It's possible that the question might be better over here, but I'm having a hard time making sense of it myself.
@Gilles I'm just a little bothered by @Krzysztof's mention that "it's not normally possible to gain root privileges while exploiting some application run as non root user". If I'm not mistaken, this is exactly what was done in a CEH course I took. I'll have to look through my books to see what app it was, though.
Granted, it was an older application with a known vulnerability to that exploit. But the point is that, without compensating controls in place, it is possible that an insecure application could allow such a thing.
e.g. if you activate SELinux/Apparmor/..., you increase the attack surface inside the kernel
@Iszi it could have been an exploit of an application that's setgid fax, combined with an exploit of a setuid root application that was only executable by the fax group
i.e. privilege separation → longer attack path
there's no such thing as preventing attacks altogether: you can't protect against bugs in the security system
(you can protect against some bugs with redundant features, but by definition, unless you can make a bug-free security system, you're vulnerable)
and, of course, there is no such thing as a bug-free system (that's law #whatever)
@Gilles Interestingly, I'm not sure there's a law for that in the lists I've referenced. However, you can probably get close with Law #10, which is actually in both lists: Technology is Not a Panacaea.
Or, Law #9 of Security Administration: Security is not about risk avoidance, it's about risk management.
@Iszi I didn't mention rootkits specifically because most rootkits run as a driver. the driver load list is in the registry (and win.ini in older OSes), which is covered by a restore.
so the rootkit would actually just stop working, because the driver wouldn't get loaded
Is it a good starting point though, for someone without any prior experience on the subject? I don't wanna pick up something too heavy for my current level.
Although many materials can be found on the internet now, there is just something about a book that i prefer. Reading through large chunks of text on a computer screen can be very tiring on the eyes.
@AndreyBotalov because no one met the thresholds we initially set, we are working with the devs to normalise down a wee bit - so we can make sure we get winners :-)
