4 ms·

> Random PIDs > Eliminates race conditions > Say you have a root daemon that forks then the child drops privileges. If you can beat the child you can inherit ro

> Random PIDs > Eliminates race conditions > Say you have a root daemon that forks then the child drops privileges. If you can beat the child you can inherit root privileges Can someone explain this? I don't see what this has to do with the randomness of pids.

Someone 12y ago
The best I can find on this is https://books.google.nl/books?id=gqKwaHmXp4YC&pg=PA50&lpg=PA50&dq=random+pid+bsd&source=bl&ots=jkiBlXLN1P&sig=uLQToYRJB8_SJAjLOj9ewF3595k&hl=en&sa=X&ei=5aoMVYzVOsvuaJulgIAG&ved=0CB8Q6AEwAA https://books.google.nl/books?id=gqKwaHmXp4YC&pg=PA50&lpg=PA.... Seems an extra layer in defence in depth, making it harder to attack a process between the time it is forked and the time it has dropped privileges by making it harder to find it.
OpenBaSeD 12y ago
Being the most secure OS, these days, is like being valedictorian of summer school. The reality is as soon as you install a dynamic language behind a webserver all their memory tricks are for not. They are still focusing on exploitation from 2002.
grkvlt 12y ago
Something like after the parent forks, the child opens a file called "/tmp/log.$$" with its PID in the name as root. If you can guess the PID of the child, you could create a link with that name, pointing at a file of your choice that is owned by root, such as "/etc/passwd". Then, you need to make the child do something predictable to that file, such as ensuring that the user supplied data being logged contains text like "\npwn::0:0::/:/bin/sh\n" giving you a valid password file entry for "pwn" with no password and root privileges.
- xorcist 12y ago
  Predictable file names in tmp is considered a security issue pretty much everywhere (hence mkstemp), so I would guess that's not what they mean.
tedunangst 12y ago
That does seem like a strange example. Random source ports is probably a better example of system wide randomization.

Someone 12y ago

The best I can find on this is https://books.google.nl/books?id=gqKwaHmXp4YC&pg=PA50&lpg=PA50&dq=random+pid+bsd&source=bl&ots=jkiBlXLN1P&sig=uLQToYRJB8_SJAjLOj9ewF3595k&hl=en&sa=X&ei=5aoMVYzVOsvuaJulgIAG&ved=0CB8Q6AEwAA https://books.google.nl/books?id=gqKwaHmXp4YC&pg=PA50&lpg=PA.... Seems an extra layer in defence in depth, making it harder to attack a process between the time it is forked and the time it has dropped privileges by making it harder to find it.

OpenBaSeD 12y ago

Being the most secure OS, these days, is like being valedictorian of summer school. The reality is as soon as you install a dynamic language behind a webserver all their memory tricks are for not. They are still focusing on exploitation from 2002.

grkvlt 12y ago

Something like after the parent forks, the child opens a file called "/tmp/log.$$" with its PID in the name as root. If you can guess the PID of the child, you could create a link with that name, pointing at a file of your choice that is owned by root, such as "/etc/passwd". Then, you need to make the child do something predictable to that file, such as ensuring that the user supplied data being logged contains text like "\npwn::0:0::/:/bin/sh\n" giving you a valid password file entry for "pwn" with no password and root privileges.

xorcist 12y ago
Predictable file names in tmp is considered a security issue pretty much everywhere (hence mkstemp), so I would guess that's not what they mean.

tedunangst 12y ago

That does seem like a strange example. Random source ports is probably a better example of system wide randomization.