Comment on What are You Working on Wednesday
mwguy@infosec.pub 1 year agoInstead of giving it a LLVM based shell, can you give it an actual shell in a container? Maybe backed by AppArmor or SELinux to prevent breakouts
Comment on What are You Working on Wednesday
mwguy@infosec.pub 1 year agoInstead of giving it a LLVM based shell, can you give it an actual shell in a container? Maybe backed by AppArmor or SELinux to prevent breakouts
RedPhoenix@aussie.zone 1 year ago
Tempting, but in order to reduce the potential attack surface, I’m likely just to create a simple simulator instead now.
If it’s good enough to fool the first few interactions of an automated script, that’ll probably do. That’ll give me the curl/wget target they’re trying to insect me with, most likely.
It means I can potentially create a single binary docker instance that can be reset practically instantly by deleting/reimporting.