Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Run sudo -k, set your clock to 01.01.1970, run sudo su and boom you're root

twitter.com

Post reply on HN
Print view View original

31–40 of 74 posts

Re: Run sudo -k, set your clock to 01.01.1970, run sudo su and boom you're root

#31

Post by dazzawazza »

simias wrote: post #21
nwh wrote: post #16

Earlier quoted context omitted.

Users on MacOS can change the time without root access.

Are you sure? If it is it sounds like a possible security issue. Time is pretty sensitive as soon as certificates are involved. Many auth systems assume the clock is properly synchronized across the system. If that's true IMO that's the security issue, not the arguably strange behaviour of sudo in a situation that should never occur.

well from the terminal

   $ date 010101011970
   date: bind: Permission denied
   date: settimeofday (timeval): Operation not permitted
   [15:45:41][dazza@imac.internal:~]
From System Preferences you can indeed set the date back to 1970:

   $ date
   Fri  2 Jan 1970 00:56:44 BST
   [00:56:44][dazza@imac.internal:~]
but there is a little lock that you might need to unlock (with a user password).

This does seem like a security issue on OSX.

Re: Run sudo -k, set your clock to 01.01.1970, run sudo su and boom you're root

#33

Post by adestefan »

dazzawazza wrote: post #31
simias wrote: post #21

Earlier quoted context omitted.

Are you sure? If it is it sounds like a possible security issue. Time is pretty sensitive as soon as certificates are involved. Many auth systems assume the clock is properly synchronized across the system. If that's true IMO that's the security issue, not the arguably strange behaviour of sudo in a situation that should never occur.

well from the terminal $ date 010101011970 date: bind: Permission denied date: settimeofday (timeval): Operation not permitted [15:45:41][dazza@imac.internal:~] From System Preferences you can indeed set the date back to 1970: $ date Fri 2 Jan 1970 00:56:44 BST [00:56:44][dazza@imac.internal:~] but there is a little lock that you might need to unlock (with a user password). This does seem like a security issue on OSX…

That little lock icon is the same as running sudo from the command line. If the user is listed as an Administrator, then they're also able to sudo.

Re: Run sudo -k, set your clock to 01.01.1970, run sudo su and boom you're root

#35

Post by _phred »

subway wrote: post #32

I wonder if it would be possible to walk back the date using an ntp mitm attack.

Very, very difficult, unless the host relies on a single timesource. Best and common practice is to use 3-4 sources from different organizations in the ISC pool. It also wouldn't surprise me if most implementations of ntpd would have further safeguards about going 40 years back in time; at the very least the skew factor would make the clock change take a longgggg time to happen.

There are much easier attack vectors.

Re: Run sudo -k, set your clock to 01.01.1970, run sudo su and boom you're root

#36

Post by lukeschlather »

__alexs wrote: post #30
hosay123 wrote: post #23

Earlier quoted context omitted.

An evil person with e.g. a stolen SSH key can escalate privileges on a machine without needing the user's password. It's not simply about sudo working as designed, it allows bypassing sudo's user authentication entirely. I can think of a handful of corporate machines (e.g. web servers) I've had pubkey access on where sudo allowed the real admin to gain root from the same account via sudo.

How are they going to change the date without having a path to superuser access already?

They could potentially spoof the machine's NTP server.

Re: Run sudo -k, set your clock to 01.01.1970, run sudo su and boom you're root

#39

Post by moe »

It may be worth noting that local privilege escalation vulnerabilities have always been dime a dozen, this is just a more egregious one.

In your planning always keep in mind that anyone with shell-access to your server can become root in one way or another, if he really wants to. There is little "defense in depth" after that point.

Re: Run sudo -k, set your clock to 01.01.1970, run sudo su and boom you're root

#40

Post by bpeebles »

trotsky wrote: post #27

I see your wonky authentication bypass and raise you a local privilege escalation that is 100% reliable on every distro that's shipped a 3.3-3.8 kernel (last 18 months or so) http://thread.gmane.org/gmane.linux.network/260061 bad times :/

Linux 3.3 came out 2012-03-18, that's just less than 12 months ago.
Post reply on HN