[ExI] ExI] are we publishing?

[Dave Sill]

On Wed, May 29, 2019 at 12:17 PM <spike at rainier66.com> wrote:

>
>
> Dave, if it is physically possible to enable (by any means, technological,
> bribery or religion-based miracle) privilege elevation, and do so without
> detection, then that server was set up incorrectly.
>

It would be nice if reality was that black and white and perfect security
was achievable and usable, but that's not the case. There are a wide range
of hardware, firmware, and software bugs that can be exploited to elevate
privileges. Even if a sysadmin knew of all of them that were known, that
doesn't mean that there are fixes available for them, and, more
importantly, there are still going to be exploitable bugs that aren't
known: they call them zero-day vulnerabilities.


> It is analogous to a bank vault left hanging open and all the employees
> going out to lunch simultaneously.  If someone wanders in off the street,
> sees, hauls away a coupla sacks of money undetected, that is considered an
> inside job.
>

No, it's more like a skilled bank robber is able pick the bank's door lock
and use a weakness in the vault lock to unlock it.

OK then.  Bank people and licensed SysAdmins are trained how to not let
> that happen.
>

Sysadmins aren't licensed. I've been one for the US Navy and Dept. of
Energy for 30+ years. For the most part, sysadmins aren't even trained. My
BS in Computer Science included 0 hours of system administration and 0
hours of computer security. There are lots of certifications these days,
but employers, including mine, are slow to require them or pay for
employees to attain them.

  If somehow someone does elevate privilege and start downloading stuff
> somehow, the SysAdmin would at least know something is going wrong.  If she
> doesn’t know and the bad guy does get away with the data undetected, that
> is an inside job, and she (the SysAdmin) is in trouble deep.
>

Nope. I know such things *shouldn't* happen, but they do. Often sysadmins
aren't able to do things they want to do, security wise, that their bosses
won't permit or fund.

I am not a SysAdmin, and my limited experience in that area is nearly 40
> years old (DEC 11-750 mainframe) but even way back then, we knew about data
> theft and we knew what precautions were in place to prevent it.
>

IT is *vastly* more complicated than it was 40 years ago. For example, if
you've got an Intel processor, you're probably vulnerable to a series of
bugs that can't be fixed by software or reconfiguration (Spectre/Meltdown
and other branch prediction bugs).

For starters, you would set up with a low-speed data line.  So even if you
> did have a crooked insider attempts to steal data, they wouldn’t get much
> and she would find out forthwith.
>

Until the first user complains that upload/downloads are taking too long,
and if they've got gigabit n/w to their house, how come the servers are
limited to KB/s?

I'm not saying that in this particular case there's nothing the sysadmin
could have done to prevent the breach. I'm saying we don't know how
responsible he is for the system's exploitability,

-Dave
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.extropy.org/pipermail/extropy-chat/attachments/20190529/0cc1898e/attachment.htm>