Re: [SC-L] Countering Trusting Trust through Diverse Double-Compiling

2005-12-15 Thread Steven M. Bellovin
In message [EMAIL PROTECTED], Kenneth R. van Wyk writes: This reminded me of an old class of PC viruses (circa 1992) that evaded detection by file scanners by hooking the S-DOS file read interrupt and returning the original, uninfected version of infected files whenever a program opened up

Re: [SC-L] Managing the insider threat through code obfuscation

2005-12-15 Thread Jose Nazario
On Thu, 15 Dec 2005, Kenneth R. van Wyk wrote: The article's premise is that, because attackers can find out a great deal about the internals of databases and such by decompiling bytecode (in Java and .NET), bytecode should be obfuscated to hide its internal details. The article points to

Re: [SC-L] Managing the insider threat through code obfuscation

2005-12-15 Thread Kenneth R. van Wyk
On Thursday 15 December 2005 09:26, Jose Nazario wrote: if the person can develop exploits against the holes in the code, what makes you think they can't fire up a runtime debugger and trace the code execution and discover the same things? Nothing makes me think that at all; in fact, I was