Date: Tue, 9 Jan 2018 15:42:07 +0200 From: Georgi Guninski <guninski@...inski.com> To: oss-security@...ts.openwall.com Subject: Own on install. How grave it is? [don't know if this is ontopic. Not on the list so CC me]. This is well known, haven't seen it discussed. In short doing clean install (factory defaults) has a window of opportunity when the device is vulnerable to a known network attack. It used to be common sense to reinstall after compromise (probably doesn't apply to the windows world where the antivirus takes care). All versions of windoze are affected by the SMB bug to my knowledge. Debian jessie (old stable) is vulnerable to malicious mirror attack. More of interest to me are devices where the installation media is fixed and can't be changed. This includes smartphones and wireless routers. Some smartphones might be vulnerable to wifi RCE (found by google?). Some wireless routers might be vulnerable to wifi RCE or default admin password attack over wifi. Internet of Things will make things worse (some NAS devices are affected). Shielding the device might not be solution since updates must be applied. Are the above concerns real? Have this been studied systematically?
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.