Re: SSSCA: We're in trouble now

[Helge Hafting <helgehaf@aitel.hist.no>]

Petro wrote:

> > Don't be too sure about that.  If a "few" knows how to circumvent,
> > they'll release circumvention kits that anybody can use.
> > Few people can use a new buffer overflow exploit, much
> > more can use a rootkit.
> 
>     That will end when you get a tripwire like system on each system
>     that reports back to Microsoft/Apple when certain critical binaries
>     don't match.

There is a difference between a circumvention kit and a rootkit.
The rootkit modifies stuff in order to hide itself.
The circumvention kit doesn't.  It doesn't modify any
"official" binaries - it provides its own binary and lets
the other one sit there.

If this is impossible somehow - replace the tripwire-like system
as well as part of the circumvention kit.  More work,
still possible.  Or firewall the port used to report back
to vendors...

There is so many options.  They may try - they will fail.


Helge Hafting