2 ms·
> Which either means the server your home directory is on How did you arrive to the conclusion that the server has your home directory? The threat model: It's
by leni536 8y ago
> Which either means the server your home directory is on
How did you arrive to the conclusion that the server has your home directory? The threat model: It's a server that you can authenticate to, retrieve files from there but otherwise you don't trust. It has nothing to do with your home directory. The PoC attack just shows the danger of invoking scp from the client's home directory.
- jedberg 8y agoI see so in the case that I scp from an untrusted host, I could have added risk that it is silently overwriting filed in my local home dir. That makes sense I suppose. I never scp files from untrusted hosts, nor can I think of a use case to do so, so it hadn’t really crossed my mind.
- willvarfar 8y agoYou should not trust the server. The server may have been compromised.
- pbhjpbhj 8y agoThe client may have also been compromised, you may have, you might be in the Truman show ... /s If I'm reading the OP right, whilst directory permissions can be modified, traversal is not possible, so it can't overwrite outside the directory you're writing to. But if you wrote to your home directly then your .bashrc could be modified ... and it sounds like other vulnerabilities allow the actual processing to be hidden (spoofed console output). Seems like the sort of thing that could be used in a spear-fishing scenario. I wonder if you could write a StackExchange answer with instructions to scp files from such-and-such server ...
- ajdlinux 8y agoThere are plenty of use cases where the host you're connecting to isn't completely untrusted but rather it's semi-trusted. Web hosting provider, university machine, etc - all multi-tenant environments which have a tendency to get compromised.