4 ms·
Well yeah you can't enforce any security boundary if your threat model includes "user might be tricked". It can't be enforced on Linux because `sudo` can be tr
by IshKebab 2y ago
Well yeah you can't enforce any security boundary if your threat model includes "user might be tricked".
It can't be enforced on Linux because `sudo` can be trivially MitM'd, but you can't do that on Windows because it's just a click.
- reissbaker 2y agoBut the entire threat model we were discussing was that the user might be tricked: Being a setuid binary means that sudo also suffers from attacks where an attacker runs `sudo ./malware` and then convinces the user to authenticate That's why the OP said that's not an enforceable security boundary. If the user is capable of attaining superuser privs, you can trick them, regardless of how attaining those privs is implemented.
- IshKebab 2y agoYeah I wasn't agreeing with that either. I didn't interpret OP's comment like that. I think he was saying you can't enforce the boundary at all even if users don't get tricked. That's true on Linux because the sudo UI can trivially be MitM'd by malware. You can't do that on Windows so trivially.
- shakna 2y agoThat was doable, and how it worked, under Windows until a few weeks ago [0]. [0] https://cyberdom.blog/abusing-the-windows-update-stack-to-gain-system-access-cve-2025-21204/ https://cyberdom.blog/abusing-the-windows-update-stack-to-ga...