| 1 |
There's an old saying: The only secure computer is one that is locked in a room, unplugged. Then again, that computer is only as secure as the lock on the door. |
| 2 |
|
| 3 |
|
| 4 |
On Wednesday, November 8, 2017, 1:48:43 AM EST, R0b0t1 <r030t1@×××××.com> wrote: |
| 5 |
|
| 6 |
On Wed, Nov 8, 2017 at 12:10 AM, R0b0t1 <r030t1@×××××.com> wrote: |
| 7 |
> On Wed, Nov 8, 2017 at 12:02 AM, Dale <rdalek1967@×××××.com> wrote: |
| 8 |
>> Dale wrote: |
| 9 |
>>> Howdy, |
| 10 |
>>> |
| 11 |
>>> I ran up on this link. Is there any truth to it and should any of us |
| 12 |
>>> Gentooers be worried about it? |
| 13 |
>>> |
| 14 |
>>> http://www.theregister.co.uk/2017/11/07/linux_usb_security_bugs/ |
| 15 |
>>> |
| 16 |
>>> Isn't Linux supposed to be more secure than this?? |
| 17 |
>>> |
| 18 |
>>> Dale |
| 19 |
>>> |
| 20 |
>>> :-) :-) |
| 21 |
>>> |
| 22 |
>> |
| 23 |
>> |
| 24 |
>> To reply to all that posted so far. I did see that it requires physical |
| 25 |
>> access, like a lot of other things. Once a person has physical access, |
| 26 |
>> there are a number of things that can go wrong. |
| 27 |
>> |
| 28 |
>> It does seem to be one of those things that while possible, has anyone |
| 29 |
>> been able to do it in the real world and even without physical access? |
| 30 |
>> Odds are, no. |
| 31 |
>> |
| 32 |
> |
| 33 |
> The most widely publicized example is STUXNET. There are also reports |
| 34 |
> that malicious USB keys with driver-level exploits are sometimes used |
| 35 |
> for industrial espionage. |
| 36 |
> |
| 37 |
> The key point being that in either case, someone is spending a lot of |
| 38 |
> money to research and set up a plausible attack. |
| 39 |
> |
| 40 |
>> Still, all things considered, Linux is pretty secure. BSD is more |
| 41 |
>> secure from what I've read but Linux is better than windoze. |
| 42 |
>> |
| 43 |
>> Dale |
| 44 |
>> |
| 45 |
>> :-) :-) |
| 46 |
>> |
| 47 |
|
| 48 |
I suppose I should add that once the basic work has been done for an |
| 49 |
exploit like this it will have great reproducibility. But at that |
| 50 |
level you are (usually) talking about very well funded actors, and one |
| 51 |
should also be worried about controller-level exploits that would be |
| 52 |
much harder to discover from an operating system. |
| 53 |
|
| 54 |
If you can't surround your computer with trustworthy armed guards, |
| 55 |
assume you suffer from a serious vulnerability based on the |
| 56 |
preliminary work the article is talking about. |
| 57 |
|
| 58 |
Rainbows and Sunshine, |
| 59 |
R0b0t1 |
Archives