Security by utter absence of usability

I've sent a company wide email telling everyone I don't want to be sysasmin anymore.

It has nothing to do with the CVE

Was the command separated by dashes or case change? Let me che...ange to something else.

This one goes to 11

in my defense, my team is always trying to be mr. achiever and drop the latest vulnerability. I got a glimpse of this one and got excited since I hadn't heard of this "new named threat". when I tried reading further to prepare my draft... the reach and exposure of this vulnerability became clear.

also, to mitigate this, we'd have to hotpatch layer 8.

Getting a shell is bad, but what makes this worse is the insecurity of popular Linux tools that can be used for privilege escalation.

The sudo program has had a known vulnerability since its inception. The developers are incompetent. In some configurations, all you need is the user's password and you can execute arbitrary code as root. Sometimes, no password is needed at all.

powershell is good because no hacker can be bothered typing that much to get anything to work ;)

I rarely comment on Lemmy but you actually made me laugh for 5 minutes straight 👏

Finally, I’m a real hacker.

Fortunately Windows is at least protected from gaining elevated privileges since it still has to go through UAC. I hope nobody discovers some vulnerability called something like "desktop2shell".

I had a msg to my team drafted before I realized I was a fucking idiot.

While the palindromic structure of that command is pleasing to mine eye, LMDE basically called me a frickin' idiot for trying.

I know it always asks Continue [Y/n] and there's no yes | or echo | to force that, so I was reasonably sure I'd get away with it, but I don't think I could argue with the sentiment had it actually said that.

(Also, I have Timeshift, so that would have saved my bacon but for the inconvenience of having to go through a rollback.)

Anyway, here's what it said (scrolling may be required to see the last line which is clearly code for "you're an idiot"):

REMOVING:                       
  apt       apt-utils          mint-meta-cinnamon  mintsources  mintupdate       sudo
  apt-file  command-not-found  mint-meta-core      mintsystem   python3-repolib

WARNING: The following essential packages will be removed.
This should NOT be done unless you know exactly what you are doing!
  apt

Summary:
  Upgrading: 0, Installing: 0, Removing: 12, Not Upgrading: 1
  Freed space: 52.3 MB

Error: Removing essential system-critical packages is not permitted. This might break the system.

Okay. I briefly ate the onion, on this one. It tastes like sysadmin tears.

I'm not taking any chances. I've already tossed bash into the /bin/

Nobody show this to my boss please, they'll be asking me why I haven't fixed it yet

I used the stones to destroy the stones

Given simple primitives and runtime permissions, a skilled hacker can even bootstrap one of these “shells” from scratch, underlining the continued importance of banning math and computer science education in our schools.

nushell, ash, elvish, dash, powershell, ...

Oh, I heard of this one! Basically every single accidental corruption of any kind in any compny's production environment was made possible by this exploit! Scary stuff!

sudo apt remove apt sudo

So zsh is good? /s

Gotta minimize your attack surface sudo apt remove konsole for any Debian kde based distros

Phew! Just got done patching all my servers. The main IOCs are

• C:\Windows\System32\cmd.exe
• /bin/bash
• /bin/sh

Just tried it out. It is real. And really simple to do.

Scary stuff. Tossing my machines in the bin tomorrow.

They may have experienced covid lockdown in Melbourne. Most of us don't feel like we are under an authoritarian government

They're right that our constitution doesn't give us rights. Our rights stem from common law and convention