Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Android 'root' phones via dirtyc0w exploit

gist.github.com

Post reply on HN
Print view View original

21–30 of 72 posts

Re: Show HN: Android 'root' phones via dirtyc0w exploit

#21

Post by Arinerron »

bastijn wrote: post #11

I wonder how many people carelessly run a script that downloads, builds, and executed something with root access. If that zip gets compromised (i.e. The source means harm) there is no end to the pain a careless user can endure. It is like blindly copying and running shell commands you don't understand with sudo rights. My intention is not to offend the author by the way :). It is to remind people to understand these…

That is really true. Any solution you propose? I mean, it is all open source, but if the author of the PoC repository were to put malicious code into the file, how would we know before reading the source?

Do you think I should host the file somewhere I trust, and make it check the hash of the downloaded file from a different to ensure it isn't compromised? My worry then is, what if the hash was compromised too?

I appreciate your response. Thanks!

Re: Show HN: Android 'root' phones via dirtyc0w exploit

#22

Post by slim »

bastijn wrote: post #11

I wonder how many people carelessly run a script that downloads, builds, and executed something with root access. If that zip gets compromised (i.e. The source means harm) there is no end to the pain a careless user can endure. It is like blindly copying and running shell commands you don't understand with sudo rights. My intention is not to offend the author by the way :). It is to remind people to understand these…

From looking at the script and the makefile : you don't need to be root

Re: Show HN: Android 'root' phones via dirtyc0w exploit

#24

Post by bastijn »

Arinerron wrote: post #21
bastijn wrote: post #11

I wonder how many people carelessly run a script that downloads, builds, and executed something with root access. If that zip gets compromised (i.e. The source means harm) there is no end to the pain a careless user can endure. It is like blindly copying and running shell commands you don't understand with sudo rights. My intention is not to offend the author by the way :). It is to remind people to understand these…

That is really true. Any solution you propose? I mean, it is all open source, but if the author of the PoC repository were to put malicious code into the file, how would we know before reading the source? Do you think I should host the file somewhere I trust, and make it check the hash of the downloaded file from a different to ensure it isn't compromised? My worry then is, what if the hash was compromised too? I app…

I think it all starts with educating the careless. Remind them of the risks so in due time they learn to think before they act. Do you have a responsibility as the provider of the script? I do not know, as a true hero you could put a statement on the top of your readme. Like a warning message. One step ahead you can become an even greater hero and host the zip yourself on a secure source. However, this places the burden of maintenance to you which is something which you might not like. In addition it brings the question of ownership.\

I think there is no real answer here. Warn them, and warn them often might be the mitigation.

Re: Show HN: Android 'root' phones via dirtyc0w exploit

#26

Post by Arinerron »

bastijn wrote: post #24
Arinerron wrote: post #21

Earlier quoted context omitted.

That is really true. Any solution you propose? I mean, it is all open source, but if the author of the PoC repository were to put malicious code into the file, how would we know before reading the source? Do you think I should host the file somewhere I trust, and make it check the hash of the downloaded file from a different to ensure it isn't compromised? My worry then is, what if the hash was compromised too? I app…

I think it all starts with educating the careless. Remind them of the risks so in due time they learn to think before they act. Do you have a responsibility as the provider of the script? I do not know, as a true hero you could put a statement on the top of your readme. Like a warning message. One step ahead you can become an even greater hero and host the zip yourself on a secure source. However, this places the bur…

Thanks! What kind of warning message would you suggest? A "the exploit might be compromised" message, a "verify your download with this hash" message, or something else?

Re: Show HN: Android 'root' phones via dirtyc0w exploit

#28

Post by anilgulecha »

Arinerron wrote: post #26
bastijn wrote: post #24

Earlier quoted context omitted.

I think it all starts with educating the careless. Remind them of the risks so in due time they learn to think before they act. Do you have a responsibility as the provider of the script? I do not know, as a true hero you could put a statement on the top of your readme. Like a warning message. One step ahead you can become an even greater hero and host the zip yourself on a secure source. However, this places the bur…

Thanks! What kind of warning message would you suggest? A "the exploit might be compromised" message, a "verify your download with this hash" message, or something else?

One thing you can do is simply fork the repo, and use your repo as the path in the script. So you're not at the mercy of upstream author's changes.
Post reply on HN