Hacker News Reader

nathan_naveenon LD_PRELOAD, The Invisible Key Theft

Nice! Looks cool!

nathan_naveenon LD_PRELOAD, The Invisible Key Theft

VMs are themselves untrustworthy we should be computing with paper and pencil (and flipping bits with an eraser)... Lol!

nathan_naveenon LD_PRELOAD, The Invisible Key Theft

Exactly, that is our thought process!

We know that this isn't anything revolutionary, but most people assume that this kind of thing can't happen, so we wrote a blog post about it.

nathan_naveenon LD_PRELOAD, The Invisible Key Theft

Question... if you change the path wouldn't a decent security tool be able to identify that it is a different executable? Also, if you are allowing an executable to access a directory then the executable should also be protected. Thoughts?

nathan_naveenon LD_PRELOAD, The Invisible Key Theft

The idea for this blog post was that if someone becomes a user in your system but you have a basic security policy in place how can they circumvent it. That is how we came across LD_PRELOAD.

nathan_naveenon LD_PRELOAD, The Invisible Key Theft

KubeArmor...

nathan_naveenon LD_PRELOAD, The Invisible Key Theft

Hey, we agree that if someone can modify your env variables you have got problems ;) But, if you have valuable data on your system then you should have defense in depth so that your most important stuff (secrets, etc...) isn't stolen.

nathan_naveenon LD_PRELOAD, The Invisible Key Theft

Thank you! We will take a look!

nathan_naveenon LD_PRELOAD, The Invisible Key Theft

Yeah... we thought the same thing but we checked a couple other EDRs and saw that a few of them don't do this. If you guys know some EDRs that do this, let us know :)

nathan_naveenon LD_PRELOAD, The Invisible Key Theft

Hey, the author here... Our blog post is mainly talking about how the vulnerability works, but even if there is an insider threat (or reverse shell or any kind of attack) there are ways to stop this. We at Bomfather have a solution for this (we aren't trying to plug ourselves here), but any good eBPF solution should be able to protect this.

nathan_naveenon GitHub's Ubuntu Runners Have 1,681 Packages and 9 High Severity Vulns

Thanks for your thoughts!

Yeah, that is exactly what we thought, so we are migrating our runner to our own infra.

nathan_naveenon GitHub's Ubuntu Runners Have 1,681 Packages and 9 High Severity Vulns

Hey, I'm a co-founder of Bomfather, we just stumbled upon this problem when we were building our product. Our product doesn't actually secure this, the best solution is to just run your own private runner.

nathan_naveenon GitHub's Ubuntu Runners Have 1,681 Packages and 9 High Severity Vulns

We are a security startup and we wanted to know what goes into our build server (which happened to be GH runners). We took a deeper look in the Ubuntu-latest runners and went down the rabbit hole.