3 ms·
Why can the compromised package not also access wherever 1p is storing the keys or access the part of memory they're loaded into?
by soheil 5y ago
Why can the compromised package not also access wherever 1p is storing the keys or access the part of memory they're loaded into?
- ossusermivami 5y agothey would have access to the socket not the key, sure a very elaborated attack can probably figure out how to exfiltrate a lot of things (since they have already compromised the host) but for most, if they don't see things in ~/.ssh they would just go away and figure out another host to exfiltrate keys
- lillecarl 5y agoBecause the keys never exist "on disk"? Why isn't every password manager pwned on every persons machine is what you're asking it seems.
- soheil 5y agoNo but what you seem to be saying is .ssh is pwned on every machine that doesn’t use a password manager.
- staticassertion 5y agoA process can not dump the memory of another process if those processes are executing under different users, or the process performing the dump is root. On many OS's there are even more strict restrictions, where within a user a process can only dump the memory of processes that are its direct descendants.
- soheil 5y ago1p runs as the logged in user so does a hypothetical malicious npm package.