5 ms·
> That's quite a leap from 'I can read /etc/shadow' to 'I am root'. Of all the leaps in that post, that's the least leapy thing. `shadow` exists precisely so t
by himinlomax 7y ago
> That's quite a leap from 'I can read /etc/shadow' to 'I am root'.
Of all the leaps in that post, that's the least leapy thing. `shadow` exists precisely so that only `root` can read its content, whereas before said content resided in `passwd` which _needs_ to be readable by all.
I see only two possibilities here. Either the people who set up that compile service are complete morons and run said compile as actual root in an actual VM; OR, more likely, shit runs in a container with an _apparent_ id of 0 but no actual privilege outside its temporary environment.
- boring_twenties 7y agoIf it was in a typical container there'd be no hashed password for root, though. Just a ! or *. In fact that's kinda the standard practice anyway nowadays (disallow logging in directly as root), so I'm really not sure what these guys are doing.
- londons_explore 7y agoRunning as actual root in a VM would be my preferred design. There are lots of times a user might need to apt-get some dependencies for their compile job. Let an attacker do whatever they like in the VM. Then delete the VM between users. Docker containers aren't really a good security barrier, and a VM is much better (although VM escape vulnerabilities aren't unheard of).
- rbanffy 7y agoThere are many ways a hostile program inside a VM can escape it and run code on the host or, at least, negatively affect it.
- arpa 7y agoPlease do share how can one escape qemu.
- jacquesm 7y agoAt your service: https://www.techrepublic.com/article/vm-escape-flaw-in-qemu-allows-for-arbitrary-code-execution-denial-of-service/ https://www.techrepublic.com/article/vm-escape-flaw-in-qemu-...
- softwarelimits 7y agoDid you try this on an up2date Linux OS, like eg Debian or Ubuntu? What was your result? Certainly as a real hacker you are not only re-posting "things from the news" but validate everything before posting any comments? Are you? I did not see any relevant content on the websites you mention in your HN profile, I expected some in-depth security publications - maybe update it with some real code that shows us how you are using the mentioned CVE-2019-14378 to perform escapes on any KVM host? Thanks!
- VBprogrammer 7y agoI'm trying to understand what your point is, are you denying that there was a vulnerability? As it stands it just sounds like you are just being a jerk on the internet.
- softwarelimits 7y agoI am asking for actual code that shows his statement is still true. The statements I read as an answer to my question contain zero value and still lots of very unrelated words. If you are sure there are vulns right now, please publish them. If not, shut up. Nillywilly "computers might be insecure" is on a level I would not expect to read on a side like this one. I just want to keep the quality level high for this news discussion site.
- cyc116 7y agoRunning in a VM is good. Running in a VM as a non-priv user is better. Ideally you'd want multiple layers of defense in case of undiscovered gaps, human error and 0-days.
- fghtr 7y agoNot many if its Qubes OS.
- rbanffy 7y agoOne would be quite enough.
- fghtr 7y agoIn fact, Qubes is using hardware virtualization IOMMU/VT-d [0], which has been escaped only once in 2006 by the project founder [1]. [0] https://www.qubes-os.org/doc/architecture/ https://www.qubes-os.org/doc/architecture/ [1] https://en.wikipedia.org/wiki/Blue_Pill_(software) https://en.wikipedia.org/wiki/Blue_Pill_(software)
- rbanffy 7y agoI trust Joanna Rutkowska's competence, but I wouldn't bet too much on chip makers not messing up again in the future. It will be progressively harder, but it will happen.
- zer0t3ch 7y agoI don't know much containerization outside of docker, but you can definitely apt-get some dependencies even inside docker containers.
- londons_explore 7y agoInside a docker container, you are root, so you can apt-get.