|
Social Engineering Your Way Into The Kernel |
|
|
|
Tuesday, 11 November 2003 |
This clever attempt to add a privelage escalation bug into the linux kernel illustrates a very sophistocated and forward thinking form of an attack. A good discussion can be found here.
It also lends some fuel to both sides of the "is open source more or less seucre?" question. Yes, anyone can contribute code (including malicious coders like this one), but all contributions are visible and subject to inspection. Thankfully, this attack was caught right away.
This also illustrates the subtle ways that programming language design decisions can have far reaching and unexpected results. Anyone who's written more that 10 lines of C is familiar with the bug the attacker tried to exploit. "=" means assignment, and "==" tests equality. It's a very easy bug to create that even seasoned C programmers often miss.
Powered by AkoComment 2.0! and SecurityImage 3.0.4 |
