News for hackers. Stuff that matters.

A comment on Reading privileged memory with a side-channel. Parent comment

Re:Reading privileged memory with a side-channel by user5994461 on Thursday January 04, 2018 @02:56AM (#16068698)
>>> By "user to root privilege escalation", I'll assume you mean leaking kernel data without root, since this attack doesn't directly allow escalating privileges at all.

The attack allows to read all the memory. Isn't there a way to scan for passwords or ssh keys and turn that into a privilege escalation?

[ Parent | on HN ]
Re:Reading privileged memory with a side-channel by comex on Thursday January 04, 2018 @03:25AM (#16068775)
Sure, SSH keys would probably work on a system with SSH enabled; I just wouldn't count that as "directly". (That would include most servers but exclude most Android devices; I have no idea whether there are other escalation methods for Android.)
[ Parent | on HN ]
Re:Reading privileged memory with a side-channel by user5994461 on Thursday January 04, 2018 @11:26PM (#16076527)
Direct or indirect is meaningless at this point. The exploit is proven, they just have to determine the "best" memory locations to read to make something "useful" out of it. Then it's bundled together as an exploit kit and it's Armageddon.
[ Parent | on HN ]