4 ms·
Small nit to pick, but in the introductory paragraph it reads "unauthenticated, targeted remote code execution." I recall that there was a special private/publ
by kevindamm 3y ago
Small nit to pick, but in the introductory paragraph it reads "unauthenticated, targeted remote code execution." I recall that there was a special private/public key pair that made this exploit only reproducible by the author (or only possible after re-keying the binary).
I believe this means it was unauthorized, not unauthenticated.
- rsc 3y ago"unauthenticated remote code execution" is a fairly standard term for this kind of access. (https://www.google.com/search?q=%22unauthenticated+remote+code+execution%22 https://www.google.com/search?q=%22unauthenticated+remote+co...)
- kevindamm 3y agoFairly standard term for a kind of access similar to this, but the distinction is important. Consider the impact if anybody else, not just this attacker, could have exploited it -- on the other hand, it may have been discovered sooner (had it also not been discovered by accident first).
- deleted 3y ago[deleted]
- mcpherrinm 3y agoI think it is unauthenticated from the point of view of SSH’s own authentication. The backdoor has its own credential, but the RCE is accessible if you don’t have an account on the system.
- kevindamm 3y agoThat's the basis for my preferring the term relating to authorization. The two terms have distinct and well-defined meanings in the domain. They're both critical aspects of security but for different reasons.
- dist-epoch 3y agoRemote code execution already implies unauthorized. There is no such thing as authorized remote code execution.
- deleted 3y ago[deleted]
- kevindamm 3y agoWhat makes you say that? SSH, RDP, even hitting a web service are all valid cases of authorized remote code execution. It's not the remote or execution parts that are bad.
- dist-epoch 3y agoNow you're redefining words. Remote code execution means a single thing, running JavaScript when accessing a web page and using SSH as intended is not RCE. https://en.wikipedia.org/wiki/Remote_code_execution https://en.wikipedia.org/wiki/Remote_code_execution https://www.google.com/search?q=Remote+code+execution https://www.google.com/search?q=Remote+code+execution
- kevindamm 3y agoI may not have been clear -- I agree that RCE, unqualified, means unauthorized RCE. but then you said there was no such thing as an "authorized" RCE and that's where I beg to differ. Sure, the term isn't used much but it wasn't the clarifying point I wanted to make above, that there is a difference between authenticated and authorized. The links you point to there are about "RCE attack" which also implies not authorized.
- dist-epoch 3y agoYour original post: > in the introductory paragraph it reads "unauthenticated, targeted remote code execution ... I believe this means it was unauthorized, not unauthenticated. You again: > agree that RCE, unqualified, means unauthorized RCE So you agree that your "unauthorized" qualification from your orignal post was unwarranted, since all unqualified RCE are unauthorized. Now if you want to split hairs, you'll say "but the introductory paragraph said unauthenticated, which is qualified RCE, thus I am still right". ok then