MESSAGE
| DATE | 2005-06-07 |
| FROM | Billy
|
| SUBJECT | Re: [NYLXS - HANGOUT] Device Drivers Filled With Flaws, Threaten
|
Ruben Safir wrote:
> On Tue, 2005-06-07 at 13:59, Billy wrote:
>
>>Ruben Safir wrote:
>>
>>>If the core Kernel is secure, how are they going to gain access to the
>>>device drivers.
>>
>>They who?
>
> Malevolent code writers
Oh. This was NOT obvious, btw.
>>Which Kernel?
>
> GNU/Linux code 2.6.x
No, the kernel itself is just Linux, not GNU/Linux.
>>What drivers?
>
> Any of them. Access is regulated from the Kernel
The kernel can be no more secure than its drivers. Here's
a quick example: FireWire devices usually have full access
to raw memory, and a malevolent FireWire device (an evil Pod
or external HDD with hacked Firmware) can pretty much root you.
I've heard of this from FireWire, probably true of USB, as well.
http://www.answers.com/Firewire
....
Another example, this time a webcam driver screwing up and
making any webcam user into a superuser, because the device
driver writes (unstoppably) out of bounds.
http://secunia.com/advisories/10911/
....
I'm certain there will be dozens more examples if I were
to really look.
|
|
