHm2SUJF1GoRApjyAJwP1Q4KUEaOR8kmQWCRZSTTEzDEvQCeIYZj
qHE3YCV5yzE+ps4I4udNIhY=
=NBj2
-----END PGP SIGNATURE-----

_______________________________________________
Dailydave mailing list
Dailydavelists.immunitysec.com
http://lists.immunitysec.com/mailman/listinfo/dailydave

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]