3 ms·
> but would be detected pretty fast in "real world". I call bullshit on that one. When did you last cat your bashrc? Every morning? Probably not. Nobody ever
by cookiengineer 2y ago
> but would be detected pretty fast in "real world".
I call bullshit on that one. When did you last cat your bashrc? Every morning? Probably not.
Nobody ever knows what kind of environment variables are modified inside /proc fs. Nobody.
The ones that do uninstall glibc.
- theamk 2y agoMaybe don't interpolate your experience so much? Not everyone is in the Web/AI space, there are still system programmers out there. My bashrc is under version control, so any changes would immediately appear if I do "status" command.. for me this was last week. (For the record, I have no desire to uninstall glibc, I like my DNS working than you very much.) The environment variables are pretty simple, and you should really take your time to learn them. When I help others troubleshoot their systems, one of my first steps is to look at their environments for anything suspicious, this is solving at least 30% of all the problems. And sure, sometimes they are somewhat mysterious ("UBUNTU_MENUPROXY=1"?) but you can often guess from context. But the most important thing is, a self-propagating worm has no idea which machine is it getting into - is it going to be old server which people want to touch as little as possible? Or is it a dev machine of a C++ programmer (or even worse, build engineer) who know every .so file and "strace" things daily? So while there might be specific orgs where such worm can live for a while, it will be found once it gets to a wider audience.