Nmap Security Scanner
*Intro
*Ref Guide
*Install Guide
*Download
*Changelog
*Book
*Docs
Security Lists
*Nmap Hackers
*Nmap Dev
*Bugtraq
*Full Disclosure
*Pen Test
*Basics
*More
Security Tools
*Pass crackers
*Sniffers
*Vuln Scanners
*Web scanners
*Wireless
*Exploitation
*Packet crafters
*More
Site News
Site Search:
Exploit World
Advertising
About/Contact
Credits
Sponsors:
edgeos



Honeypots: Re: sebek as a patch?

Re: sebek as a patch?

From: <Valdis.Kletnieks_at_vt.edu>
Date: Wed, 05 Oct 2005 15:18:24 -0400

On Thu, 06 Oct 2005 01:29:21 +0900, NAHieu said:

(Just a gentle reminder for the readers)...

> In sebek environment, we better disable /dev/{kmem,mem}, together with
> loading module capability. Then nobody can no longer access to kernel
> memory, no?

Barring *other* bugs/issues. One of the single most dangerous things when
doing security is confusing "all known ways of doing XYZ are blocked" with
"there is no possible way of doing XYZ".

(And another reminder for everybody - remember to trim extraneous quoted
material..)

  • application/pgp-signature attachment: stored
Received on Oct 05 2005
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
edgeos