3 ms·

The example from this blog is much worse than that. At least "ask" relies upon the user being an administrator and granting access. This application ran as root

The example from this blog is much worse than that. At least "ask" relies upon the user being an administrator and granting access. This application ran as root already without needing escalation and allowed anyone to run arbitrary commands as pre and post hooks. I can't even conceive of what a worse security hole would look like. This is unauthenticated root shell to anyone on the network. Maybe Intel Management Engine is worse since it grants privilege to run instructions and access hardware even the OS can't get to?

anyfoo 5y ago
Nowadays, depending on the OS and it's configuration, root is not necessarily the end to end all things, but if the servers in question were "normally configured" Linux servers a number of years ago, it was likely equivalent to total access. Including control of the kernel through things like /dev/mem, /dev/kmem, and /dev/ports, which at least were common and accessible to root a while ago. With newer stuff in certain configurations, something that gives you remote execution in the kernel or even lower (your Intel ME Engine example seems like a good one) is a much worse security hole, yeah (but then this one could still be a stepping stone to the worse bug).
- T3OU-736 5y ago
  TCSEC [1] levels high enough specified that root wasn't omnipotent, nor could do things unilaterally, and never without logging. B2 and higher, if memory serves. SGI's IRIX could be a part of a B2-level installation (because criteria was applicable to more than just the OS). So much wheel reinvention sometimes... [1] https://en.m.wikipedia.org/wiki/Trusted_Computer_System_Evaluation_Criteria https://en.m.wikipedia.org/wiki/Trusted_Computer_System_Eval...
  - anyfoo 5y ago
    Yeah, I tried to qualify my statement a lot ("normally configured", "Linux server", "number of years ago"...). But I think the subjective viewpoint I gave is probably familiar to a lot of people that used to deal with commodity Linux servers. I share the sentiment with the wheel reinvention, though. This will continue happening...
  - Y_Y 5y ago
    > So much wheel reinvention sometimes... Users on this system are not permitted to make UNIX puns. This incident will be reported.
hermitdev 5y ago
Around 10 years or so ago, at a previous employer, one could run any command as any other user, root included. No exploits, no custom binaries accepting commands to be run as root. The cause? One character in the rlogin configs on all servers that allowed unathenticated access. Oops.
- anyfoo 5y ago
  Was that character "+"? :)
  - hermitdev 5y ago
    Yes. Yes it was. :)

anyfoo 5y ago

Nowadays, depending on the OS and it's configuration, root is not necessarily the end to end all things, but if the servers in question were "normally configured" Linux servers a number of years ago, it was likely equivalent to total access. Including control of the kernel through things like /dev/mem, /dev/kmem, and /dev/ports, which at least were common and accessible to root a while ago. With newer stuff in certain configurations, something that gives you remote execution in the kernel or even lower (your Intel ME Engine example seems like a good one) is a much worse security hole, yeah (but then this one could still be a stepping stone to the worse bug).

T3OU-736 5y ago
TCSEC [1] levels high enough specified that root wasn't omnipotent, nor could do things unilaterally, and never without logging. B2 and higher, if memory serves. SGI's IRIX could be a part of a B2-level installation (because criteria was applicable to more than just the OS). So much wheel reinvention sometimes... [1] https://en.m.wikipedia.org/wiki/Trusted_Computer_System_Evaluation_Criteria https://en.m.wikipedia.org/wiki/Trusted_Computer_System_Eval...
- anyfoo 5y ago
  Yeah, I tried to qualify my statement a lot ("normally configured", "Linux server", "number of years ago"...). But I think the subjective viewpoint I gave is probably familiar to a lot of people that used to deal with commodity Linux servers. I share the sentiment with the wheel reinvention, though. This will continue happening...
- Y_Y 5y ago
  > So much wheel reinvention sometimes... Users on this system are not permitted to make UNIX puns. This incident will be reported.

hermitdev 5y ago

Around 10 years or so ago, at a previous employer, one could run any command as any other user, root included. No exploits, no custom binaries accepting commands to be run as root. The cause? One character in the rlogin configs on all servers that allowed unathenticated access. Oops.

anyfoo 5y ago
Was that character "+"? :)
- hermitdev 5y ago
  Yes. Yes it was. :)