[SCADASEC] Major Linux security hole found

[ljknews]

At 4:19 PM -0600 2/12/08, Clint Bodungen wrote:

> I *was*, in fact, only speaking of a remote/outside attack.  I purposely
> left out the insider aspect because if you already have an insider on a
> critical system capable of executing a privilege escalation exploit,  you're
> already screwed.  An insider with mal-intent, and even less skill, can still
> do much worse than execute a stupid privilege escalation attack. 

Any organization confident that they have eliminated all
possibility of having a malicious insider should get out
of whatever business they are in and switch over to doing
personnel consulting for vulnerable organizations, including
those US government agencies who have had top secret data
deliberately compromised by insiders.

Perhaps most egregious was the Walker case where a US Navy
insider gave/soldcrypto  keying data.  I am sure they would
love to have a solution to absolutely avoid insider attacks.
-- 
Larry Kilgallen