[Gllug] just preaching to the converted !

[Nix]

On Sat, 22 Oct 2005, Tethys suggested tentatively:
>                                                                I can't
> remember the precise details, but someone wrote a bit of code that
> executed either executed certain opcodes in a given order, or did
> something else funny (interrupt timings, maybe?), That in turn
> had a measurable effect (CPU temperature? something else?), which
> could be detected by a process at a lower privilege level. That was
> then used to transmit information from one level to the other using
> morse code. *Very* clever, and very hard to protect against.

And hyperthreaded CPUs now add another avenue of attack (which
fortunately is easy to protect against: only schedule processes with
identical MAC labels on the same physical CPU at the same time; it
might lead to a lot of wasted CPU time though).

>>Linux could have that problem today if popular apps on Linux had been
>>written by blithering short-termist fools with no understanding of
>>security
[...]
> See, we already *do* have apps like that under Linux. I bought one of the
> LGP games IIRC, and it needed to be installed setuid root so that it could
> write to /etc and /usr/bin

*brain melts*

Writing to /etc is bad enough. Writing to /usr/bin is an offence
warranting slow execution by firing squad.

>                            (in a laughably trivial-to-crack anti-piracy
> measure).

The authors had never heard of unionfs nor per-process namespaces...
and of course a small custom kernel patch or LD_PRELOADed library could
easily get around that.

> Fortunately, such stupid apps are rare, but they exist under Linux just
> as they do under Windows.

It's the rarity that differs. Under Windows it seems to be the norm.

-- 
`"Gun-wielding recluse gunned down by local police" isn't the epitaph
 I want. I am hoping for "Witnesses reported the sound up to two hundred
 kilometers away" or "Last body part finally located".' --- James Nicoll
-- 
Gllug mailing list  -  Gllug at gllug.org.uk
http://lists.gllug.org.uk/mailman/listinfo/gllug