Re: self authentication for sensors in ids ?

[Stefano Zanero <stefano.zanero () ieee org>]

Martin Roesch wrote:

> Not sure I understand this one, if the sensor falls into an attacker's  
> hands the sensor can be made to report anything (or nothing).

Yes, there is no real way to recognize if something running on a 
compromised machine has not been tampered with.

Anything you throw in can only slow the attacker down, not stop him.

Stefano


---------------------------------------------------------------------------
---------------------------------------------------------------------------