Earlier quoted context omitted.
Not really. Generally we use "Local Privilege Exploit" to describe an exploit that goes from a reasonably normal user privileges to root privileges. And we don't usually worry about them, because an application with normal user privileges can already to so much damage. But this exploit can be triggered from inside a tightly sandboxed process, such as firefox's isolated browser process. Which means the attacker now on…
Realistically, if you have a browser sandbox, the system LPE exploit gives you very little more. Everything interesting on a desktop system is accessible by the user account directly.
GhostLock, a stack-UAF that has existed in all Linux distributions for 15 years
151–160 of 209 posts
Re: GhostLock, a stack-UAF that has existed in all Linux distributions for 15 years
#152Earlier quoted context omitted.
Wonder if it were possible to use this to (finally) jailbreak DJIs original RC that came with the Mini 3 Pro. It doesn't have a web browser or, virtually, anything of use... but I think it supports enough of a web browser to log in into wifi captive portals.
What can you do with a jailbroken drone rc?
Re: GhostLock, a stack-UAF that has existed in all Linux distributions for 15 years
#153Tested on three Android devices (version 9, 13, 16) with different Firefox versions under 150 (had to modify for older). Two boot looped, I had to enter recovery and the other just powered off [0]. The demo modifies the wallpaper on supported Pixel devices. [0] IonStack https://rootme.nebusec.ai ____ Tip: Install a Chromium flavor browser (Chromite) separate from the main browser. Disable Javascript and hardware acce…
So I took the risk and ran it on a Samsung S26 Ultra - I will confirm the full details once I have `adb` installed and running. The exploit/POC (call it what you want) ran or appeared to have executed because: 1. I saw output on the Firefox tab when I navigated to https://rootme.nebusec.io/b9e3f1a4-7c82-4d6e-9a51-2f8c4b3e0d... >. 2. I saw some output from the execution of the POC. However, after I went to https://roo…
Re: GhostLock, a stack-UAF that has existed in all Linux distributions for 15 years
#154Earlier quoted context omitted.
Does Docker use user namespaces by default? Otherwise root in the container is actually root on the host, from what I read. Correct me if I'm wrong. (Privileges are still limited by seccomp filters blocking some syscalls, and there's SELinux to block some other stuff, but it's still the actual root user without user namespaces, I think?)
That's right. Docker still runs without user namespaces by default, which means that root is the same user inside and outside of the container. This does open up attack surface and configuration footguns. Confinement still leverages dropping some root caps, seccomp, various other namespaces, etc.
Re: GhostLock, a stack-UAF that has existed in all Linux distributions for 15 years
#155Re: GhostLock, a stack-UAF that has existed in all Linux distributions for 15 years
#156Earlier quoted context omitted.
We should be fighting against SafetyNet and similar attestation systems. The proper solution is one we had with desktop computing for decades. If you keep the key material on your eID or bank card, you don't need a locked down operating system. Which then allows devices to live for much longer. We're slowly losing the war on General Purpose Computing. https://media.ccc.de/v/28c3-4848-en-the_coming_war_on_genera...
> We should be fighting against SafetyNet and similar attestation systems. The proper solution is one we had with desktop computing for decades. If you keep the key material on your eID or bank card So you want a bank card/ID card to be required each time you use Google Pay? What's the point of Google Pay then.
Maybe I could even duct-tape it to my phone if I really want to do that.
Re: GhostLock, a stack-UAF that has existed in all Linux distributions for 15 years
#157"Nothing could have prevented this from happening," say users of only language where this happens
Re: GhostLock, a stack-UAF that has existed in all Linux distributions for 15 years
#158Earlier quoted context omitted.
That's right. Docker still runs without user namespaces by default, which means that root is the same user inside and outside of the container. This does open up attack surface and configuration footguns. Confinement still leverages dropping some root caps, seccomp, various other namespaces, etc.
I don't think this is true, otherwise you could just load a kernel module into the host kernel from a container.
https://stackoverflow.com/questions/33013539/docker-loading-...
Re: GhostLock, a stack-UAF that has existed in all Linux distributions for 15 years
#159Do we really need infosec companies now that a skid with claude can find decades-old kernel privesc over a weekend? Also can we talk about how bad Linux security is? At this point it's becoming a real liability to run anything on Linux that needs to be secure. OpenBSD has been around for ages, is written in C, and is really, really secure. Do they support containers yet (or microVMs)? Cuz if they do, I'm moving my wo…
Re: GhostLock, a stack-UAF that has existed in all Linux distributions for 15 years
#160Do we really need infosec companies now that a skid with claude can find decades-old kernel privesc over a weekend? Also can we talk about how bad Linux security is? At this point it's becoming a real liability to run anything on Linux that needs to be secure. OpenBSD has been around for ages, is written in C, and is really, really secure. Do they support containers yet (or microVMs)? Cuz if they do, I'm moving my wo…
OpenBSD is the Linux of a decade or two ago, not attracting attention and not being compatible or useful for quite a lot of stuff.