Hacker News Reader

Comment by netsec_burn | Hacker News Reader

Security guy here. I had the chance to look over this project and try it out today. I have no less than 5 ways to acquire root privileges from an unprivileged user in the 15 minutes I looked at it. Has anyone audited this distro in the past 10 years?

View on HN

With 5 ways to get root, the attacker will be rendered harmless via decision paralysis.

Do you plan on documenting and contributing an actual critique or just making an unverifiable internet jab? Because if you're serious then the project would probably welcome knowing the specific so they can evaluate their system design.

Yes, I mentioned in another comment (at the time of your comment) that I planned on doing a more comprehensive writeup at a later date. If what you're saying is my claims are unverifiable, you're correct. I generally don't publish any of my research unless there's a way to keep my lights on. The good news is, I should be able to soon.

Thanks security guy. For reference, how many ways to break in do you find per 15 minutes when looking into other distros?

Depends on their popularity. For Ubuntu, Debian, RHEL, Mint, MX Linux, etc. it took me 10 years to find a single LPE. Special case Linux distros, like those for audio editing or signal processing, have about 1-3 LPE's in the first 30 min to an hour I look at them. And GoboLinux.. broken permissions, broken trust of library load paths, root SUIDs with 5 LPE issues at a glance of the source. They even gave some regular binaries root privileges because why not. I didn't look into the root services running or writable paths because I assumed those would be vulnerable too. The question is not if you can get root, but how many ways there are to get root. I was running GoboLinux in a 15 minute session, and once it expired I didn't start a new one.

I'll come back to it and do a more comprehensive audit. I haven't released any zerodays I've found, ever, but recently I was thinking about making a blog. This might be some good material.

Thanks, good to know that this is not the norm. Yes please do a more comprehensive audit. And start a blog.

Any experience with opensuse?

It's the last distro on my bucket list. I have vulnerabilities but nothing to drop a root shell.

just wanted to thank you for the update

Have you audited Tails by any chance?

I have. Only so far as to test if another zeroday I created worked. It did because it shares a lot of similarities with other Debian-based targets. I haven't tested Tails further, because there are no ethical buyers of Tails vulnerabilities.

How does this compare to other "weird" distros like NixOS or GuixSD?

I spent about an hour on this after your comment. Honestly, I was pretty lost in the filesystem for half of that time. I have never used either distro.

My copy of NixOS had no password on the root user by default, which is not ideal but I assume most deployments aren't like that (right?). I was able to become other users on GuixSD using the SUID's the distro ships with, but not root. Not yet. The surface is much larger on both of those distros than the mainstream OS's. I may be able to pull of a root LPE, but I'd need to look for a full day at least.

Thanks for the insight. I believe you are expected to set a root password in the installer :) but other than that I wouldn't know.

Can you send a message to <guix-security@gnu.org>?

https://guix.gnu.org/en/security/

> My copy of NixOS had no password on the root user by default, which is not ideal but I assume most deployments aren't like that (right?).

By no password, do you mean:

- it is impossible to log in as root with a password (a good thing, I'd think, as people should be using sudo), or

- it's possible to log in as root without any authentication (a bad thing, obviously)?

I recall that by default it is impossible, and you are expected to use 'sudo'. Of course that means you can also use 'sudo su'.

> My copy of NixOS had no password on the root user by default

That isn't the default behavior for NixOS. From the docs[1]:

> If set to null (default) this user will not be able to log in using a password (i.e. via login command).

The installer also asked for a root password when I installed NixOS years ago and it still does[2].

[1]: https://search.nixos.org/options?channel=20.09&show=users.ex... [2]: https://github.com/NixOS/nixpkgs/blob/a3a531071598cad0c60485...

Ugh. Any specific examples, just for the record, for someone who doesn't care enough to try the system?

Reply on news.ycombinator.com