Linux ransomware in the wild

Re:Linux ransomware in the wild by throwmenow_0140 on Saturday October 21, 2017 @12:23PM (#15522345)

agree. ordinary user is absolutely sufficient. I'll now present a sophisticated privilege escalation method that most of us won't notice (me included, sarcasm off):

  alias sudo='/usr/bin/sudo echo something evil && /usr/bin/sudo'

I don't think it matters that he used his root account.

Edit: Maybe I'm wrong with my opinion, you can disable ASLR using your root rights... https://askubuntu.com/a/318476

Edit: Last exploit for Linux remote exploitation with Flash is from 2015 https://www.rapid7.com/db/modules/exploit/multi/browser/adob... or did I miss something here?

[ Parent | on HN ]

Re:Linux ransomware in the wild by LinuxBender on Saturday October 21, 2017 @01:26PM (#15522609)

As an attacker, I test for sudo -n. If it succeeds, I have root. In most cases I do not need it however. SSH key trusts, SSH multiplexing and bad posix permissions are more than enough to get me anywhere and grab anything.

[ Parent | on HN ]

Re:Linux ransomware in the wild by JTechno on Saturday October 21, 2017 @01:10PM (#15522552)

I'm going to make a separate account just to run the web browser, xhost +localhost && su -c web-browser unprivileged-user

[ Parent | on HN ]

Re:Linux ransomware in the wild by freeloop3 on Saturday October 21, 2017 @06:05PM (#15523879)

If you're using xwindows they can just install a keylogger

[ Parent | on HN ]

Re:Linux ransomware in the wild by jlgaddis on Saturday October 21, 2017 @04:44PM (#15523531)

There was a zero-day for Flash being exploited ITW just a few days ago.

[ Parent | on HN ]

Re:Linux ransomware in the wild by incompatible on Saturday October 21, 2017 @07:20PM (#15524153)

I didn't think any browser on Linux still supported Flash.

[ Parent | on HN ]

Re:Linux ransomware in the wild by wrycoder on Saturday October 21, 2017 @12:43PM (#15522441)

I use /usr/bin/sudo <>

[ Parent | on HN ]

Re:Linux ransomware in the wild by chrisfosterelli on Saturday October 21, 2017 @12:53PM (#15522482)

So they check .bash_history and then they realize they just need to also `alias /usr/bin/sudo`.

[ Parent | on HN ]

Re:Linux ransomware in the wild by kbp on Saturday October 21, 2017 @01:31PM (#15522634)

> So they check .bash_history and then they realize they just need to also `alias /usr/bin/sudo`.

    $ alias /usr/bin/sudo=whatever
    bash: alias: `/usr/bin/sudo': invalid alias name

[ Parent | on HN ]

Re:Linux ransomware in the wild by chrisfosterelli on Saturday October 21, 2017 @03:20PM (#15523158)

Oh, fair point. Not all shells support this apparently. zsh does:

    -> alias /usr/bin/sudo='ls -a'
    -> /usr/bin/sudo
     .  ..

[ Parent | on HN ]

Re:Linux ransomware in the wild by wrycoder on Saturday October 21, 2017 @01:08PM (#15522548)

Hm. How about ‘sudo’ <> ? i.e. quote the command?

[ Parent | on HN ]

Re:Linux ransomware in the wild by wallacoloo on Saturday October 21, 2017 @05:22PM (#15523683)

If they have access to your .bashrc they can also alter your PATH and create a script named sudo somewhere they have write access to that carries the malicious payload. So you're not gaining much by adding the quotes.

[ Parent | on HN ]

Re:Linux ransomware in the wild by chrisfosterelli on Saturday October 21, 2017 @03:24PM (#15523176)

Based on the sibling comment to yours, I don't think bash supports this. zsh allows you to make a \'sudo\' alias though, so it depends on your shell.

[ Parent | on HN ]

Re:Linux ransomware in the wild by wrycoder on Saturday October 21, 2017 @03:48PM (#15523293)

At least in bash, quoting the command disables any alias. Maybe also in zsh?

[ Parent | on HN ]

Re:Linux ransomware in the wild by chrisfosterelli on Saturday October 21, 2017 @03:54PM (#15523323)

zsh seems to have much more flexible alias rules than bash:

    > alias \'sudo\'='ls -a'
    > 'sudo'                
    .  ..

[ Parent | on HN ]