Hi there.
Andrew van der Stock wrote:
[...]
I'd like to hear from the original vulnerability disclosure writers
(Red Team Pentesting, http://www.redteam-pentesting.de) for how their
correspondence on December 4th - December 6th with Theo went. Maybe
there's more to this than is noted in the opinion piece.
You are right there, we discussed about securelevels with Theo for a
while and his oppinion boiled down to the sentence we quoted in our
advisory. (Acutually this was a the whole content of a single mail)
Of course this statement was not the only response we got from him. He
actually wrote several very long and detailed mails before, explaining
his distaste for securelevels, why they are useless and should be
removed. We did not want to start any Theo-Bashing by quoting his single
statement, it just clearly recapitulates what he said before. No fix was
sensible for securelevels because they are broken by design.
Let's see if the next release of OpenBSD will still contain securelevels.
In my oppinion things would be much better if there was any proper
documentation about securelvels available, clearly stating what they can
do and most important: what not.
Securelevels are no catch-all for root-compromise.
Better Documentation was also suggested by the FreeBSD Security Team,
yet doing "man securelevel" still shows things like:
"The kernel runs with five different levels of security."
Cool, I run Security 5. Now I'm really secured, am I?
[...]
Best regards,
Markus Vervier
--
RedTeam Pentesting Tel.: +49-(0)241-963 1300
Dennewartstr. 25-27 Fax : +49-(0)241-963 1304
52068 Aachen http://www.redteam-pentesting.de
-------------------------------------------------------------------------
This List Sponsored by: Watchfire
Watchfire's AppScan is the industry's first and leading web application
security testing suite, and the only solution to provide comprehensive
remediation tasks at every level of the application. See for yourself.
Download AppScan 6.0 today.
https://www.watchfire.com/securearea/appscansix.aspx?id=701300000003Ssh
--------------------------------------------------------------------------
