4 ms·
Those links say 70% of all security bugs, but since my bc/dc does not have the ! command (to spawn processes) and only reads files, not writes them (except stdo
by aeonik 3y ago
Those links say 70% of all security bugs, but since my bc/dc does not have the ! command (to spawn processes) and only reads files, not writes them (except stdout), it’s hard to actually turn a memory safety issue into a security bug, even if it’s possible.
Is this quote assuming ASLR, non-executable stack, stack canaries?
I don't really understand what writing files and forking have to do with the security of system? Unless you mean it limits the attack surface from a ROP gadget?
- gavinhoward 3y agoAuthor here. It means that you have to find input that triggers a memory bug to do something malicious. If my dc had the `!` command, then you, as an attacker with low privileges, might be able to modify a dc script to spawn another command that you know can be exploited to get root. Without it, you have to exploit my dc for ROP or some other attack. Of course, then you would just target a shell, right? And that's the point: I've put in enough work, and my bc/dc are locked down enough, that attackers would probably find other ways in.