4 ms·
It is a common hiding place once the box has been broken into, not necessarily something that would be attacked right away. If you look on google you can see pl
by namidark 14y ago
It is a common hiding place once the box has been broken into, not necessarily something that would be attacked right away. If you look on google you can see plenty of evidence of people's boxes being compromised through insecure shared memory and you can find plenty of examples of shared memory being exploited for privilege escalation and hiding malicious files.
- agwa 14y agoWhat makes /dev/shm a better hiding place than /tmp or /var/tmp?
- iuguy 14y agoIn automated exploitation (e.g. scanning for common classes of web vulnerabilities) /dev/shm is better because it doesn't touch the disk filesystem. It's also not an obvious place people use on a regular basis (as opposed to /tmp) so (some) people are less likely to look for things in there. /tmp sometimes uses tmpfs which is also memory based, but not always and you won't know until you're in /tmp.
- WestCoastJustin 14y ago/dev/shm is a better hiding place than /tmp or /var/tmp because if someone notices something weird on a server their instinct might to be power it off or reboot it. A power cycle will wipe /dev/shm since it is memory backed storage. Lots of places will remove the network, power off the machine, and disk image the affected server for later analysis.