How Torch broke ls and made me vulnerable

on a similar note, this (having '.' or $(pwd) on LD_LIBRARY_PATH) also broke the `ls` command (and a bunch of other stuff) in the TeamWin Recovery Project (TWRP) recovery on mobile devices when you were in `/system/lib` on a 64-bit machine.

https://github.com/omnirom/android_bootable_recovery/commit/...

Re: How Torch broke ls and made me vulnerable

#5

Post by anderskaseorg » Fri, Jun 09, 2017, 4:16 AM UTC

How to safely prepend a directory to a PATH-like variable (in any POSIX-compliant shell):

export LD_LIBRARY_PATH=/opt/whatever/lib${LD_LIBRARY_PATH:+:$LD_LIBRARY_PATH}

Pull request sent to https://github.com/torch/distro/pull/228.

Re: How Torch broke ls and made me vulnerable

#6

Post by foota » Fri, Jun 09, 2017, 5:16 AM UTC

Seems like this may almost have been better done through a disclosure channel with torch?

Re: How Torch broke ls and made me vulnerable

#7

Post by binarycrusader » Fri, Jun 09, 2017, 5:36 AM UTC

Torch probably doesn't even need to set LD_LIBRARY_PATH. If LD_LIBRARY_PATH is only being set so that binaries distributed by torch work, then I'd strongly suggest they use RUNPATH instead with $ORIGIN.

There are examples in various places:

https://enchildfone.wordpress.com/2010/03/23/a-description-o... http://man7.org/linux/man-pages/man8/ld.so.8.html http://longwei.github.io/rpath_origin/

LD_LIBRARY_PATH is really only for a developer's local use; it should never be used for installed software.

Disclaimer: may not apply in some scenarios, I haven't used Torch, so this is merely a general observation.

Re: How Torch broke ls and made me vulnerable

#8

Post by matheweis » Fri, Jun 09, 2017, 5:44 AM UTC

On most modern Mac OS installations, this is a non-issue. System Integrity Protection doesn't honor any changes to LD_LIBRARY_PATH, presumably for exactly this sort of reason. (Of course, one might have turned off SIP, in which case this is no longer true, but it's nice to know it's the default).

Re: How Torch broke ls and made me vulnerable

#9

Post by lloydde » Fri, Jun 09, 2017, 5:47 AM UTC

Buried in there is "Torch machine learning library", which then allowed me to figure out what software was being blamed. http://torch.ch/

Re: How Torch broke ls and made me vulnerable

#10

Post by eridius » Fri, Jun 09, 2017, 5:57 AM UTC

andreiw wrote: post #3

you know, that's a pretty good plausibly-deniable backdoor, if you think about it... sounds like a pretty good thing to disable in ld.so...

How is it a backdoor? System services don't typically source the user's bash profile before running, and even if they did, they don't run from attacker-controlled directories anyway. At best you could compromise someone by tricking them into cd'ing into a folder you provided, but that's not something that would generally be called a "backdoor". And if you can get them to run your install script, you've already "compromised" them anyway and LD_LIBRARY_PATH is completely unnecessary.