Re:The Next Vulnerability: Looking Back on Meltdown and Spec...
by pmoriarty on Saturday February 09, 2019 @12:54PM
(#19123591)
It really would depend on what they did and how they did it.
If the "privileged data" they read was, say, the root password which they used to gain root access and then started snooping around the system as root or modifying parts of the filesystem, that could be easily detected.
If the exploit itself was performed over the network or if the privileged data they read was transferred over the network, that might also be detected, depending on how it was sent and where it was sent to.
If they tried to launch attacks or probes from the exploited system they could be detected at well.
Network intrusion detection systems and host detection intrusion systems could both help here.
If the "privileged data" they read was, say, the root password which they used to gain root access and then started snooping around the system as root or modifying parts of the filesystem, that could be easily detected.
If the exploit itself was performed over the network or if the privileged data they read was transferred over the network, that might also be detected, depending on how it was sent and where it was sent to.
If they tried to launch attacks or probes from the exploited system they could be detected at well.
Network intrusion detection systems and host detection intrusion systems could both help here.