5 ms·
Yes, all of those vulnerabilities in non-privileged applications like 'ls' are worth millionssssss.
by dguido 13y ago
Yes, all of those vulnerabilities in non-privileged applications like 'ls' are worth millionssssss.
- jerf 13y agoYes, and then they combine them with a kernel exploit and, uh, suddenly your "unprivileged process" turns out to not be so unprivileged after all. Resist the temptation to marginalize security bugs. They don't exist in isolation.
- tptacek 13y agoYou're right, but so is the parent commenter; there is a popular meme that security bugs in general are worth large amounts of money, but in reality only a small subset of bugs command real money.
- lawnchair_larry 13y agoYou could be a better ambassador of our industry by explaining the misconception instead of being condescending. And we wonder why developers think we are just arrogant jerks.
- dguido 13y agoYou're welcome to step in and explain, but I think it's pretty obvious why local vulnerabilities in non-setuid binaries aren't exactly "critical."
- betterunix 13y agohttps://xkcd.com/1200/ https://xkcd.com/1200/
- dguido 13y agoThat would only be accurate if you could trigger one of these bugs remotely.
- betterunix 13y ago...or if you can trick the user into opening a malicious file. An exploit in ls? Send them a zip, tarball, etc. with a maliciously named file.
- contingencies 13y agoIMHO anyone who contributes to the state of the art with regards to public security tooling is doing the world a favour. Even if the majority of these applications are not well privileged, and therefore of dubious value, applying the same technical knowledge elsewhere could earn them cash. I still applaud their efforts.