3 ms·
> The payload only activates if the running program has the process name /usr/bin/sshd. This means that systems that put sshd in /usr/sbin or another folder are
by AshamedCaptain 3y ago
> The payload only activates if the running program has the process name /usr/bin/sshd. This means that systems that put sshd in /usr/sbin or another folder are not vulnerable. This further suspects targeting systemd systems due to their usrmerge initiative putting all binaries in /usr/bin.
This is highly likely wrong. The hack targets rpm and deb distros and as far as I know _all of them_ put sshd in /usr/sbin. The original oss-security report specifically said arg0 had to be /usr/sbin/sshd and I can reproduce his findings about increased runtime if you do so.
This /usr/bin vs /usr/sbin also has nothing do with usrmerge.
This type of mistake casts doubt in the rest of analysis.
- redserk 3y agoThere is no rational reason to justify throwing out the entire analysis over one mistake.
- AshamedCaptain 3y agoI said "Casts doubt". In the same way a typo in the headline, a logic error in the first bullet point, a misconception in the introduction, etc. casts doubt on the rest of a publication. And this was no simple typo, as there was an accompanying and erroneous justification (which btw also hints to a lack of knowledge in the topic). This bullet was practically the easiest to verify out of the entire article and was already showing a contradiction. You might enjoy publications where fact-checking is not high in the list of priorities of the author (this article contains a disclaimer saying as much), but most "rational" readers should be interested in knowing how light the fact-checking indeed was, specially in a topic as important as this.