Re: Britney and Kevin are Chaotic

[joanna <joanna () invisiblethings org>]

El Nahual wrote:
> Fastly and stupidly saying, there is a nice solution to stop all malware and
> virus and bds, sign your shit and get anal on getting it to work, you can
> heck out the stuff on www.se46.se we are coding the unix version of it (so i
> wont get that tramped once it gets known)

attacker exploits some bug in the legitimate (certified) system process; 
the shellcode downloads and installs rootkit in the system; the rootkit 
makes traditional HIDSes, like Tripwire and probably your se46 (idea 
seems quite similar to thing called "Windows Software Restriction 
Policies" btw), completely blind to what is happening in the system...

what I would like to stress is that file system integrity is just the 
very beginning of host-based IDS. even if desktop computers are concerned.

joanna.
_______________________________________________
Dailydave mailing list
Dailydave () lists immunitysec com
https://lists.immunitysec.com/mailman/listinfo/dailydave