Linux Getting Harder To Crack 553
AlanS2002 points out today's article from Iain Thomson on vnu.net, which says that "Linux systems are getting tougher for hackers to crack, security experts have reported today," summarizing "A study conducted by the Honeynet Project has found that it takes about 3 months before a unpatched Linux machine will be owned, compared with about 72 hours in the past. According to a report on the study default installations are now more secure with less services enabled by default, added to this is newer versions of software such as OpenSSH being more secure. Interestingly Solaris 8 and 9 did not fare so well."
Slashdot Getting Easier to Dupe (Score:5, Funny)
Re:Slashdot Getting Easier to Dupe (Score:4, Informative)
Re:Slashdot Getting Easier to Dupe (Score:2)
Re:There is a solution for dupes (Score:3, Funny)
That would save the editors from the trouble of having to actually read the website.
cracked (Score:4, Funny)
Owned? (Score:5, Funny)
Maybe I'm wrong, but shouldn't it be pwnd or 0wned or 0wn3d or 0\/\/|/|3|) or some variation on that instead of owned
Re:Owned? (Score:5, Funny)
Yes, you are correct. The problem is Slashdot doesn't have spell-check yet.
Re:Owned? (Score:2)
Re:Owned? (Score:4, Funny)
How about "pawned"?
Since none of the
(I can't wait for the "What's YOUR excuse?" responses...)
Re:Owned? (Score:4, Insightful)
So you're expecting someone with no income to emigrate to *another country* just because there's an economic downturn.
That's about the lamest thing I've ever heard. If you're unemployed you're going to have trouble getting bus fare let alone buying a new house in a foreign country.
Re:Owned? (Score:3, Funny)
Nope, that's about right. As a newbie I put Slackware on a machine and it took about that long to get X to work with my AGP video card. Until I got a GUI, I didn't feel like I was in control.
Re:Owned? (Score:5, Funny)
interesting (Score:5, Funny)
"A study conducted by the Honeynet Project has found that it takes about 3 minutes before a unpatched Windows SP2 machine to be owned, compared with about 72 seconds in the past.
Re:interesting (Score:2, Funny)
Re:interesting (Score:5, Insightful)
Tell the millions of gamers out there about it.
Re:interesting (Score:2, Insightful)
Re:interesting (Score:3, Insightful)
Re:interesting (Score:3, Insightful)
Certianly as soon as all their Win games run with no issues.. OOPS, they haven't done that with Windows yet!
Re:interesting (Score:4, Insightful)
Re:interesting (Score:5, Funny)
Re:interesting (Score:3, Insightful)
Linux itself really doesn
Re:interesting (Score:3, Interesting)
Even if the firewall were enabled, this is a pre-SP2 box he was talking about. That still leaves a short window of vulnerability, as Windows XP will bring up the firewall after the networking is set up.
MartAs a Linux User... (Score:3, Interesting)
Re:As a Linux User... (Score:2, Funny)
Re:As a Linux User... (Score:5, Informative)
To create a zombie for a DDoS attack, to host child pornography or warez, to use as a spam relay. All of these and more are reasons home computers are attacked. All they want are more systems in their arsenal, to make them more resilient and more effective. It doesn't make much difference if it's a home PC or a workstation in some office somewhere.
Re:As a Linux User... (Score:5, Insightful)
A router routes packets. (Score:2, Insightful)
Did he mean "firewall" instead of "router"?
I don't think he did because he refered to his "unfirewalled SP1 Windows XP box".
Unless he refers to a NAT'ing device as a "router".
Re:A router routes packets. (Score:2, Insightful)
No it hasn't. Beyond the false assumption that every machine ever cracked was directly beyond a router(aka cheapo linksys), many/most zombies come from people plugged directly into to the Net with no buffer. How do you think all of those worms spread so fast when all they do is simple port scans to find hosts to propagate with? Scans that a router running NAT would block. The real threat comes from users plugged directly into their
Re:A router routes packets. (Score:5, Informative)
How do you think your traffic gets from point A to point B on the net, though? Routers.
Re:A router routes packets. (Score:5, Informative)
Re:A router routes packets. (Score:5, Informative)
On cisco it's also the "nat overload".
NAT leave you somewhat vulnerable it's a mapping address for address (many to many). Don't feel secure with NAT without firewalling.
PAT is much more closed (many to one).
It's also true that everyone say NAT when they do PAT.
Re:A router routes packets. (Score:3, Insightful)
Hmmh. I see the point that "network address translation" kind of implies a one to one relation between external and internal addresses.
However, to me "port address translation" sounds worse because the *network address* is still the key thing that gets changed in a many to one situation. The fact that the router assigns a new client port for outbound connections is just a side effect. The server and client still use the same ports, regardless the router does in between.
"PAT" sounds more logic
Re:A router routes packets. (Score:3, Informative)
I'd say you have NAT with port forwarding. Apparently for purists it's PAT. For the moderates it's probably both since they'd see PAT as a special case of NAT (only one external address).
Re:A router routes packets. (Score:5, Insightful)
1. Hub
2. Switch
3. Router
4. Firewall
5. NAT
6. Proxy
7. Modem
Next, explain to us how packets from computer A with ISP X on one side of the world, can possibly attack computer B with ISP Y on the other side of the world without going through at least two routers.
Re:A router routes packets. (Score:5, Funny)
http://www.ietf.org/rfc/rfc1149.txt?number=1149
Re:A router routes packets. (Score:3, Funny)
In related news, Remington [remington.com] has announced that it will invest in IT, specializing in Internet security systems. They have already released a number of RFC-1149 compliant firewall appliances [remington.com].
Re:A router routes packets. (Score:5, Funny)
Simple.
Computer A is set to capture its outgoing packets and print them into a piece of paper. This paper is then given to a ninja, who leaps to the other side of the world, types in the packet into machine B, and sends it through the loopback device. 0wn3d !
Moral: firewalls are no defense against ninjas ! In fact, don't have a firewall, because if you do, a ninja will come and 0wn your computer, then flip out right there ! You wouldn't want a ninja to flip out in your house while you're asleep, now would you ?
Re:As a Linux User... (Score:3, Insightful)
Re:As a Linux User... (Score:2, Informative)
They aren't after your data - just your connection (Score:5, Insightful)
And most of the spam I see is from home machines that have been cracked (zombies).
Not to mention the DDoS zombies out there.
They'd be happy to get your credit card info off of your home machine, but they attack to turn you into a zombie with bandwidth.
Re:They aren't after your data - just your connect (Score:4, Informative)
Re:They aren't after your data - just your connect (Score:3, Informative)
Combine the little blue box with
Re:As a Linux User... (Score:5, Interesting)
As far as you know. Gone are the days of random vandalism, where if your box was cracked you knew about it the next day. Today's box is owned not to trash it, but to use it. If your Windows box is owned, you won't always know about it, until it is sold called into use to serve its new master.
Re:As a Linux User... (Score:2)
That's true of any OS, not just Windows.
Re:As a Linux User... (Score:5, Funny)
Being infected with "just a bit of spyware" is like being just a little bit pregnant.
SCO (Score:3, Funny)
RedHat comes with a pretty good iptables setup (Score:5, Interesting)
Quite refreshing to see, since I was doing the install for a customer who'd decided to go for a reimaging because their machine had been compromised.
Re:RedHat comes with a pretty good iptables setup (Score:2)
Re-image because of a little thing like the box being owned? I worked for one place that let some SunOS (not Solaris) machines go after being compromised because our sites were working, and the sysadmin didn't know what they did. (At least these machines didn't processes credit cards)
This was before I worked there, and when the current sysadmin started he bought some linux (or BSD, I'm not sure) servers and moved over to something more secure. Hasn't had a problem yet.
RedHat 6 vs. Win98 - Windows was safer (Score:3, Interesting)
Re:RedHat comes with a pretty good iptables setup (Score:2)
Re:RedHat comes with a pretty good iptables setup (Score:3, Interesting)
Re:RedHat comes with a pretty good iptables setup (Score:3, Insightful)
how is that "interesting"? (Score:2, Insightful)
DUH!
However: (Score:2)
So presumably any compromises of Solaris production system may mean big-trouble for it's operating companies.
This, I would suggest is the reason for the comparison.
In Case it get's /.ed (Score:4, Funny)
(Ranked from most crackable to least crackable)
Linux>Solaris>Glass>Windows
Re:In Case it get's /.ed (Score:3, Interesting)
is this a joke, or did you reverse your 's? Either way, you just made Linux much easier to crack than glass...
Re:In Case it get's /.ed (Score:3, Informative)
Really messed that post up.
Re:In Case it get's /.ed (Score:3, Funny)
Oh. He must have been referring to an independant study funded by Microsoft.
I'm sure it's coming soon.
Re:In Case it get's /.ed (Score:2)
Re:In Case it get's /.ed (Score:2)
when will it reach vms standards? (Score:5, Interesting)
The game began at 10 a.m. on Friday. The VMS machine on the Green team was configured with Apache web server. As we are aware, VMS is an extremely secure operating system. While many of the other boxes in the room, mostly Unix, linux, and forms of windows, and even a Macintosh, were compromised and subsequently attended to by their masters, the VMS system remained intact. Here is where a real security issue comes into play.
We were very confident of the VMS box, and a lot of interest was generated by it. In the spirit of spreading the good word and educating the people about VMS, we ended up answering a lot of questions about VMS, and showing how the machine automagically added user accounts, and demonstrated the various terminal games and web pages which had been created. We were also aware that, in this crowd of 5000+ hackers, someone might be able to weasel their way into the machine if any security measures were taken lightly.
As events would have it, we had an issue, which we did not understand, with the operation of the serial port used as the operators' console. At 2:00 a.m. Saturday morning the system manager decided to telnet to the box in order to do some routine checks. Using Telnet in an environment with 5000 hackers on your network is an insecure method of administering a computer system. A lot of people were fascinated by the VMS system, and had asked many questions about it, shoulder-surfing the console operator, who of course answered their questions in this friendly game of an environment.
One of the hackers who had been showing a lot of interest in the VMS box happened to be sniffing packets from the system manager's PC. He discovered the password to the account, a simple procedure any 13 year old kid can pull off with ease after a little social engineering. The hacker logged in, and placed a couple text files (his mark for points) in the manager's user directory, and then notified the system manager in order to claim the points. There were no points for hacking the machine because the files were placed in a user directory instead of the `root' VMS directory. He was awarded 10 points for social engineering.
Was this an instance of VMS being hacked? No, it was just a circumstance where a privileged login session was passed in plaintext over a network with 5000 mechanics, social engineers, and hackers on it. By using a telnet session on an open network, the system managers' login information was freely made available to any who cared to record it. Giving away your login info in this way to a hacker who subsequently uses it does not constitute being hacked, it constitutes an error in security procedure. The thought of improved security, such as some level of encryption for telnet on VMS, immediately comes to mind. Be very afraid.
The Alpha was disconnected from the haxor network, the serial port issue (our fault alone) was fixed, and the network was reconnected. The incident did not repeat, nor did any hack whatsoever of the VMS system take place during the event. The hackers bombarded the box with telnets and ftp attempts to every bizarre port number imaginable, obscure ports in the 40,000 range and more. The word of the early-morning incident had spread, and those seeking glory and a reputation besieged the box.
Another kind of social engineering, involving a clever lie intended to trap those who would think it cool to hack the NOC was presented in this way: People came by, with an IP address, saying, "here is the IP address for the NOC, have fun". It was really an outside IP address, and this was a ruse to make those who listened loose points for attacking sites outside the defcon network. Hacking outside the CTF network was forbidden.
As the game progressed, the goons announced that there were not enough hackers (huh? The tables were *full* of people). To make it more enticing, the point award for placing your mark in the root directory of a server
Re:when will it reach vms standards? (Score:2)
Interesting. (Score:5, Interesting)
(The idea being to discourage people from playing at skript-kiddie, but concentrating on the real challenges. Using the above logic, if a box was "practically uncrackable", the incentive should be so great that it becomes almost the sole focus.)
As for Linux, a correctly-configured hardened box should come close to VMS in security. The sorts of things that you could configure to do this are as follows:
The reason for so many steps is that Linux is flexible. Flexibility, if used well, can make for an extremely tough system. If used badly, it can make for a highly vulnerable system. Mistakes are not always easy to catch, so it's better to have enough independent redundancy that a failure isn't catastrophic.
VMS had flaws, too, and could be easily mis-configured. (Being able to put DCL scripts in mail subject lines was plain stupid.) But, again, if set up well, was virtually bullet-proof.
Very true (Score:3, Informative)
Just because the bozo in the above story didn't know what to do once in was in the box, doesn't mean that other bozos won't be more ambitious or do more sniffing.
Windows is down to 4 minutes... (Score:5, Informative)
FreeBSD? (Score:4, Interesting)
not again (the partisanship) (Score:5, Interesting)
if it is indeed true what this study claims then i am the first to applaude the kernel guys and the distribution makers.
but there are facts that won't change:
- software monoculture is BAD (no matter what the monoculture consists of)
- linux is NOT the safest alternative out there (compare *BSD, VMS,
- there have been an alarming number of exploits as well for the kernel itself (local root exploits, anybody) as also many exploits for user land applications (mplayer, mpeg123, mozilla,
SECURITY IS A PROCESS NOT A STATE!
please, dear media (and also dear slashdot), make an effort to educate people in security matters instead of putting some solution on the "security pedestal". don't make claims about the absolute security of any alternative.
the complete solution is what makes and breaks security, not the components, and without adequate, highly trained and proficient personell it will always be near impossible to achieve truly secure (whatever THAT means) solutions.
well, at least the uprising unices make it easier for the proficient and maybe even raise the security bar for the amateurs, but alas this is not an end to itself!
jethr0
Re:not again (the partisanship) (Score:2)
well, at least the uprising unices make it easier for the proficient and maybe even raise the security bar for the amateurs, but alas this is not an end to itself!
And yes, I've been here a long time...
davidu
Re:not again (the partisanship) (Score:4, Insightful)
Wrong. Security is a state. Securing is a proces. Look them up, they're in the dictionary.
I usually hear that quote from people who want to make a living out of implementing security. The fact is, with the current state of systems, a lot of time needs to go in to creating a secure system and keeping it secure. This is not inevitable however. As time goes on, computer systems and networks will simply be more secure by default, especially thanks to all the hackers out there that find the holes and let us know about them (often times via the always funny "I infected you with a virus" method.
software monoculture is BAD
There are huge powerful upsides to a monoculture. Sure there are downsides too but I think in the end we will have one and it will be a huge benefit, even to security.
And 640K should be enough for anyone.
If you really think that it is impossible for security to happen automatically, ask your self exactly what is it that a security professional can do that it is theoretically impossible to automate.
Re:not again (the partisanship) (Score:3, Informative)
If the security gets better (just like it has over the past 40 years) its because the good guys are usually behind by a few steps, if they weren't behind they wouldnt know what to secure, or why. Even given the assumption that security somehow catches up with what the people attacking the systems are doing your also assuming that the people do
Re:not again (the partisanship) (Score:3, Insightful)
133t... (Score:5, Funny)
Stop nagging, I'll get to it.
Re:133t... (Score:5, Funny)
Stop nagging, I'll get to it.
It's not that all 4 weren't compromised, it's just that they didn't notice me. I guess you're the one they caught on the first 3? It's okay, keep practicing.
Fairwell, English grammer (Score:4, Funny)
Hardening Linux works! (Score:2, Informative)
Unpatched? (Score:5, Insightful)
In other news... (Score:5, Funny)
Comment removed (Score:4, Insightful)
Re:In other news... (Score:4, Funny)
cause an defect relationship? (Score:2)
Half Truth (Score:5, Insightful)
Gene Spafford was interviewed by linuxplanet [linuxplanet.com] couple of years ago. He says why linux isn't completely secure, even though it is a outdated interview, I will like to say most of his ideas do make sense even today.
Even if those honeypots are harder to penetrate that does not mean drivers, or individual applications that many people use are designed with security in mind first. Hackers are always going to be around all this means is that script kiddies are going to be able to do less and less to break into a linux but but more sophisticated hackers are going to want to try harder and within time. You will have the same problems just like in real life a ADT system can make your home safer does not mean you still will not get broken into. Plus, within this article you should be asking who are the security experts?
All in all I would hope people read this article in hopes that linux is their solution too security out of the box. In other words if you believe in security do not rely on the distro. to be 80% secure even if you locked the system up tight like your suppose too you still have a good chance of getting hacked. This article is just showing business people in the IT world that they can setup linux and not need a administartor with good experise to be hired instead of that person they can pay half as much with little experence to manage the network because linux is so secure. See where I am going with this article?
Hardening systems works! (Score:5, Informative)
Red Hat, on the other hand, has moved to both turning no remotely-accessible inetd/xinetd services on by default and offers an easy install-time firewall that works transparently on workstations and very simple servers. The difference in exposure of vulnerabilities to attackers is tremendous. The vulnerabilities may still be there, but the attacker often can't get to them or can't get the same level of privilege out of them. For instance, running OpenSSH in privilege-separated mode the way most Linux distros do now means that some exploits don't work, while others only grant the attacker non-root access.
Linux vendors/creators have led the commercial Unix world in pre-install hardening - I like to think this is due in part to the success of Bastille Linux [slashdot.org], a hardening program for SuSE, Red Hat/Fedora, Debian, and Mandrake Linux, as well as HP-UX and Mac OS X. Bastille ships on recent HP-UX O/S's, is available from both Debian and SuSE as a vendor-supplied package.
Security is a strong concept of safeness (Score:4, Interesting)
We analyzed the various systems available to us at the time we were making the rearchitecture decision, some six months ago or so, and quite rapidly we reached a decision based on the data. That is.. Linux would be more secure in our company because we already have the technical people using Linux outside of work who would be able to already understand the system and be able to fix specific and non-specific security issues themselves rather than having us rely on an outside contractor or vendor. This meant we could buy vanilla beige boxes and install Linux, set up all of our business processes, all without having to go to one of those vendors such as RedHat, Sun, or one of the other many vendors in the Linux field.
So, security is a strong concept of safeness for us, and we're glad we're running Linux.
How about testing against NAT/routers? (Score:5, Interesting)
How about a study like this against the varous NAT/routers being used out there? How easy is it to own systems sitting behind those? This appears to be the standard anymore for the millions of cable/dsl connections.
Client Side Attacks (Score:5, Interesting)
Of course, this kind of analysis would require a more involved approach to testing O/S security, rather than just installing an O/S, throwing it on the internet and sitting back and waiting for whatever randomly happens to it to happen, which doesn't really seem to be the way honeynet likes to operate.
Keep in mind that Honeypots were originally intended to track the behavior of so called blackhats, not to analyze the security of operating systems, and they probbably aren't the best choice for the job.
The Way to a 100% Secure System (Score:4, Funny)
http://www.worleybuggerflyco.com/flytyingtools/arr ow_diagram.jpg [worleybuggerflyco.com]
Statistically Insignificant (Score:4, Informative)
SELinux (Score:3, Interesting)
Do people still get rooted running something like Fedora Core 3 with SELinux? I can imagine they do, you just don't really hear about it anymore. Perhaps the system is still too new to tell either way. If every daemon is locked down with a targeted SELinux policy in the future, and I see no reason why you wouldn't want this once someone has done the work of writing the policy, perhaps we'll see a dramatic reduction in compromised systems.
Re:Not even remotely scientific (Score:3, Interesting)
They have an experiment they run, and they measure the outcomes. The measurements over time have changed. They compared the measurements.
That's pretty much the textbook definition of "scientific" and "statistics".
No, this "study", might be an anecdote (I'm unaware of how many machines they have). However, it is a "fact", N months that putting an unpatched Linux
Re:Not even remotely scientific (Score:2)
Re:Not even remotely scientific (Score:5, Insightful)
You can only draw those conclusions about water because someone has done all the scientific measurements before you.
We didn't figure out gravity all at once. Some guy started dropping balls and measuring time. Some guys started measuring the time it took to roll down planks. Eventually they made lots of measurements that were "big boiling pot of useless variables", and figured out that air resistance makes a difference. That if you measure incredibly accurately, that the latitude and longitude (more specifically your distance from the center of the earth) matter. Even more accurately, what time of year does matter (our distance from the sun changes). They sorted out the patterns in the data. What they are doing is called "basic science". It isn't sexy, and it isn't useful right away. However to start something that a is a "science", you have to start by making measurements and then explaining them. Explain to me roughly speaking, how one makes "Scientific" measurements on the internet where you have control groups? How precisely does one setup a second world wide interent that is identical in all ways except one has an extra Linux machine on it? Maybe if they continue to make such measurements, they might figure what the variables are.
That's precisely what they are doing. I'd have to read the actual statement they made to see how well they are lying with statistics. My guess is the statement they made was accurate and accurately captured what it was they measured.
Also, I'm going to guess they used the same RedHat distributions (or at least had all of the old ones, and some new ones), and they used all the same old IP's (or at least used all the old ranges, and some new ranges). So I'd further venture to guess that your "boiling water" analogy is incorrect. I've read about these guys quite often. They are fairly "scientific" about what they do, and how they do it. The biggest problem they have is man power to setup and analyze the machines and attacks. Which is really a function of their other big problem, a serious lack of financial resources. What they are doing on a large scale would result in really useful measurements. Sure what they are doing is on the level of "Grade School Science Projects" in terms of the scale and quality of science. However, that doesn't make it any less "scientific".
As to this:
Useful science, is called "Engineering". Useless science is all over the place. Science is about forming a hypothesis, setting up a way of measuring your hypothesis, then analyzing the data after the fact. This sure seems to fit the bill. Useless Science, is how all science started. Next you'll tell me Linux isn't at all like Unix, because it started out life as a useless terminal program.
Kirby
Re:Not even remotely scientific (Score:2)
Re:Not even remotely scientific (Score:2, Insightful)
Re:Not even remotely scientific (Score:5, Insightful)
You really should read up on the honeynet project sometime before saying silly things like this.
For starters, they have in fact found previously unknown exploits (at least one, but possibly several). I forget the exact details off hand, but in "Honeypots" (A pretty decent book), it is covered. They cover it in the section about different types of honeypots and what they are good for. They discovered a hole in a network service that was previously unknown on Linux machines several years ago when the project first started. I can cite it tomorrow if you really don't believe me (the book is at home, I'm not). A lot of blackhats give out zero days as a way of gaining credibility. While it wans't a zero day, a honeypot was one of the first things to figure out how one of the Major worms worked (Code Red I think, but it might have been one of the others).
Also, black hats need a platform to mount their attack from that they can easily own without worry. So they attach home networks knowing that they can complete own a box and wipe the logs. Meanwhile, they can mount attacks from those machines onto others that are important. They need the intermediate machines to be anonymous. They might want to attack "American Express", or "Amazon.com". Anyone with any brains doesn't attack those from the IP's known to be in their basement. They find other machines that will have no logging, or logging that can be completely compromised to use as a base of attack. Then the trail to find them dies at these random machines on the interent.
Besides that, any one wanting to implement a "Andy Worhal Worm", needs to find a set of machines that have an exploit available. In order to find those, one has to start attacking random machines on the internet. The honeypot project could accomplish that (I don't know that they have, but it would be a very good use of it).
Finally, I don't have any important machines, so information about random machines on the internet fits me to a "T". I am more interested in what the script kiddies are doing, and what sorts of attacks they are making. The honeynet project does provide details about what JRandom guy with an IP on the internet can expect to be hit with.
Kirby
Re:Not even remotely scientific (Score:3, Insightful)
Max
Re:Better interpretation of the results: (Score:2)
Re:Spelling (Score:2)
Re:Security (Score:5, Informative)
1) Even way back in solaris 2.5 (and probably before that, but that is when I started), you could just download the latest patch cluster, run 'install_cluster', and then reboot when you were done (if required... see below). That was it. No muss, no fuss... A new cluster was generated every 2 weeks for the lazy admin who wanted to stay up to date with patches yet not actually read the patch notes
2) Nowadays, its even easier... All you have to do is install the latest patchpro. Then you can do several things. For the brave/stupid, you can run smpatch (the main patchpro command) out of cron and have it automatically fetch and install the latest `non reboot` pathes and install them. For those of us who have to run under a change control system that requires notifying others of changes, there is `smpatch analyze`, `smpatch download` and `smpatch add`.
You can use the analyze command to generate a list of patches in order of dependencies and then feed that list into your change control system for tracking what you applied. The use the 'download' and 'add' commands then take that list and download them to the system and then add them to the system. (the 'add' command will also perform the download if you dont want to stage them ahead of time.)
If you made any 'major changes' like an updated kernel, you'll want to reboot. If you didnt apply any patches that require a reboot, then no problem, dont reboot. Some patches may say that they require a reboot, but a savvy admin (or a daring one ) can get around those 'recommendations' reloading the impacted kernel modules (sun even has a way to hot patch the kernel for those customers that absolutely can not bring the system down anytime soon)
Even 'apt-get update' needs a reboot when you change big things like kernels or major libraries (or at least restarting all apps/services/whatever that use those libraries, at which point you may as well just suck it up and reboot since the service is going down. You didnt think that those running apps would get all of those libc.so updates without restarting did ya?)
And as an extra added bonus, smpatch only downloads signed patches and verifies the signature before installing.
Re:Maybes (Score:2)
Re:LEADING ANALYSTS CONFIRM IT... (Score:4, Informative)