4 ms·
Software that can bypass the firewall for certain, and a possible local privesc (I don't want to promise the LPE yet, I've only looked for 10min). Some skeptici
by netsec_burn 6y ago
Software that can bypass the firewall for certain, and a possible local privesc (I don't want to promise the LPE yet, I've only looked for 10min). Some skepticism is understandable. I've followed up on a few of the replies here outside of HN (such as the Guix project, I found a root LPE they will be releasing a fix for in the coming weeks). For 10 years or so I've not disclosed any vulnerabilities I found. Publicly unverifiable claims are necessary in security, if I were to release the POC before Guix (for instance) can patch it it'll affect their users.
- dhaavi 6y agoIf you publish your findings somewhere, I'd love to read what you have found! We are also building a FOSS application firewall for Linux and I would like to see what problems you have found and how we are doing in that regard. Ref: https://safing.io/portmaster/ https://safing.io/portmaster/
- netsec_burn 6y agoHey there. I did a second 10 minute code review on Portmaster. First I want to say, well done on your modular source tree. It made it very easy for me to go through your open source project. Second, Portmaster is more vulnerable than EBPFSnitch. There's a firewall bypass like EBPFSnitch and a possible auth bypass in the API. I need to verify if the auth bypass is exploitable. A blog post sounds interesting but I'd need to coordinate disclosure with you so your end users aren't affected. I'll circle back in an email thread, expect it in ~1mo.
- dhaavi 6y agoWow, thank you for looking into it! I am very much looking forward to your email.