I work at google just shut off every server to protect us. 👍
I just tested this exploit, I was easily able to remove the french language pack by typing “rm -fr /*”
Switch off computer is the best mitigation
Removing keyboard and locking operator out of building is the next best thing.
Okay. I briefly ate the onion, on this one. It tastes like sysadmin tears.
I was fooled until I saw the CVSS score of 11 on a scale of 0 to 10.
I had a msg to my team drafted before I realized I was a fucking idiot.
in my defense, my team is always trying to be mr. achiever and drop the latest vulnerability. I got a glimpse of this one and got excited since I hadn’t heard of this “new named threat”. when I tried reading further to prepare my draft… the reach and exposure of this vulnerability became clear.
also, to mitigate this, we’d have to hotpatch layer 8.
I’ve sent a company wide email telling everyone I don’t want to be sysasmin anymore.
It has nothing to do with the CVE
I only figured it out because I read your comment.
That’s why I confessed. I’m glad to help.
I’m here cautiously making sure it’s a joke that I don’t understand. Problem exists between keyboard and seat.
Getting a shell is bad, but what makes this worse is the insecurity of popular Linux tools that can be used for privilege escalation.
The
sudoprogram has had a known vulnerability since its inception. The developers are incompetent. In some configurations, all you need is the user’s password and you can execute arbitrary code as root. Sometimes, no password is needed at all.sudo is so broken, automatic privilege cloning of any user
Just tried it out. It is real. And really simple to do.
Scary stuff. Tossing my machines in the bin tomorrow.
I’m not taking any chances. I’ve already tossed
bashinto the/bin/
Finally I’m justified in doing everything via a GUI.
Nobody show this to my boss please, they’ll be asking me why I haven’t fixed it yet
Only tangentially related, but this reminds me of an interaction I had here on Lemmy. I was talking about my pure bash, brain-made CLI app that pushes files between Google Compute head nodes and Google Storage buckets, but does some additional fuckery with bash strings to serve as a crude git. Basically, the app manipulates a string that represents a bucket, and then uses the appropriate gcloud command with that string.
Someone was extremely concerned about the security of my app, how I should do an AI code review, and that only good programmers use all the tools available to them. I told them that I only want my code to be reviewed by humans. They said it was wild that someone would decline a security review. I told them that if there’s a security issue with my app, they’ll have to take it up with Google.
Given simple primitives and runtime permissions, a skilled hacker can even bootstrap one of these “shells” from scratch, underlining the continued importance of banning math and computer science education in our schools.
Phew! Just got done patching all my servers. The main IOCs are
- C:\Windows\System32\cmd.exe
- /bin/bash
- /bin/sh
So zsh is good? /s
nushell, ash, elvish, dash, powershell, …
powershell is good because no hacker can be bothered typing that much to get anything to work ;)
Security by utter absence of usability
I’m taking some admin/security courses and powershell was touted as “it’s so easy to make your own scripts to save time!”. I was just like, “the fuck Koolaid are you drinking?”
pwsh
Was the command separated by dashes or case change? Let me che…ange to something else.
The article says it’s a one click exploit, but I’m finding I need to make two quick clicks to enter into the program. Can someone help me?? Am I doing something wrong?
I’ve spent all day trying to update my software to get this to work!!!
Yeah, I have to hit super then type ‘te’ before I can one-click this exploit
Though I guess I could make it one-click if I added a desktop shortcut to the terminal emulator
This one goes to 11
Gotta minimize your attack surface sudo apt remove konsole for any Debian kde based distros
sudo apt remove apt sudoI used the stones to destroy the stones
While the palindromic structure of that command is pleasing to mine eye, LMDE basically called me a frickin’ idiot for trying.
I know it always asks
Continue [Y/n]and there’s noyes |orecho |to force that, so I was reasonably sure I’d get away with it, but I don’t think I could argue with the sentiment had it actually said that.(Also, I have Timeshift, so that would have saved my bacon but for the inconvenience of having to go through a rollback.)
Anyway, here’s what it said (scrolling may be required to see the last line which is clearly code for “you’re an idiot”):
REMOVING: apt apt-utils mint-meta-cinnamon mintsources mintupdate sudo apt-file command-not-found mint-meta-core mintsystem python3-repolib WARNING: The following essential packages will be removed. This should NOT be done unless you know exactly what you are doing! apt Summary: Upgrading: 0, Installing: 0, Removing: 12, Not Upgrading: 1 Freed space: 52.3 MB Error: Removing essential system-critical packages is not permitted. This might break the system.Honestly, I want to be allowed to break my system. I own it, it should do exactly what I say, warnings are fine, but software deciding it knows better than you is how we have reached the inescapable technogulag of the now.
In my experience, Linux only allows you to do 1 incredibly stupid thing at a time. Remove sudo? Cool. Remove apt? You betcha. Remove apt AND sudo? You’re fucking nuts, I ain’t doing that
https://www.gnu.org/philosophy/free-sw.en.html#four-freedoms
Freedom 0 says I can be nuts and that clankers better obey
I use Konsole on my Mac. It’s not listed on there, so am I safe?
