4 ms·
Thanks security guy. For reference, how many ways to break in do you find per 15 minutes when looking into other distros?
by sieste 6y ago
Thanks security guy. For reference, how many ways to break in do you find per 15 minutes when looking into other distros?
- netsec_burn 6y agoDepends on their popularity. For Ubuntu, Debian, RHEL, Mint, MX Linux, etc. it took me 10 years to find a single LPE. Special case Linux distros, like those for audio editing or signal processing, have about 1-3 LPE's in the first 30 min to an hour I look at them. And GoboLinux.. broken permissions, broken trust of library load paths, root SUIDs with 5 LPE issues at a glance of the source. They even gave some regular binaries root privileges because why not. I didn't look into the root services running or writable paths because I assumed those would be vulnerable too. The question is not if you can get root, but how many ways there are to get root. I was running GoboLinux in a 15 minute session, and once it expired I didn't start a new one. I'll come back to it and do a more comprehensive audit. I haven't released any zerodays I've found, ever, but recently I was thinking about making a blog. This might be some good material.
- sieste 6y agoThanks, good to know that this is not the norm. Yes please do a more comprehensive audit. And start a blog.
- adamcstephens 6y agoAny experience with opensuse?
- netsec_burn 6y agoIt's the last distro on my bucket list. I have vulnerabilities but nothing to drop a root shell.
- Lapsa 6y agojust wanted to thank you for the update
- hmsimha 6y agoHave you audited Tails by any chance?
- netsec_burn 6y agoI have. Only so far as to test if another zeroday I created worked. It did because it shares a lot of similarities with other Debian-based targets. I haven't tested Tails further, because there are no ethical buyers of Tails vulnerabilities.