3 ms·
The attacker can install a keylogger as normal user and then wait for the sudo password. How much better is that, really?
by yAnonymous 11y ago
The attacker can install a keylogger as normal user and then wait for the sudo password. How much better is that, really?
- tokenizerrr 11y agoHow would a normal user go about installing this system-wde keylogger?
- NoGravitas 11y agoIt wouldn't be system-wide. You'd need to compromise an interactive user account, install and run the keylogger as them, and wait for them to su or sudo. So it's a means of escalating privileges from a regular user account.
- tokenizerrr 11y agoRight, and your daemons use sub-1000 UIDs and user UIDs start at 1000. In Debian, at least. Other distros have other starting points, but the concept remains the same.
- gtrevorjay 11y agoValue for each delta will vary, but every extra step (the need to install a keylogger) or dependency requirement (that this be an interactive node and someone eventually logs in) will decrease your overall chance of penetration. Almost no one has the resources to stand up to a targeted attack from even a mildly capable hacker. Therefore, the risk profile most administrators are working against are attacks of opportunity. In that race, as in the old joke about outrunning your friend instead of a lion, you need only be be some small amount more difficult to crack than the next potential victim.
- icebraining 11y agoThe user under which the application is running shouldn't even be in the sudo group.