5 ms·
You need root in order to overwrite sudo in the first place I think, but yes password replay attacks are real. This is why I think it is a good idea to get a yu
by ahelwer 18d ago
You need root in order to overwrite sudo in the first place I think, but yes password replay attacks are real. This is why I think it is a good idea to get a yubikey and use PAM to require a physical user presence check to acquire root privileges. You don't even need a password at that point. Unfortunately haven't figured out how to make this work over SSH.
- porridgeraisin 18d agoNo, the above attack writes that function into bashrc, meaning the next time the user runs sudo themselves, you harvest their password.
- ffsm8 18d agoLook at the excerpt. They're not overwriting the sudo binary. The attack vector is real for malware running on a administrator user session which can be escalated to root via sudo. It's a niche, but it's real. Esp. if you're targeting npm installed user scripts or similar
- lrvick 18d ago> You need root in order to overwrite sudo in the first place I think You just need write access to .bashrc or similar. > This is why I think it is a good idea to get a yubikey and use PAM to require a physical user presence check to acquire root privileges. Unprivileged malware will be waiting with a root payload ready to fire the next time you tap your yubikey.
- Brian_K_White 18d agoYou do not need root to run that shell function, nor to get it loaded into a shell's environment. They didn't say anything about overwriting the sudo binary, and that is not required, which I think was their whole point was to show exactly how that is not required.