7 ms·
To clarify, when does this run? Like you download malware A, run malware A and this function definition changes sudo for it, or sudo for other cases?
by nazcan 4mo ago
To clarify, when does this run? Like you download malware A, run malware A and this function definition changes sudo for it, or sudo for other cases?
- lrvick 4mo agoThis could for instance be injected into your .bashrc when you do an "npm install" of a package that has a deeply nested supply chain attack. Then the next time you run sudo, phase2 triggers installing a rootkit, etc.
- arcfour 4mo agoOr you could also hijack it using $PATH search order with your wrapper to get existing terminal sessions too, there's a lot of ways to skin that cat.
- lrvick 4mo agoEndless ways, which is why I do not understand why sudo is ever used anymore, especially in production. You do not need root to do anything in Linux these days anyway between Namespaces and Capabilities so there is really no reason for root to be accessible at all or have any processes running as root post boot.
- GCUMstlyHarmls 4mo agoI dont mean to be snarky, can you run `pacman -Syu` without root with "new" tech? Or do you mean in general on production systems or whatever?
- lrvick 4mo agoPlenty of package managers can install to an arbitrary directory like ~/.local. Each user, or even each project, can have its own rootfs full of software. The only things I tend to have running at the system level are a kernel and init and maybe openssh.
- Ferret7446 4mo agoThat is one of many reasons to keep your dotfiles under version control.
- lpribis 4mo agoHow would that help? Unless you happen to check the dotfiles git diff before running _anything_. I guess this could be put in prompt or some cron job to detect diffs but I bet absolutely nobody does this.
- lrvick 4mo agoSomeone that can wrap your sudo binary can wrap you git binary too. Once your OS is compromised all bets are off.