5 ms·

What makes /dev/shm a better hiding place than /tmp or /var/tmp?

• iuguy 14y ago
  In automated exploitation (e.g. scanning for common classes of web vulnerabilities) /dev/shm is better because it doesn't touch the disk filesystem. It's also not an obvious place people use on a regular basis (as opposed to /tmp) so (some) people are less likely to look for things in there. /tmp sometimes uses tmpfs which is also memory based, but not always and you won't know until you're in /tmp.
• WestCoastJustin 14y ago
  /dev/shm is a better hiding place than /tmp or /var/tmp because if someone notices something weird on a server their instinct might to be power it off or reboot it. A power cycle will wipe /dev/shm since it is memory backed storage. Lots of places will remove the network, power off the machine, and disk image the affected server for later analysis.
  • anthonyb 14y ago
    /tmp is also normally cleared on a reboot.
    • lloeki 14y ago
      More precisely, it should not be relied on being persistent across reboots, vs /var/tmp which can be.