3 ms·
The security issues are already clearly warned about: the debug info must come from a trustworthy server. But I don't see why a black hat would choose this atta
by not2b 3y ago
The security issues are already clearly warned about: the debug info must come from a trustworthy server. But I don't see why a black hat would choose this attack vector. They would have to wait for a developer to debug a binary with shared libraries, while fetching debug info from a a corrupted server. The developer would most likely be using a server provided by a distro (say, Red Hat/Fedora), and if a bad guy can replace the debuginfo files on such a server, they can just as easily replace RPMs directly and feed users malware.
- tovej 3y agoYes, it would me more notable if a client could somehow compromise the server, which may work theoretically as an internal attack vector in a software dev organization. I agree that compromising a distro server is unlikely, but I suppose a mitm attack could be plausible though, and this would give arbitrary code execution. EDIT: or is it ACE? The article seems to emphasize sending arbitrary _data_ to the client, so now I'm confused. If you can make the binary print something else, surely you have ACE? Or do you have to step through the code?
- jmprspret 3y agoI kind of agree. But another aide to it is that it would be cool to see in a CTF type challenge.