Can’t wait for one that’ll work on Android so I can maybe root some otherwise useless old phones
What would you use the old phones for out of curiosity?
A middle finger to those you’re jailbreaking from.
I’m not the person you replied to, but I would love to have more ARM hardware for running tests on. A lot of what I write needs to be separately tested on each architecture.
I’ve encountered a couple of people who use them as remote cameras to observe their 3D printers. That suggests a bunch of other possibilities for things you want to be able to watch or listen to without standing over them and without buying an extra webcam to cover what might be a temporary need.
They are less expensive.
EDIT:
Sorry, I misread the parent comment.
You would use them for literally anything you typically or potentially could use a phone for.
If you are not playing video games on your phone… there is basically no common reason to have a top spec brand new phone.
What do I want my phone to do?
Make calls, send messages, run a web browser, check emails, take a picture or video every once in a while, act as a notepad, check a weather forecast, have some map explorer, use some entirely 2D proprietary apps for things like… groceries or hailing a ride or checking my bank balance.
Pretty sure that right there is about 80% of people’s phone use case.
You do not need top spec hardware to do any of that.
You have the gaming thing to do the gaming stuff.
Removing all the system-level bloat that makes them unpleasant to use, perhaps stripping one down to the level of a fancy MP3 player with its microSD slot. Also having “disposable” phones to play with various rooted tweaks. All of my easily-rootable phones are too valuable as daily drivers to experiment on, while all of the ones I don’t care about also don’t have rooting methods yet.
In the 90s I compiled all my kernels at home from source with just the drivers I needed. Only installed the packages I needed. Only enabled the services I needed. The Unix way. When the kernel added modules I was still only compiling a subset and generally loading them manually.
Obviously that doesn’t work for most users and distros sensibly started shipping with modules compiled for practically every need. Usually when I view distro security alerts they are for packages I don’t install. But I have all these damn kernel modules just waiting to automatically load. I know I can blacklist them individually but I wonder if there is a way to profile the modules I use and use a deny all/whitelist approach instead?
Clearly you know of lot about this. Here are some comments for the next human.
Deny all modules seems more possible than a whitelist approach. To deny all, the command is likely “sysctl kernel.modules_disabled=1”.
Whitelisting is harder. One could store a list of all loaded modules on a working system. Store a list of all kernel modules currently installed on the system. Compare the lists and remove from the “all” list the “running” list (grep will do this) and write it to the blacklist file.
The problem with the Whitelisting approach is that it needs to run after every kernel module install (which is doable).
If the above is the case, then someone must have automated this already, but I cannot find it quickly. (I checked Debian’s package repository.)
Clearly you know of lot about this.
Nah, that is the problem. It all got so dynamic and easy I don’t really know how the hundreds of active modules on my desktop are loaded, why or in what order anymore. The days when I could list a handful of modules to load at boot are long gone I think unless its an embedded device or perhaps a simple server.
Setting modules_disabled might be viable for a relatively static system. I have seen that one when looking at hardening servers in the past but thought it was a bit extreme. Perhaps not.
Ok this is the first time I try one of these exploits and it works on my system, I’m currently very spooked.
On the other hand, this may allow me to root my LG WebOS TV?
Now that i Didn’t consider
may become useful if i forgot my password.
Or somebody else’s password
It was patched in almalinux though, and it was how this exploit got exposed before disclosure.
At lest this is what I read
Well shit. I wonder if all Linux systems are affected, the testing in the repo doesn’t cover Arch for instance. For now I’d assume the answer is yes.
deleted by creator
Have you tried updating your system with a less cheerful command? Like
damn -Syu
Does this affect immutable distros like Bazzite?
deleted by creator
This exploit appears to be inspired by the copy fail.
Should you be worried? Nah, You should not be installing untrusted software on your device. This isnt even the type of exploit that scares me. Your device gas to already be compromised for this exploit to succeed.
Supply chain attacks are what scare me.
Supply chain attacks are what scare me.
As a former OS security pro, this is the right answer. Not because of the exploit itself, but because young (unmentored) coders readily trust some really bad patterns of pulling in random junk from the web and running it. THIS is how the LPE becomes essentially an RCE-level problem.
It’s a positive thing, don’t be worried.
These vulns already existed. It’s possible the bad guys were already using them. This gets them out in the open and on their way to being resolved.
Just keep patches up to date with any modern and maintained distro and you’ll be grand.
With AI enabled bug hunting, you’re likely to see a blitz of vulnerabilities, followed by a significant reduction in vulnerabilities.
Yes, malicious folks are usin em – heck, Kali’s had AI integrations for a while on a bunch of its tools even, for pen testing. But devs writing code get em too, and those are the people we need to see using these sorts of workflows as it lets them clip a bunch of zero days.
I think Mozilla, as an example, had a recent patch that cleaned up something like 271 zero days? Anthropic taking their Mythos stuff to banks/govt was largely just a publicity thing to try and shut people up who were mocking claudes code, but also potentially because it’d found govt-placed backdoors that they wanted the gov to know were about to be exposed / patched. The USA’s alleged ability to “shut off” tech assets during raids in Venezuela and Iran, gets trickier if AI is exposing their back doors. Likely also why the US Administration is now saying they want to review AIs before they get released. Mythos definitely isn’t the only game in town for this sort of stuff – but the general idea that the dev teams will be shifting to using these tools for QA / writing more secure apps in the near future, is fairly valid. So I wouldn’t go too tinfoil hat-y on that front… though it is a period where we’ll see a need to patch aggressively, and to double check security configs etc.
The Mozilla numbers are wildly inflated. They were effectively just advertising for Anthropic’s mediocre LLM with that blog post.
Eh, fair enough – doesn’t really change the underlying concept though.
if somebody has user access to your computer, they are already 95% there, so I am not worried about these priv escalation part of the last 5%
deleted by creator
Your user account can run applications and read and write to a lot of locations on the disk.
So it can be used to run malware (cryptominers, ransomware, RATs etc.) Exfiltrate the data your account has access to, download or plant malicious or illegal data, use your internet connection to attack other systems with DOS or similar, use any logged in social media accounts to attack or spam your contacts, steal saved passwords and credentials from your web browsers, use your peripherals or connected devices (printers cameras microphone speakers), pivot to access other services on your local network (smart devices, IoT, TVs, home lab) etc.
There are comparatively few things an attacker wants on a desktop that actually require root access. It’s mostly just system files, package management and settings changes that require root to mess with. Eg. You would need root to dump a shadow file or stuff like luks encryption keys from kernel memory, but if an attacker has your logged in user account, the disk is already decrypted and account is already logged in.
Most systems also use single user, you normally give yourself docker group access (I use docker for work) and that alone is equivalent to root access. It’s not the 90s anymore where universities gave user access to all students, priv escalation was a big security threat, now it almost doesn’t mean anything, nobody shares the same machine anymore the way they used to do.
Yes kinda? It depends a lot on the system. It’s still pretty common, even with containers like docker, for different services to run with different accounts and permissions. Eg. If you have a webapp with a small database or something, the web server will be
www-dataor whatever and the db will be a different user account like apostgresuser or something. Even a fresh Linux install will have a separate user account for things likentp(orsystemd-timesync) etc. Users aren’t usually people, they’re daemons with limited scope and rule of least privilege.Even if it’s all docker containers and you deploy them with the same docker account on the host, there are almost certainly a bunch of different accounts inside.
That way if there’s some vulnerability in ntp or something, an attacker might have permission to mess with the time but can’t, in theory, take over the whole container.
I think there is a trend towards caring less about that aspect of defence in depth if each service is in its own container and just rely on isolation. People are deploying services running as root with ansible or even just in dockerfiles, and not caring about it because there’s nothing else on the box for an attacker anyway. If they compromise the service, they’ve already got what they want.
I get the thought process but it still doesn’t feel good to me. If some docker bug shows up that allows a container user with root to break isolation and use the shared kernel to pivot to the host or other containers, then that one dodgy webapp that’s not running as a restricted user can become a part of a larger kill chain. It’s really easy to develop systems with least privilege in mind and there’s not much downside to doing it. It’s a good habit to create different accounts for different services (even if there’s one admin/docker/ansible/whatever account for deployment).
For me the scariest thing someone could do on my pc is exfiltrate all the data from my home directory which is readable by my user account.
Maybe I’m misunderstanding you, but that’s harm to me without root access.
Funny that just after Microsoft commits suicide with Winders 11, Linux “exploits” start popping up like Whack-A-Moles. Makes one wonder if they were inserted by MS engineers.
Nah, people just started using LLM assisted vuln discovery workflows and having early successes with them.
There will be diminishing returns.
We’re living through the Linux’ enshittification era
Not really. Proprietary software have just as many if not more vulnerabilities. Linux is just more honest and open about reporting them so it seems like they have more.
Linux also shows up more in CVE databases etc because many distributions also assign their own CVEs for the same bugs.
I feel like you don’t even know what enshittification is.
How is finding vulnerabilities and patching them enshittification?
Not sure the term applies here. Enshittification is about companies making products worse on purpose for profit.
See who’s behind the Linux Foundation
No?
