Subject: Re: verified executable kernel modification committed
To: Gavan Fantom <gavan@coolfactor.org>
From: Seth Kurtzberg <seth@cql.com>
List: tech-security
Date: 11/03/2002 09:41:58
That's a good point.  There are some situations, though, where this is
undesirable.  Drives are inexpensive, but the cost is not zero.  More
significantly, two drives consume significantly more power than one. 
You might argue that it takes a somewhat more sophisticated person to
defeat the system (because you could check for the device in software
and because any monkey can replace a cable), but it may be true that
anyone who cares enough to open the box is probably capable of defeating
it.

On Sun, 2002-11-03 at 05:51, Gavan Fantom wrote:
> On 1 Nov 2002, Seth Kurtzberg wrote:
> 
> > Specifically, I've been working on a fairly simple device that can be
> > placed between an IDE drive and an IDE cable.  (There's nothing specific
> > to IDE here; it is just the mostly commonly used interface at the
> > moment.)  This device has a table, stored in non-volatile memory, which
> > marks physical disk blocks as read-only.  Then, any write request for
> > one of these blocks never arrives at the drive.
> 
> Wouldn't an easier approach be to put all the read-only files onto a
> separate hard drive and then cut the write line? A second hard drive isn't
> particularly expensive, and would be much easier than compiling a block
> list and storing it in NVRAM.
> 
> -- 
> Gillette - the best a man can forget
> 
-- 
Seth Kurtzberg
M. I. S. Corp
480-661-1849
Pager 888-605-9296, or 6059296@skytel.com