4 ms·

Can someone explain what this list really means? Does it mean that these are binaries that have vulnerabilities in them that can be exploited? Clicking on each

Can someone explain what this list really means? Does it mean that these are binaries that have vulnerabilities in them that can be exploited? Clicking on each of them, it just describes what it does in a way but no link to vulnerabilities of how the binaries could be used to exploit. By that logic a lot of the binaries on linux fit this list.

blihp 7y ago
It's just a list of binaries that have the potential to be used by exploits. There's nothing inherently wrong with many of the privileges if they are absolutely necessary to do the job... which often they are unless either functionality is removed/disabled or the executable or parts of the system rearchitected. By keeping track of the potential exposure of such binaries one can 1) continuously ask the question 'what needs to be done to mitigate/eliminate these potential attack vectors?' (an example would be the changes to Xorg to eliminate the need to run with root privileges) and 2) help security conscious admins keep on top of the risks they are potentially exposing themselves to when installing/allowing use of said binaries in various situations. (such as not allowing the use of these binaries in restricted shell scenarios... or at least being aware of the potential risks and and making an informed decision vs. inadvertently putting the system at risk)
- Topgamer7 7y ago
  So for example the aria2c application listed. Unless you either have a script or process that runs it via sudo, or uses chmod +s on it, you're in the clear (barring other vulns)?
  - schoen 7y ago
    An example could be that a user is allowed to run aria2c via sudo in the /etc/sudoers file (perhaps with certain restrictions described there). If that user's account is compromised, the attacker could then potentially use the technique mentioned here to escalate to root or to the user as whom /etc/sudoers permits aria2c to be run, at least if the sudoers file didn't forbid the invocation that accomplish the escalation. One angle you could think about is "if I'm a system administrator writing an /etc/sudoers file and I want to allow users to do certain tasks, am I then inadvertently allowing them to do other completely unrelated tasks, perhaps in an entirely nonintuitive way"? Edit: a very nice example is https://news.ycombinator.com/item?id=20648960 https://news.ycombinator.com/item?id=20648960, downthread.
staticassertion 7y ago
"Living off the land" is a technique used by attackers to evade detection. It's easy to monitor for new binaries, or unsigned ones. It's harder to monitor for legitimate binaries that are generally used in your environmet - it requires extra context to determine "is this suspicious". None of these programs are exploitable, they are useful to attackers. This is great for me, as someone whose job it is to protect a network - I can start thinking about how I can monitor these binaries.

blihp 7y ago

It's just a list of binaries that have the potential to be used by exploits. There's nothing inherently wrong with many of the privileges if they are absolutely necessary to do the job... which often they are unless either functionality is removed/disabled or the executable or parts of the system rearchitected. By keeping track of the potential exposure of such binaries one can 1) continuously ask the question 'what needs to be done to mitigate/eliminate these potential attack vectors?' (an example would be the changes to Xorg to eliminate the need to run with root privileges) and 2) help security conscious admins keep on top of the risks they are potentially exposing themselves to when installing/allowing use of said binaries in various situations. (such as not allowing the use of these binaries in restricted shell scenarios... or at least being aware of the potential risks and and making an informed decision vs. inadvertently putting the system at risk)

Topgamer7 7y ago
So for example the aria2c application listed. Unless you either have a script or process that runs it via sudo, or uses chmod +s on it, you're in the clear (barring other vulns)?
- schoen 7y ago
  An example could be that a user is allowed to run aria2c via sudo in the /etc/sudoers file (perhaps with certain restrictions described there). If that user's account is compromised, the attacker could then potentially use the technique mentioned here to escalate to root or to the user as whom /etc/sudoers permits aria2c to be run, at least if the sudoers file didn't forbid the invocation that accomplish the escalation. One angle you could think about is "if I'm a system administrator writing an /etc/sudoers file and I want to allow users to do certain tasks, am I then inadvertently allowing them to do other completely unrelated tasks, perhaps in an entirely nonintuitive way"? Edit: a very nice example is https://news.ycombinator.com/item?id=20648960 https://news.ycombinator.com/item?id=20648960, downthread.

staticassertion 7y ago

"Living off the land" is a technique used by attackers to evade detection. It's easy to monitor for new binaries, or unsigned ones. It's harder to monitor for legitimate binaries that are generally used in your environmet - it requires extra context to determine "is this suspicious". None of these programs are exploitable, they are useful to attackers. This is great for me, as someone whose job it is to protect a network - I can start thinking about how I can monitor these binaries.