Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GhostLock, a stack-UAF that has existed in all Linux distributions for 15 years

nebusec.ai

Post reply on HN
Print view View original

181–190 of 209 posts

Re: GhostLock, a stack-UAF that has existed in all Linux distributions for 15 years

#181

Post by AnthonyMouse »

goodburb wrote: post #96
kuschku wrote: post #95

Earlier quoted context omitted.

> I suspect that this will be added to all Google Play integrity levels, limiting many apps from being installed on unpatched phones in the future. You do realize that a full kernel vulnerability like this allows you to feed falsified information to SafetyNet? Just like DRM, it gives the developer the illusion of control, but doesn't do anything to actually improve "safety" or "integrity". It's silly that whenever I…

Agreed, but I think this will force the average user to upgrade* their phones after losing access to sensitive apps (bank, gov) before getting compromised. Good news for reusing old phones and taking control. *as in replace

> Agreed, but I think this will force the average user to upgrade* their phones after losing access to sensitive apps (bank, gov) before getting compromised.

The problem being that there are many millions of people who can't afford to replace a phone they only recently bought just because the vendor never updates it, which means those banks and things can't in practice demand that people do that. Indeed, it creates the opposite problem, because installing a custom ROM on that device would give it a patched kernel but cause it to fail attestation, so what the attestation is actually doing is requiring those people to continue to use the vulnerable OS.

Re: GhostLock, a stack-UAF that has existed in all Linux distributions for 15 years

#182

Post by AnthonyMouse »

ChocolateGod wrote: post #112
kuschku wrote: post #105

Earlier quoted context omitted.

We should be fighting against SafetyNet and similar attestation systems. The proper solution is one we had with desktop computing for decades. If you keep the key material on your eID or bank card, you don't need a locked down operating system. Which then allows devices to live for much longer. We're slowly losing the war on General Purpose Computing. https://media.ccc.de/v/28c3-4848-en-the_coming_war_on_genera...

> We should be fighting against SafetyNet and similar attestation systems. The proper solution is one we had with desktop computing for decades. If you keep the key material on your eID or bank card So you want a bank card/ID card to be required each time you use Google Pay? What's the point of Google Pay then.

The obvious way to do this is that you need to physically attach the bank card in order to authorize a new vendor. So then when you sign up for Google Pay or Paypal or what have you, you need to get out your card -- which is good. You can't steal a physical card by breaching some other merchant it was used at.

From then your Google Pay account is authorized to initiate charges until you tell your bank otherwise and you don't need the card again unless you want to sign up for Venmo etc.

And it makes things easy if someone steals your phone, because you just sign into the payment processor and deauthorize the device or, if they've already changed your password etc., sign into (or go to) the bank and deauthorize the payment processor.

Re: GhostLock, a stack-UAF that has existed in all Linux distributions for 15 years

#183

Post by XorNot »

password4321 wrote: post #16
circularfoyers wrote: post #8

Earlier quoted context omitted.

Since this enables container escape, sounds like this might still impact quite a lot of us?

I guess, if you thought Docker/etc. was a security boundary

There was a virtual machine KVM escape found like 2 weeks ago.

Nothing is a security boundary anymore.

Re: GhostLock, a stack-UAF that has existed in all Linux distributions for 15 years

#184

Post by alexjplant »

dmittman wrote: post #50
alexjplant wrote: post #26

> This is the same shape as many other life-cycle bugs [...] Claude-ism detected. IME with Claude Code an object does not have a type or definition, apparently, but rather a shape (or at least it reaches for that word before more technically-accurate ones). Problems are not of a similar class or type, but of the same shape. Functions are not defined by their signatures but by their shape. Who talks like this and how…

Isn't this just observation bias? "If I haven't encountered something, then it must not be real?" (Paraphrasing)

I must confess that I asked a leading question. At no point did I say that the usage wasn't real; by way of dramatic omission I was more pointing to the fact that a common ECMAScript/React-ism is overrepresented in Claude's training set to the point that it's being applied to situations not involving duck-typed languages.

I'm not a grammatical prescriptivist but I find it viscerally troubling that a bunch of LLM cargo-culted terms are starting to inform how we talk about our work.

Re: GhostLock, a stack-UAF that has existed in all Linux distributions for 15 years

#185

Post by physicalecon »

tjoff wrote: post #167
physicalecon wrote: post #158

Earlier quoted context omitted.

It is very possible to load a kernel module into the host from a container. https://stackoverflow.com/questions/33013539/docker-loading-...

FYI, looks like you are shadowbanned.

[dead]

Re: GhostLock, a stack-UAF that has existed in all Linux distributions for 15 years

#187

Post by brainwad »

AnthonyMouse wrote: post #180
brainwad wrote: post #124

Earlier quoted context omitted.

Google is the good actor here. 7 years of updates, unlocked bootloader, support for LineageOS, etc. The reason it sucks is all the other OEMs who don't care about anything other than the current year's models.

That's Google as the hardware OEM, not Google as the OS/platform vendor. They should be standing on Qualcomm's neck until they upstream their drivers and whatever else is necessary to make it practical for anyone to run updated kernels on their hardware, the same as it has worked for PCs for decades.

FWIW, when Windows NT was ported to mobile it also was compiled against binary blobs for specific Qualcomm SoCs. It's not an Android deficiency; what works on PCs just doesn't really work in mobile-land.

Re: GhostLock, a stack-UAF that has existed in all Linux distributions for 15 years

#188

Post by AnthonyMouse »

brainwad wrote: post #187
AnthonyMouse wrote: post #180

Earlier quoted context omitted.

That's Google as the hardware OEM, not Google as the OS/platform vendor. They should be standing on Qualcomm's neck until they upstream their drivers and whatever else is necessary to make it practical for anyone to run updated kernels on their hardware, the same as it has worked for PCs for decades.

FWIW, when Windows NT was ported to mobile it also was compiled against binary blobs for specific Qualcomm SoCs. It's not an Android deficiency; what works on PCs just doesn't really work in mobile-land.

The reason it's like that is that 1990s Microsoft used carrot and stick to make the hardware vendors do the right thing and present day Google isn't doing that when they're the ones who would need to.

The alternative would be for the hardware market to be less consolidated (the government keeps allowing Qualcomm to buy up competitors) so that the chip companies would have to compete on things like this. But that's no excuse for Google to be sitting on their hands when they could fix it too.

Re: GhostLock, a stack-UAF that has existed in all Linux distributions for 15 years

#189

Post by kuschku »

ChocolateGod wrote: post #134
kuschku wrote: post #122

Earlier quoted context omitted.

Once upon a time(tm), Google had a great solution for that: You could get a credit card in nano SIM format, and insert into in your dual-SIM phone. That then allows you to do secure NFC credit card payments even on a rooted phone with custom ROM.

That doesn't work when someone has multiple or virtual cards. That also means if someone steals my phone they get my credit card too. Not a great solution.

> That also means if someone steals my phone they get my credit card too.

Which hasn't been an issue since Chip & PIN became required, 22 years ago (at least over here).

Re: GhostLock, a stack-UAF that has existed in all Linux distributions for 15 years

#190

Post by pkoiralap »

Huge kudos to the security researchers for 1, finding an exploit, and 2, unlike copyfail, excluding a zero-day ready-to-use LPE script that anyone could have used.

I tried using this for LPE on a Rocky9 for a couple of hours and thankfully couldn't get it to work. So that means unless you have quite some free time on your hand, or are extremely good at doing what you do, you can't actually use this to get LPE on enterprise distros.

Post reply on HN