Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

You might want to stop running atop

rachelbythebay.com

Post reply on HN
Print view View original

121–130 of 155 posts

Re: You might want to stop running atop

#121

Post by TheDong »

isotopp wrote: post #118
TheDong wrote: post #108

No one else seems to have run 'grep system(', so I will: https://github.com/Atoptool/atop/blob/037a6d3e4ace6c7be6c5dc... > system ("gunzip -c %s > %s", tmpname1, tmpname2") tmpname2 is hardcoded as "/tmp/atopwrkXXXXXX", so that's fine. tmpname1 is '$irawname.gz'. '$irawname' is set by the '-r' flag. So, presumably if you can get the rest of the code to play nice and get you there, you can escalate from having shell a…

Eh? Calling system() for a binary without a path? And why system() using execl() in the first place, when you could do something using execve() without a sh inbetween instead? Even w/o an exploit this can be prettier and more secure.

We're not disagreeing. Even if there's no 'sploit there, people have spaces in their directory or file names, and it's kinda nice for your tool to work with those, so obviously you should be using an execve variant to pass arguments properly.

I assume the reason for the incorrect system call is that doing a shell redirect ('>') does actually look prettier though.

Doing the actual right code is definitely less pretty looking IMO: https://github.com/luvit/zlib/blob/8de57bce969eb9dafc1f1f5c2...

Re: You might want to stop running atop

#122

Post by whazor »

nodesocket wrote: post #64
bitbasher wrote: post #30

Pure speculation; but it sounds to me like she was doing some sysadmin triage and possibly stumbled onto a backdoor/exfiltration through atop. She likely can't disclose anything right now.

Except, she kinda did disclose already. Seems a bit strange to circumvent standard embargo practices, only to publicly hint of an exploit but not give any details.

Maybe because it is a non-essential tool with many alternatives available? It could also be because there are already illicit parties using atop to hack companies? Still, publishing a CVE with the specific exploit and a recommendation to fully delete atop would be better. Even if there is no patch available.

Re: You might want to stop running atop

#123

Post by bigiain »

jamie0 wrote: post #109
geenat wrote: post #66

Earlier quoted context omitted.

I agree it's not good but being realistic: I'd be far less worried about the Australian government stealing/selling customer data, using my servers in a botnet, using my servers to spread malware.. etc. Mainland China, Russia, North Korea, all have proven track records of doing these things and having corporate espionage rat lines: https://www.youtube.com/watch?v=y27B-sKIUHA

a backdoor would still be a backdoor - even if the "good guys" made it. e.g. Dual_EC_DRBG

And from outside, it certainly seems like those “good guys” are edging closer and closer to a malicious dictatorship recently. (If you don’t see that from inside, try asking a trans person. Or a non white person. Or a Canadian. Or a woman who wants reproductive health care.)

Re: You might want to stop running atop

#124

Post by LinuxBender »

ndsipa_pomu wrote: post #120
LinuxBender wrote: post #74

Earlier quoted context omitted.

Missing from their output is an upvote and downvote button. Or a debug function that forces it to divulge where it obtained the data. Wait, now that I think about it why are there Fact Checkers for humans and not for AI?

That sounds like a lot of work, can't we get AI to do it for us?

You jest but I think it can happen. Grok could be responsible for tagging the output of all the other AI's as "Potential Misinformation, Disinformation per the Ministry of Truth".

Re: You might want to stop running atop

#125

Post by lnxdork »

TheDong wrote: post #108

No one else seems to have run 'grep system(', so I will: https://github.com/Atoptool/atop/blob/037a6d3e4ace6c7be6c5dc... > system ("gunzip -c %s > %s", tmpname1, tmpname2") tmpname2 is hardcoded as "/tmp/atopwrkXXXXXX", so that's fine. tmpname1 is '$irawname.gz'. '$irawname' is set by the '-r' flag. So, presumably if you can get the rest of the code to play nice and get you there, you can escalate from having shell a…

Agree as a basic example. tmpname1 = "/tmp/file.txt; rm -rf /"; becomes gunzip -c /tmp/file.txt; rm -rf / > /tmp/atopwrkXXXXXX

Also tmpname2 could be symlinked to /etc/passwd before it is unlinked..

Re: You might want to stop running atop

#126

Post by LadyCailin »

bigstrat2003 wrote: post #54
plorkyeran wrote: post #17

Earlier quoted context omitted.

Yeah, from a rando this would be just bad vagueposting but Rachel is absolutely someone who could know about a very good reason why we should uninstall atop but be unable to legally say why. I would heed her warning.

I would disagree and still say that this is bad vagueposting. It doesn't matter how reputable the source is: if you say "don't do X" but don't give a reason why, I'm not inclined to listen. Granted I don't use atop anyways, but I don't think a vague blog post - even one from a respected person - is sufficient justification to change what software one uses.

That seems.. whatever the opposite of pragmatic is, but not in a good way, as in “principled”. There are very good reasons one would be required to be vague in a situation like this, but still know about a very serious issue.

It’s like seeing a road sign that says “danger ahead” and ignoring it because it wasn’t very specific. It’s just.. not a sensible move.

Re: You might want to stop running atop

#127

Post by ThePowerOfFuet »

tetromino_ wrote: post #69
geenat wrote: post #21

Probably a backdoor. Repositories controlled by accounts based in mainland China and Russia are always a risk- it's too easy for a dictatorship to force something to happen even if the authors themselves are trying to act in good faith. XZ, Swoole... examples off the top of my head.

Where did you see signs of control by Russia or China? The project's github repo states that the project currently has one maintainer, and that maintainer has a very Dutch name and a .nl website.

Talking about the author of the suspicious commits. In another repo:

https://github.com/xroche/httrack/pull/210/commits/e00339643...

Re: You might want to stop running atop

#128

Post by cmsj »

geenat wrote: post #66
protocolture wrote: post #60

Earlier quoted context omitted.

> it's too easy for a dictatorship to force something We really need to get rid of this mentality. Australia has laws that allow undisclosed, compelled, software updates. Verbally by ministers, but written (confidential) changes can be requested by federal agencies. Many western countries have followed to various degrees. There's no stable trusted government that doesn't want its fingers in your code.

I agree it's not good but being realistic: I'd be far less worried about the Australian government stealing/selling customer data, using my servers in a botnet, using my servers to spread malware.. etc. Mainland China, Russia, North Korea, all have proven track records of doing these things and having corporate espionage rat lines: https://www.youtube.com/watch?v=y27B-sKIUHA

You're not worried about a member of the Five Eyes coalition stealing data? Wild.

Re: You might want to stop running atop

#129

Post by cesarb »

dgacmu wrote: post #20

There's a lot of speculation about why, with the answer almost certainly security / exploitable (or backdoor), and I'll just throw an extra little tidbit in: atop seems to run persistently as root, which may be the reason for preventing it from running/uninstalling. the netatop part of atop installs a persistent kernel module, netatop.ko, as part of its installation. The module hooks netfilter to be able to monitor a…

> atop seems to run persistently as root, which may be the reason for preventing it from running/uninstalling.

Some distributions (like Ubuntu) enable that service by default, but some others (like Fedora) don't.

Re: You might want to stop running atop

#130

Post by wlonkly »

_nalply wrote: post #114
cortesoft wrote: post #97

Earlier quoted context omitted.

This seems completely backwards... if someone says to do something but doesn't give a reason, then the ONLY thing to base your decision on whether to listen is their reputation and your trust in them. If someone I trust tells me to trust them, I will.

First, I decided I am going to avoid atop. Even if Rachel would be wrong, it doesn't hurt not to use some specific software I don't depend on. > If someone I trust tells me to trust them, I will. Huh? When I trust someone, then I trust already and there's no need being told to trust. When I don't trust someone, then I run away when being told to trust. Hell, if someone tells me to trust them, it's a red flag and I dr…

I think it's "If someone I already trust says 'trust me on this one', I will."
Post reply on HN