Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email email@example.com
Re: [Full-Disclosure] No shell => secure?
From: st3ng4h (st3ng4hcomcast.net)
Date: Fri Jul 09 2004 - 20:08:23 CDT
On Fri, Jul 09, 2004 at 10:41:59PM +0200, Matthias Benkmann wrote:
> Since everybody seems to insist on misunderstanding me
I think people are understanding you perfectly well. Your approach
and your reasoning is the main cause of friction, because they are
both somewhat flawed and lack perspective. The assumption you hold
that 'I have no enemies, therefore I needn't worry about any attacks
that require modification or extra effort to compromise my system'
is, sorry to say, naive, and ideas of putting /bin/sh in goofy
places and dealing with the implications of doing so, in order to
guard against a tiny subset of possible attacks, is
Regardless of whether you want to believe it or not, what you
propose is security through obscurity (or, breaking the system
outright), and if it is your first or only line of defense, you're
caught with your pants down when the first skilled attacker
becomes interested in your system. What's more, the improvement in
security is infinitesimal in relation to the amount of effort
required to get it working properly, or at all.
If you really want to go through the horrendous contortions
necessary to get it working, your ideas can be effective in
deterring automated attacks and the most dimwitted/lazy of
attackers. But if these threats are the only ones you are willing
to take into consideration in securing your system, you're in
> So I have one example to back up my claim. Now it's your turn. Give me a
> worm that my scheme would not have protected me against. That's all you
> need to do to convince me. Easy, isn't it? No need to give me lengthy
> lectures. Just give me one URL. If you can't do that, don't bother
> replying. You're wasting your time, because you're telling me things I
> already know.
I know this game, it's called "Waste Everyone's Time".
Why should anyone play it when your attitude conveys that you will
refuse to understand why your idea is half-baked to begin with,
even if they showed you evidence to the contrary?
Full-Disclosure - We believe in it.