3 ms·
I don’t really understand what that gives the attacker. Login to the developer’s machine as in? What if they disabled SSH password auth? I mean, if you alread
by heavenlyblue 6y ago
I don’t really understand what that gives the attacker.
Login to the developer’s machine as in? What if they disabled SSH password auth?
I mean, if you already made them run a random script why would you even care about their password?
- fulafel 6y agoTo be able to easily get root through sudo later when running the malware payload (reverse shell eg) in the background?
- heavenlyblue 6y agoYou already have sudo, you can install any malware immediately (with a rootkit on top and any kernel extensions to hide yourself)
- fulafel 6y agoMaybe you don't want to leave any log traces, kernel mods etc behind yet before getting instructions from your c&c or waiting until a set time when some other coordinated action (or a weekend) happens.