News for hackers. Stuff that matters.

A comment on CopyFail was not disclosed to Gentoo developer. Parent comment

Re:CopyFail was not disclosed to Gentoo developer by i_think_so on Friday May 01, 2026 @09:55AM (#47974865)
Oh come on, you know what I'm saying. It's small when written in python, which means any skid can spew it into a server he's got a shell on and get root in 2 seconds. He doesn't need to hope there's already a compiler installed, nor does he need to download some big tool. Just:

  cat | python3 && su
  <puke>, Ctrl-D
And I'm sure it can be refined into something much more likable to the spooky types, if they haven't already done it.
[ Parent | on HN ]
Re:CopyFail was not disclosed to Gentoo developer by akerl_ on Friday May 01, 2026 @10:29AM (#47975212)
Again, Linux LPE via either vulns or misconfigured permissions / binaries is common.

People who run servers that give out shell access to uses or randos already needed to contend with this.

Added later: you may find https://gtfobins.org/ fascinating or horrifying.

[ Parent | on HN ]
Re:CopyFail was not disclosed to Gentoo developer by tptacek on Friday May 01, 2026 @12:42PM (#47976849)
This is such a 1996 argument. It really was a big deal back then whether you had compilers on your multiuser SunOS boxes, because attackers would then use them to compile exploit.c.

The whole thread, really bringing me back to comp.security.unix. I'm not complaining! I miss comp.security.unix.

[ Parent | on HN ]
Re:CopyFail was not disclosed to Gentoo developer by i_think_so on Saturday May 02, 2026 @04:55AM (#47984679)
I feel honored to receive some of the much vaunted tptacek disingenuity. It is like a fine wine, only to be appreciated by an experienced palate. I won't deny being a fan, nor smiling at the attention.

Yes, Thomas, I too remember the digital landscape of Unix workstations in 1996. Isn't it interesting that, as the old folks say, "everything old is new again"?

For example, have you noticed that most of the 2.3 metric assloads of virtual machines created and used every day do not bother installing compilers either? Are those sysadmins also pining for a bygone era? Or do they just not need them to run their microservice's static binaries?

[ Parent | on HN ]