crispin cowan crispinwirexcom ben mord wrote original message crispin cowan mailtocrispinwirexcom sent wednesday september 04 2002 546 pm ben mord cc webappsec securityfocuscom secprog securityfocus subject use base image delta image automated recovery attacks ben mord wrote inspired mode operation supported vmware use vmwares ability rolll back state recover intrusions dissertation work area optimistic computing interested applying security problem unfortunately hit bunch problems commit state good cant run redo log forever performance storage penalties accumulate even log structured file systems garbage collect eventually commit sometime problem commit eagerly might commit corrupted state commit conservatively eat performance storage penalties discover corrupted state middle redo log want critical state comes need way dig corruption middle save rest dissertation solves problem rewrite everything programming language imposes substantial performance penalties love vmware use every day best 200 ever spent software fast proposed solution first two problems mention less ambitious idea never commit instead simply revert base state reboot ah case use something considerably less powerful vmware need machine configured boot cdrom use ram disk scratch space numerous linux distros available let boot stateless functional system cdrom obviously cant partitions accrue important state eg partition stores database table data want state persist need mountable writable partition protect need kind access control management decide writable partition blah blah blah know security problem starts look like conventional servers simple approxmation make usr separate partion mount readonly good news attackers want trojan software reboot least bad news administrators want update software reboot least crispin crispin cowan phd chief scientist wirex httpwirexcomcrispin security hardened linux distribution httpimmunixorg available purchase httpwirexcomproductsimmunixpurchasehtml wed 04 sep 2002 163003 0700 use base image delta image automated recovery