The point is that you might not know that an attacker had root. Also, what if they didn't have root directly. What if they knew they could they could make a service act just slightly strange and redirect output to a second program ( maybe a database) which then caused a buffer overflow which then was used to escalate permissions. It happens every day.
On Tue, Apr 30, 2013 at 1:47 PM, Blake Dunlap <[email protected]> wrote: > But if they have root, this backdoor is hardly what I'd be concerned with.. > > It's like freaking out over the fence gate being open while the barn's > completely on fire. > > > On Tue, Apr 30, 2013 at 1:14 PM, andrew mcelroy <[email protected]>wrote: > >> remote root exploits become available all the time. >> >> http://www.infosecisland.com/blogview/21151-Metasploitable-Gaining-Root-on-a-Vulnerable-Linux-System.html >> >> If you hop over to reddit.com/r/linux or /r/sysadmin they seem to think >> it is okay to run commands via root by default. >> Between out of date software and stupid humans, root can be easier to get >> than you'd think at first glance. >> >> >> On Tue, Apr 30, 2013 at 1:10 PM, Blake Dunlap <[email protected]> wrote: >> >>> This "scary exploit" requires root to be installed... >>> >>> I don't get the hype myself >>> >>> >>> On Tue, Apr 30, 2013 at 1:04 PM, Drew from Zhrodague < >>> [email protected]> wrote: >>> >>>> >>>> Thank you very much for this alert, Andrew. I copied down the python >>>>> script and attempted to run. I get: >>>>> >>>>> shmid = shmget(SHM_KEY, SHM_SIZE, 0o666) >>>>> ^ >>>>> SyntaxError: invalid syntax >>>>> >>>> >>>> Yah, that didn't work for me either. >>>> >>>> -- >>>> >>>> Drew from Zhrodague >>>> lolcat divinator >>>> [email protected] >>>> >>>> >>>> -- >>>> -- >>>> You received this message because you are subscribed to the Google >>>> Groups "NLUG" group. >>>> To post to this group, send email to [email protected] >>>> To unsubscribe from this group, send email to nlug-talk+unsubscribe@** >>>> googlegroups.com <nlug-talk%[email protected]> >>>> For more options, visit this group at http://groups.google.com/** >>>> group/nlug-talk?hl=en <http://groups.google.com/group/nlug-talk?hl=en> >>>> >>>> --- You received this message because you are subscribed to the Google >>>> Groups "NLUG" group. >>>> To unsubscribe from this group and stop receiving emails from it, send >>>> an email to >>>> nlug-talk+unsubscribe@**googlegroups.com<nlug-talk%[email protected]> >>>> . >>>> For more options, visit >>>> https://groups.google.com/**groups/opt_out<https://groups.google.com/groups/opt_out> >>>> . >>>> >>>> >>>> >>> -- >>> -- >>> You received this message because you are subscribed to the Google >>> Groups "NLUG" group. >>> To post to this group, send email to [email protected] >>> To unsubscribe from this group, send email to >>> [email protected] >>> For more options, visit this group at >>> http://groups.google.com/group/nlug-talk?hl=en >>> >>> --- >>> You received this message because you are subscribed to the Google >>> Groups "NLUG" group. >>> To unsubscribe from this group and stop receiving emails from it, send >>> an email to [email protected]. >>> For more options, visit https://groups.google.com/groups/opt_out. >>> >>> >>> >> >> -- >> -- >> You received this message because you are subscribed to the Google Groups >> "NLUG" group. >> To post to this group, send email to [email protected] >> To unsubscribe from this group, send email to >> [email protected] >> For more options, visit this group at >> http://groups.google.com/group/nlug-talk?hl=en >> >> --- >> You received this message because you are subscribed to the Google Groups >> "NLUG" group. >> To unsubscribe from this group and stop receiving emails from it, send an >> email to [email protected]. >> For more options, visit https://groups.google.com/groups/opt_out. >> >> >> > > -- > -- > You received this message because you are subscribed to the Google Groups > "NLUG" group. > To post to this group, send email to [email protected] > To unsubscribe from this group, send email to > [email protected] > For more options, visit this group at > http://groups.google.com/group/nlug-talk?hl=en > > --- > You received this message because you are subscribed to the Google Groups > "NLUG" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/groups/opt_out. > > > -- -- You received this message because you are subscribed to the Google Groups "NLUG" group. To post to this group, send email to [email protected] To unsubscribe from this group, send email to [email protected] For more options, visit this group at http://groups.google.com/group/nlug-talk?hl=en --- You received this message because you are subscribed to the Google Groups "NLUG" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/groups/opt_out.
