3 ms·
Ok, so the malware runs a keylogger / clipboard logger, gets the password and runs sudo on it's own. Or replaces your shell by putting exec ~/hackedbash into yo
by exyi 5mo ago
Ok, so the malware runs a keylogger / clipboard logger, gets the password and runs sudo on it's own. Or replaces your shell by putting exec ~/hackedbash into your bashrc
Password on sudo is only useful if you detect the infection before you run sudo
- fragmede 5mo agoCould link it to a yubikey via pam.d so you need a fingerpress to authenticate.
- pastage 5mo agoPhysical attestations are hard to solve, I think it would be nice if all TPMs in laptops had this. Then the problem becomes how do you automate stuff that needs to be done.
- lrvick 5mo agoAnd then the moment you authenticate, the fake sudo still executes its payload. Yubikeys do not fix this issue.
- exyi 5mo agoAt least my password won't leak as often with yubikey, but the attacker can still hack my shell to execute fake sudo. Even if I type /bin/sudo explicitly, there is ptrace, LD_PRELOAD or just replacing the entire bash binary. In practice yubikey sudo keeps you much safer today, as almost nobody uses it and malware won't be prepared for it