“Most serious” Linux privilege-escalation bug ever is under active exploit

Re:“Most serious” Linux privilege-escalation bug ever is und... by peterwwillis on Thursday October 20, 2016 @07:41PM (#12757117)

Fwiw, you should never think about an OS in terms of what security features they have enabled by default. The OS is almost always designed to help the user use programs and to help programs run. Just assume it is not secure until you do an audit + lockdown yourself.

If you want a secure system by default, you should probably not use Linux. I would go with OSX or OpenBSD to start.

(And finally: mounting /usr read-only isn't actually a security feature, because if you can exec code you can run a privesc and remount /usr read-write; mounting as noexec could arguably be considered a security feature)

[ Parent | on HN ]

Re:“Most serious” Linux privilege-escalation bug ever is und... by caf on Thursday October 20, 2016 @07:49PM (#12757152)

OSX, really? It's had more than one privilege escalation exploitable from just a shell prompt (eg. the DYLD_PRINT_TO_FILE bug).

Not really surprising since it's overwhelmingly used in practice as a single-user system.

[ Parent | on HN ]

Re:“Most serious” Linux privilege-escalation bug ever is und... by ams6110 on Thursday October 20, 2016 @07:44PM (#12757133)

OSX? How is that more secure by default than Linux?

[ Parent | on HN ]

Re:“Most serious” Linux privilege-escalation bug ever is und... by peterwwillis on Thursday October 20, 2016 @07:47PM (#12757149)

Less published exploits. Okay, so "more secure" isn't exactly correct, maybe "more difficult for a 10 year old with Metasploit to own it"

[ Parent | on HN ]

Re:“Most serious” Linux privilege-escalation bug ever is und... by vacri on Thursday October 20, 2016 @11:21PM (#12757947)

Who'd've thought that an OS that is rarely used to serve remote content is more resilient against software focused on breaking into remote systems?

[ Parent | on HN ]