Re: Sudo tricks


So, in other words, all you need in order to get root access is a
rootkit, your shell script, and root access? Ummm... I don't get it.

I was also confused by this. However, one guess is that by
compromising an unprivileged account and creating command aliases to
run trojaned su and sudo programs, the attacker can hopefully gain
access to another account, then another, etc. By using these sudo
"privilege chains" the attacker might eventually obtain root access.

This attack would be slightly virus-like in behavior, although local
to the system. And it might accomplish less, and more slowly, than if
the attacker used some other means to determine the explicit su/sudo
relationships and exploit them directly (e.g. sudo -l to list allowed
commands?) And this attack sounds like it's entirely dependent on
whether or not such a chain even exists on the system. Insert
standard text about the likelihood of easier attack vectors here.

Just a guess, though. Interesting notion of a local-only "virus" to
compromise users on a multi-user system, although it seems like just
another way to exploit trust relationships once you've gained access
to a local account.

- Steve

Relevant Pages

  • Re: Why are there few viruses for UNIX/Linux systems?
    ... while provider the attacker full control over the remote system. ... > Pfizer's Global account which logged us onto the internet as was, ... Then gained root access as the Systadmin there had a second hidden ...
    (comp.os.linux.security)
  • Re: Masking/Hiding a password in Perl Source
    ... In the interest of security, I want to find a way to mask this. ... This is actually a hard problem to solve in the general sense. ... so this will simply delay but not impede the attacker who has ... obtained root access. ...
    (comp.lang.perl.misc)
  • Re: securing wireless
    ... > Security is never absolute. ... You add layers, in order to make it too ... > difficult for an attacker. ... > still have to find a way to get root access etc. ...
    (comp.os.linux.networking)
  • Re: Root access loggin
    ... Once any kind of local access is given to a user trust becomes an issue; regardless of root access or not. ... This is where sudo is unlike root access. ... easy for the user to keep track of just the root-privileged commands, ...
    (freebsd-questions)
  • Re: Security Weaknesses of OS X
    ... Tom Stiller wrote: ... a closer equivalent would be to type 'sudo su'. ... Lots of Unix systems have sudo. ... sudo ends the root access after a period of time ...
    (comp.sys.mac.system)