Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > alt.comp.freeware > #250678 > unrolled thread

Exploit Logs You Into Linux Systems After Hitting Backspace 28 Times

Back to article view | Back to alt.comp.freeware

Contents

  Exploit Logs You Into Linux Systems After Hitting Backspace 28 Times Anonymous <anonymous@hoi-polloi.org> - 2015-12-20 21:28 +0100
    Re: Exploit Logs You Into Linux Systems After Hitting Backspace 28 Times Shadow <Sh@dow.br> - 2015-12-20 18:58 -0200
      Re: Exploit Logs You Into Linux Systems After Hitting Backspace 28 Times Mark Warner <mhwarner.inhibitions@gmail.com> - 2015-12-20 16:48 -0500
      Re: Exploit Logs You Into Linux Systems After Hitting Backspace 28 Times gheston@hiwaay.net (Gary Heston) - 2015-12-21 19:03 -0600
        Re: Exploit Logs You Into Linux Systems After Hitting Backspace 28 Times Big Bad Bob <BigBadBob-at-mrp3-dot-com@testing.local> - 2015-12-22 12:27 -0800
          Re: Exploit Logs You Into Linux Systems After Hitting Backspace 28 Times "Anonymous Remailer (austria)" <mixmaster@remailer.privacy.at> - 2015-12-23 05:53 +0100
    Re: Exploit Logs You Into Linux Systems After Hitting Backspace 28 Times Chris Ahlstrom <OFeem1987@teleworm.us> - 2015-12-20 19:38 -0500
      Re: Exploit Logs You Into Linux Systems After Hitting Backspace 28 Times Big Bad Bob <BigBadBob-at-mrp3-dot-com@testing.local> - 2015-12-21 09:06 -0800
        Re: Exploit Logs You Into Linux Systems After Hitting Backspace 28 Times edevils <use_replyto_address@devils.com> - 2015-12-21 18:32 +0100
          Re: Exploit Logs You Into Linux Systems After Hitting Backspace 28 Times Peter Köhlmann <peter-koehlmann@t-online.de> - 2015-12-21 19:01 +0100
            Re: Exploit Logs You Into Linux Systems After Hitting Backspace 28 Times edevils <use_replyto_address@devils.com> - 2015-12-21 19:21 +0100
              Re: Exploit Logs You Into Linux Systems After Hitting Backspace 28 Times ray carter <ray@zianet.com> - 2015-12-21 21:28 +0000
                Re: Exploit Logs You Into Linux Systems After Hitting Backspace 28 Times edevils <use_replyto_address@devils.com> - 2015-12-22 11:55 +0100
                  Re: Exploit Logs You Into Linux Systems After Hitting Backspace 28 Times Anonymous <nobody@remailer.paranoici.org> - 2015-12-23 04:22 +0000
              Re: Exploit Logs You Into Linux Systems After Hitting Backspace 28 Times Peter Köhlmann <peter-koehlmann@t-online.de> - 2015-12-22 01:18 +0100
                Re: Exploit Logs You Into Linux Systems After Hitting Backspace 28 Times edevils <use_replyto_address@devils.com> - 2015-12-22 11:49 +0100
              Re: Exploit Logs You Into Linux Systems After Hitting Backspace 28 Times Big Bad Bob <BigBadBob-at-mrp3-dot-com@testing.local> - 2015-12-22 13:01 -0800
                Re: Exploit Logs You Into Linux Systems After Hitting Backspace 28 Times edevils <use_replyto_address@devils.com> - 2015-12-25 14:34 +0100
                  Re: Exploit Logs You Into Linux Systems After Hitting Backspace 28 Times Jack Ryan <noreply@remailer.cpunk.us> - 2015-12-25 19:13 -0500
            Re: Exploit Logs You Into Linux Systems After Hitting Backspace 28 Times "Anonymous Remailer (austria)" <mixmaster@remailer.privacy.at> - 2015-12-22 08:17 +0100
            Re: Exploit Logs You Into Linux Systems After Hitting Backspace 28 Times Fritz Wuehler <fritz@spamexpire-201512.rodent.frell.theremailer.net> - 2015-12-22 12:07 +0100
            Re: Exploit Logs You Into Linux Systems After Hitting Backspace 28 Times Big Bad Bob <BigBadBob-at-mrp3-dot-com@testing.local> - 2015-12-22 12:29 -0800
              Re: Exploit Logs You Into Linux Systems After Hitting Backspace 28 Times edevils <use_replyto_address@devils.com> - 2015-12-25 14:35 +0100
        Re: Exploit Logs You Into Linux Systems After Hitting Backspace 28 Times "Anonymous Remailer (austria)" <mixmaster@remailer.privacy.at> - 2015-12-23 04:03 +0100
          Re: Exploit Logs You Into Linux Systems After Hitting Backspace 28  Times Euclides Zoto <euclides_zoto@optimum.net> - 2015-12-28 20:48 -0800
      Re: Exploit Logs You Into Linux Systems After Hitting Backspace 28 Times Yrrah <Yrrah-acf@acf.invalid> - 2015-12-21 19:32 +0100
      Re: Exploit Logs You Into Linux Systems After Hitting Backspace 28 Times Yrrah <Yrrah-acf@acf.invalid> - 2015-12-21 19:33 +0100

Page 1 of 2  [1] 2  Next page →

#250678 — Exploit Logs You Into Linux Systems After Hitting Backspace 28 Times

Though most of you likely don't run Linux—specifically, one 
using the Grub2 bootloader—you'll surely appreciate the 
unintended humor of a brand-new exploit that was recently found 
for said bootloader. The exploit is being quickly patched by 
various major Linux distros, including Ubuntu, Red Hat, and 
Debian, and it also requires physical access to an unpatched 
machine to work, so it's not the worst potential vulnerability, 
just one of the sillier ones.

As Hector Marco and Ismael Ripoll explained in a Dec. 14 
security report, "To quickly check if your system is vulnerable, 
when the Grub ask[s] you the username, press the Backspace 28 
times. If your machine reboots or you get a rescue shell then 
your Grub is affected."

Yes, it's that easy. After you've tapped backspace for the 28th 
time (on an affected system), you'll gain access to the rescue 
shell—giving you a lot more power over the system than you 
previously had. An attacker would be able to have full access to 
the console without needing to enter any user name or password 
whatsoever. Said person could then load a customized kernel and 
do all sorts of things to the host computer—including copying 
the contents of its hard drive or installing some other, harder-
to-find exploit (like a rootkit) that could cause all sorts of 
issues for a compromised system (or, worse, other networked 
systems).

"The attacker is able to destroy any data including the grub 
itself. Even in the case that the disk is ciphered the attacker 
can overwrite it, causing a [denial of service]," the report 
reads.

If your Linux distro of choice doesn't happen to have a patch 
ready just yet, you can grab the emergency patch that Marco and 
Ripoll have created to fix the isssue—all stemming from a simple 
integer underflow fault that was introduced to Grub2 in December 
2009.

"It is irresponsible for grub to lack decades-old exploit 
mitigations like stack cookies that could have addressed this 
issue," said Dan Guido, Trail of Bits founder, in an interview 
with Motherboard.

http://www.pcmag.com/article2/0,2817,2496870,00.asp

[toc] | [next] | [standalone]

#250679

On Sun, 20 Dec 2015 21:28:59 +0100, Anonymous
<anonymous@hoi-polloi.org> wrote:

>Though most of you likely don't run Linux—specifically, one 
>using the Grub2 bootloader—you'll surely appreciate the 
>unintended humor of a brand-new exploit that was recently found 
>for said bootloader. The exploit is being quickly patched by 
>various major Linux distros, including Ubuntu, Red Hat, and 
>Debian, and it also requires physical access to an unpatched 
>machine to work, so it's not the worst potential vulnerability, 
>just one of the sillier ones.
>
>As Hector Marco and Ismael Ripoll explained in a Dec. 14 
>security report, "To quickly check if your system is vulnerable, 
>when the Grub ask[s] you the username, press the Backspace 28 
>times. If your machine reboots or you get a rescue shell then 
>your Grub is affected."
>
>Yes, it's that easy. After you've tapped backspace for the 28th 
>time (on an affected system), you'll gain access to the rescue 
>shell—giving you a lot more power over the system than you 
>previously had. An attacker would be able to have full access to 
>the console without needing to enter any user name or password 
>whatsoever. Said person could then load a customized kernel and 
>do all sorts of things to the host computer—including copying 
>the contents of its hard drive or installing some other, harder-
>to-find exploit (like a rootkit) that could cause all sorts of 
>issues for a compromised system (or, worse, other networked 
>systems).
>
>"The attacker is able to destroy any data including the grub 
>itself. Even in the case that the disk is ciphered the attacker 
>can overwrite it, causing a [denial of service]," the report 
>reads.

	I could do all that by booting from a Linux live CD. If you
have physical access to the machine (Linux or any other OS, assuming
it's not "Truly enCrypted") you have root, or admin, or whatever your
OS calls it.
	[]'s
>
>If your Linux distro of choice doesn't happen to have a patch 
>ready just yet, you can grab the emergency patch that Marco and 
>Ripoll have created to fix the isssue—all stemming from a simple 
>integer underflow fault that was introduced to Grub2 in December 
>2009.
>
>"It is irresponsible for grub to lack decades-old exploit 
>mitigations like stack cookies that could have addressed this 
>issue," said Dan Guido, Trail of Bits founder, in an interview 
>with Motherboard.
>
>http://www.pcmag.com/article2/0,2817,2496870,00.asp
-- 
Don't be evil - Google 2004
We have a new policy  - Google 2012

[toc] | [prev] | [next] | [standalone]

#250681

On 12/20/2015 03:58 PM, Shadow wrote:
> On Sun, 20 Dec 2015 21:28:59 +0100, Anonymous wrote:
>>
>> "The attacker is able to destroy any data including the grub
>> itself. Even in the case that the disk is ciphered the attacker
>> can overwrite it, causing a [denial of service]," the report
>> reads.
>
> 	I could do all that by booting from a Linux live CD. If you
> have physical access to the machine (Linux or any other OS, assuming
> it's not "Truly enCrypted") you have root, or admin, or whatever your
> OS calls it.
> 	[]'s

Yeah, the shills are making sure this gets lots of play.

It's like saying "If I own your computer I p0wn it."

-- 
Mark Warner
MEPIS Linux
Registered Linux User #415318
...lose .inhibitions when replying

[toc] | [prev] | [next] | [standalone]

#250761

In article <3b5e7bte4rb2a9fda2l5rku6qbkv5umdub@4ax.com>,
Shadow  <Sh@dow.br> wrote:
>On Sun, 20 Dec 2015 21:28:59 +0100, Anonymous
><anonymous@hoi-polloi.org> wrote:
>
>>Though most of you likely don't run Linux—specifically, one 
>>using the Grub2 bootloader—you'll surely appreciate the 
>>unintended humor of a brand-new exploit that was recently found 
>>for said bootloader. The exploit is being quickly patched by 
>>various major Linux distros, including Ubuntu, Red Hat, and 
>>Debian, and it also requires physical access to an unpatched 
>>machine to work, so it's not the worst potential vulnerability, 
>>just one of the sillier ones.
>OS calls it.

  [ ... ]

Given physical access to a system, an attacker of even modest skills can
get any and everything off a system. If the sole objective is denial of
service, I don't know of any hard drve that can survive a hammer or
drill (particularly both) attack.

  Without physical security, nothing else matters.


  Gary

[toc] | [prev] | [next] | [standalone]

#250801

On 12/21/15 17:03, Gary Heston so wittily quipped:
> Given physical access to a system, an attacker of even modest skills can
> get any and everything off a system. If the sole objective is denial of
> service, I don't know of any hard drve that can survive a hammer or
> drill (particularly both) attack.

or thermite

[toc] | [prev] | [next] | [standalone]

#250824

In article <BrCdnVFaBsGAL-TLnZ2dnUU7-LudnZ2d@earthlink.com>
Big Bad Bob <BigBadBob-at-mrp3-dot-com@testing.local> wrote:
>
> On 12/21/15 17:03, Gary Heston so wittily quipped:
> > Given physical access to a system, an attacker of even modest skills can
> > get any and everything off a system. If the sole objective is denial of
> > service, I don't know of any hard drve that can survive a hammer or
> > drill (particularly both) attack.
>
> or thermite

Why must one poor little hard drive be the single point of 
failure?

[toc] | [prev] | [next] | [standalone]

#250688

Anonymous wrote this copyrighted missive and expects royalties:

> Though most of you likely don't run Linux—specifically, one 
> using the Grub2 bootloader—you'll surely appreciate the 
> unintended humor of a brand-new exploit that was recently found 
> for said bootloader.
>
> http://www.pcmag.com/article2/0,2817,2496870,00.asp

What took you so long to post this?  It's been bandied about
for many days now.

Already fixed, by the way.

Pretty stupid bug, though.  Should never have happened.

-- 
You will win success in whatever calling you adopt.

[toc] | [prev] | [next] | [standalone]

#250737

On 12/20/15 16:38, Chris Ahlstrom so wittily quipped:
> Anonymous wrote this copyrighted missive and expects royalties:
> 
>> Though most of you likely don't run Linux—specifically, one 
>> using the Grub2 bootloader—you'll surely appreciate the 
>> unintended humor of a brand-new exploit that was recently found 
>> for said bootloader.
>>
>> http://www.pcmag.com/article2/0,2817,2496870,00.asp
> 
> What took you so long to post this?  It's been bandied about
> for many days now.
> 
> Already fixed, by the way.
> 
> Pretty stupid bug, though.  Should never have happened.
> 

with physical access to the machine, there's nothing stopping anyone
from removing the hard drive, plugging in a USB hard drive adaptor
thingy, and then reading it directly with another computer.

so the bug is funnier than it is dangerous.

[toc] | [prev] | [next] | [standalone]

#250739

On 21/12/2015 18:06, Big Bad Bob wrote:
> On 12/20/15 16:38, Chris Ahlstrom so wittily quipped:
>> Anonymous wrote this copyrighted missive and expects royalties:
>>
>>> Though most of you likely don't run Linux—specifically, one
>>> using the Grub2 bootloader—you'll surely appreciate the
>>> unintended humor of a brand-new exploit that was recently found
>>> for said bootloader.
>>>
>>> http://www.pcmag.com/article2/0,2817,2496870,00.asp
>>
>> What took you so long to post this?  It's been bandied about
>> for many days now.
>>
>> Already fixed, by the way.
>>
>> Pretty stupid bug, though.  Should never have happened.
>>
>
> with physical access to the machine, there's nothing stopping anyone
> from removing the hard drive, plugging in a USB hard drive adaptor
> thingy, and then reading it directly with another computer.
>
> so the bug is funnier than it is dangerous.

Unless data is encrypted. If you remove the hard drive and plug it 
somewhere, you are still left with ciphered data.

On the contrary, if you read Hector Marco and Ismael Ripoll's original 
article, you'll find out how they used the GRUB2 vulnerability to access 
the GRUB rescue shell and deploy a malware from there.

"Since the data is ciphered, the strategy we will use is to infect the 
system and wait until the user decrypts the data (by login into the 
system) and then access to the information in plain."

http://hmarco.org/bugs/CVE-2015-8370-Grub2-authentication-bypass.html

[toc] | [prev] | [next] | [standalone]

#250740

edevils wrote:

> On 21/12/2015 18:06, Big Bad Bob wrote:
>> On 12/20/15 16:38, Chris Ahlstrom so wittily quipped:
>>> Anonymous wrote this copyrighted missive and expects royalties:
>>>
>>>> Though most of you likely don't run Linux—specifically, one
>>>> using the Grub2 bootloader—you'll surely appreciate the
>>>> unintended humor of a brand-new exploit that was recently found
>>>> for said bootloader.
>>>>
>>>> http://www.pcmag.com/article2/0,2817,2496870,00.asp
>>>
>>> What took you so long to post this?  It's been bandied about
>>> for many days now.
>>>
>>> Already fixed, by the way.
>>>
>>> Pretty stupid bug, though.  Should never have happened.
>>>
>>
>> with physical access to the machine, there's nothing stopping anyone
>> from removing the hard drive, plugging in a USB hard drive adaptor
>> thingy, and then reading it directly with another computer.
>>
>> so the bug is funnier than it is dangerous.
> 
> Unless data is encrypted. If you remove the hard drive and plug it
> somewhere, you are still left with ciphered data.
> 
> On the contrary, if you read Hector Marco and Ismael Ripoll's original
> article, you'll find out how they used the GRUB2 vulnerability to access
> the GRUB rescue shell and deploy a malware from there.
> 
> "Since the data is ciphered, the strategy we will use is to infect the
> system and wait until the user decrypts the data (by login into the
> system) and then access to the information in plain."
> 
> http://hmarco.org/bugs/CVE-2015-8370-Grub2-authentication-bypass.html

With physical access to the machine they could just as well install the 
logging software the standard way. No need for a Grub exploit
 
Physical access means all bounds are off. You can not secure such a system 
in any meaningful way, encrypted or not

[toc] | [prev] | [next] | [standalone]

#250745

On 21/12/2015 19:01, Peter Köhlmann wrote:
> edevils wrote:
>
>> On 21/12/2015 18:06, Big Bad Bob wrote:
>>> On 12/20/15 16:38, Chris Ahlstrom so wittily quipped:
>>>> Anonymous wrote this copyrighted missive and expects royalties:
>>>>
>>>>> Though most of you likely don't run Linux—specifically, one
>>>>> using the Grub2 bootloader—you'll surely appreciate the
>>>>> unintended humor of a brand-new exploit that was recently found
>>>>> for said bootloader.
>>>>>
>>>>> http://www.pcmag.com/article2/0,2817,2496870,00.asp
>>>>
>>>> What took you so long to post this?  It's been bandied about
>>>> for many days now.
>>>>
>>>> Already fixed, by the way.
>>>>
>>>> Pretty stupid bug, though.  Should never have happened.
>>>>
>>>
>>> with physical access to the machine, there's nothing stopping anyone
>>> from removing the hard drive, plugging in a USB hard drive adaptor
>>> thingy, and then reading it directly with another computer.
>>>
>>> so the bug is funnier than it is dangerous.
>>
>> Unless data is encrypted. If you remove the hard drive and plug it
>> somewhere, you are still left with ciphered data.
>>
>> On the contrary, if you read Hector Marco and Ismael Ripoll's original
>> article, you'll find out how they used the GRUB2 vulnerability to access
>> the GRUB rescue shell and deploy a malware from there.
>>
>> "Since the data is ciphered, the strategy we will use is to infect the
>> system and wait until the user decrypts the data (by login into the
>> system) and then access to the information in plain."
>>
>> http://hmarco.org/bugs/CVE-2015-8370-Grub2-authentication-bypass.html
>
> With physical access to the machine they could just as well install the
> logging software the standard way.

Could they, if GRUB is password protected?


> No need for a Grub exploit
>
> Physical access means all bounds are off. You can not secure such a system
> in any meaningful way, encrypted or not

However, removing a hard drive is not as easy as using a keyboard. If 
you remove a hard drive in an office, you might be be noticed.
Some hard drives are even stored in a secure vault, while you can still 
access the keyboard.

[toc] | [prev] | [next] | [standalone]

#250752

>> With physical access to the machine they could just as well install the
>> logging software the standard way.
> 
> Could they, if GRUB is password protected?
> 
> 
>> No need for a Grub exploit
>>
>> Physical access means all bounds are off. You can not secure such a
>> system in any meaningful way, encrypted or not
> 
> However, removing a hard drive is not as easy as using a keyboard. If
> you remove a hard drive in an office, you might be be noticed.
> Some hard drives are even stored in a secure vault, while you can still
> access the keyboard.

physical access == total access

[toc] | [prev] | [next] | [standalone]

#250769

On 12/21/2015 10:28 PM, ray carter wrote:
>
>>> With physical access to the machine they could just as well install the
>>> logging software the standard way.
>>
>> Could they, if GRUB is password protected?
>>
>>
>>> No need for a Grub exploit
>>>
>>> Physical access means all bounds are off. You can not secure such a
>>> system in any meaningful way, encrypted or not
>>
>> However, removing a hard drive is not as easy as using a keyboard. If
>> you remove a hard drive in an office, you might be be noticed.
>> Some hard drives are even stored in a secure vault, while you can still
>> access the keyboard.
>
> physical access == total access

If  a bad guy has UNRESTRICTED physical access, then he will be able to 
do anything.
But another scenario is "restricted" physical access, meaning: KEYBOARD 
access only!

[toc] | [prev] | [next] | [standalone]

#250823

In article <n5ba25$nfk$1@dont-email.me>
edevils <use_replyto_address@devils.com> wrote:
>
> On 12/21/2015 10:28 PM, ray carter wrote:
> >
> >>> With physical access to the machine they could just as well install the
> >>> logging software the standard way.
> >>
> >> Could they, if GRUB is password protected?
> >>
> >>
> >>> No need for a Grub exploit
> >>>
> >>> Physical access means all bounds are off. You can not secure such a
> >>> system in any meaningful way, encrypted or not
> >>
> >> However, removing a hard drive is not as easy as using a keyboard. If
> >> you remove a hard drive in an office, you might be be noticed.
> >> Some hard drives are even stored in a secure vault, while you can still
> >> access the keyboard.
> >
> > physical access == total access
>
> If  a bad guy has UNRESTRICTED physical access, then he will be able to
> do anything.
> But another scenario is "restricted" physical access, meaning: KEYBOARD
> access only!

Lmao.  Like to see you stop me from doing anything if I have 
"KEYBOARD" access.

[toc] | [prev] | [next] | [standalone]

#250760

edevils wrote:

> On 21/12/2015 19:01, Peter Köhlmann wrote:
>> edevils wrote:
>>
>>> On 21/12/2015 18:06, Big Bad Bob wrote:
>>>> On 12/20/15 16:38, Chris Ahlstrom so wittily quipped:
>>>>> Anonymous wrote this copyrighted missive and expects royalties:
>>>>>
>>>>>> Though most of you likely don't run Linux—specifically, one
>>>>>> using the Grub2 bootloader—you'll surely appreciate the
>>>>>> unintended humor of a brand-new exploit that was recently found
>>>>>> for said bootloader.
>>>>>>
>>>>>> http://www.pcmag.com/article2/0,2817,2496870,00.asp
>>>>>
>>>>> What took you so long to post this?  It's been bandied about
>>>>> for many days now.
>>>>>
>>>>> Already fixed, by the way.
>>>>>
>>>>> Pretty stupid bug, though.  Should never have happened.
>>>>>
>>>>
>>>> with physical access to the machine, there's nothing stopping anyone
>>>> from removing the hard drive, plugging in a USB hard drive adaptor
>>>> thingy, and then reading it directly with another computer.
>>>>
>>>> so the bug is funnier than it is dangerous.
>>>
>>> Unless data is encrypted. If you remove the hard drive and plug it
>>> somewhere, you are still left with ciphered data.
>>>
>>> On the contrary, if you read Hector Marco and Ismael Ripoll's original
>>> article, you'll find out how they used the GRUB2 vulnerability to access
>>> the GRUB rescue shell and deploy a malware from there.
>>>
>>> "Since the data is ciphered, the strategy we will use is to infect the
>>> system and wait until the user decrypts the data (by login into the
>>> system) and then access to the information in plain."
>>>
>>> http://hmarco.org/bugs/CVE-2015-8370-Grub2-authentication-bypass.html
>>
>> With physical access to the machine they could just as well install the
>> logging software the standard way.
> 
> Could they, if GRUB is password protected?
> 

Yes

[toc] | [prev] | [next] | [standalone]

#250768

On 12/22/2015 1:18 AM, Peter Köhlmann wrote:
> edevils wrote:
>
>> On 21/12/2015 19:01, Peter Köhlmann wrote:
>>> edevils wrote:
>>>
>>>> On 21/12/2015 18:06, Big Bad Bob wrote:
>>>>> On 12/20/15 16:38, Chris Ahlstrom so wittily quipped:
>>>>>> Anonymous wrote this copyrighted missive and expects royalties:
>>>>>>
>>>>>>> Though most of you likely don't run Linux—specifically, one
>>>>>>> using the Grub2 bootloader—you'll surely appreciate the
>>>>>>> unintended humor of a brand-new exploit that was recently found
>>>>>>> for said bootloader.
>>>>>>>
>>>>>>> http://www.pcmag.com/article2/0,2817,2496870,00.asp
>>>>>>
>>>>>> What took you so long to post this?  It's been bandied about
>>>>>> for many days now.
>>>>>>
>>>>>> Already fixed, by the way.
>>>>>>
>>>>>> Pretty stupid bug, though.  Should never have happened.
>>>>>>
>>>>>
>>>>> with physical access to the machine, there's nothing stopping anyone
>>>>> from removing the hard drive, plugging in a USB hard drive adaptor
>>>>> thingy, and then reading it directly with another computer.
>>>>>
>>>>> so the bug is funnier than it is dangerous.
>>>>
>>>> Unless data is encrypted. If you remove the hard drive and plug it
>>>> somewhere, you are still left with ciphered data.
>>>>
>>>> On the contrary, if you read Hector Marco and Ismael Ripoll's original
>>>> article, you'll find out how they used the GRUB2 vulnerability to access
>>>> the GRUB rescue shell and deploy a malware from there.
>>>>
>>>> "Since the data is ciphered, the strategy we will use is to infect the
>>>> system and wait until the user decrypts the data (by login into the
>>>> system) and then access to the information in plain."
>>>>
>>>> http://hmarco.org/bugs/CVE-2015-8370-Grub2-authentication-bypass.html
>>>
>>> With physical access to the machine they could just as well install the
>>> logging software the standard way.
>>
>> Could they, if GRUB is password protected?
>>
>
> Yes


1. USB and DVD etc. access would locked be in BIOS settings, of course.
2. Are you talking of keyboard access, or using hammer and screwdriver? 
That wouldn't go unnoticed.

[toc] | [prev] | [next] | [standalone]

#250806

On 12/21/15 10:21, edevils so wittily quipped:
> On 21/12/2015 19:01, Peter Köhlmann wrote:
>> edevils wrote:
>>
>>> On 21/12/2015 18:06, Big Bad Bob wrote:
>>>> On 12/20/15 16:38, Chris Ahlstrom so wittily quipped:
>>>>> Anonymous wrote this copyrighted missive and expects royalties:
>>>>>
>>>>>> Though most of you likely don't run Linux—specifically, one
>>>>>> using the Grub2 bootloader—you'll surely appreciate the
>>>>>> unintended humor of a brand-new exploit that was recently found
>>>>>> for said bootloader.
>>>>>>
>>>>>> http://www.pcmag.com/article2/0,2817,2496870,00.asp
>>>>>
>>>>> What took you so long to post this?  It's been bandied about
>>>>> for many days now.
>>>>>
>>>>> Already fixed, by the way.
>>>>>
>>>>> Pretty stupid bug, though.  Should never have happened.
>>>>>
>>>>
>>>> with physical access to the machine, there's nothing stopping anyone
>>>> from removing the hard drive, plugging in a USB hard drive adaptor
>>>> thingy, and then reading it directly with another computer.
>>>>
>>>> so the bug is funnier than it is dangerous.
>>>
>>> Unless data is encrypted. If you remove the hard drive and plug it
>>> somewhere, you are still left with ciphered data.
>>>
>>> On the contrary, if you read Hector Marco and Ismael Ripoll's original
>>> article, you'll find out how they used the GRUB2 vulnerability to access
>>> the GRUB rescue shell and deploy a malware from there.
>>>
>>> "Since the data is ciphered, the strategy we will use is to infect the
>>> system and wait until the user decrypts the data (by login into the
>>> system) and then access to the information in plain."
>>>
>>> http://hmarco.org/bugs/CVE-2015-8370-Grub2-authentication-bypass.html
>>
>> With physical access to the machine they could just as well install the
>> logging software the standard way.
> 
> Could they, if GRUB is password protected?

yes.  just install "no password" grub onto a different hard drive, and
set it up (cloned without password) to boot that image from a separate
HD [USB plug in for example], then put the "new" HD into the hard drive
slot, and voila!  boot whatever you want, whenever you want, no password
required.

[toc] | [prev] | [next] | [standalone]

#251051

On 22/12/2015 22:01, Big Bad Bob wrote:
> On 12/21/15 10:21, edevils so wittily quipped:
>> On 21/12/2015 19:01, Peter Köhlmann wrote:
>>> edevils wrote:
>>>
>>>> On 21/12/2015 18:06, Big Bad Bob wrote:
>>>>> On 12/20/15 16:38, Chris Ahlstrom so wittily quipped:
>>>>>> Anonymous wrote this copyrighted missive and expects royalties:
>>>>>>
>>>>>>> Though most of you likely don't run Linux—specifically, one
>>>>>>> using the Grub2 bootloader—you'll surely appreciate the
>>>>>>> unintended humor of a brand-new exploit that was recently found
>>>>>>> for said bootloader.
>>>>>>>
>>>>>>> http://www.pcmag.com/article2/0,2817,2496870,00.asp
>>>>>>
>>>>>> What took you so long to post this?  It's been bandied about
>>>>>> for many days now.
>>>>>>
>>>>>> Already fixed, by the way.
>>>>>>
>>>>>> Pretty stupid bug, though.  Should never have happened.
>>>>>>
>>>>>
>>>>> with physical access to the machine, there's nothing stopping anyone
>>>>> from removing the hard drive, plugging in a USB hard drive adaptor
>>>>> thingy, and then reading it directly with another computer.
>>>>>
>>>>> so the bug is funnier than it is dangerous.
>>>>
>>>> Unless data is encrypted. If you remove the hard drive and plug it
>>>> somewhere, you are still left with ciphered data.
>>>>
>>>> On the contrary, if you read Hector Marco and Ismael Ripoll's original
>>>> article, you'll find out how they used the GRUB2 vulnerability to access
>>>> the GRUB rescue shell and deploy a malware from there.
>>>>
>>>> "Since the data is ciphered, the strategy we will use is to infect the
>>>> system and wait until the user decrypts the data (by login into the
>>>> system) and then access to the information in plain."
>>>>
>>>> http://hmarco.org/bugs/CVE-2015-8370-Grub2-authentication-bypass.html
>>>
>>> With physical access to the machine they could just as well install the
>>> logging software the standard way.
>>
>> Could they, if GRUB is password protected?
>
> yes.  just install "no password" grub onto a different hard drive,


Looks like you have not read previous posts.

Again, I am talking about keyboard access, in a scenario where both GRUB 
and BIOS settings are  password protected. No *unrestricted* physical 
access, no tampering with hardware.

Therefore, no "different hard drive" available, no "boot from CD/USB", 
no easy shortcuts available,


> and
> set it up (cloned without password) to boot that image from a separate
> HD [USB plug in for example], then put the "new" HD into the hard drive
> slot, and voila!  boot whatever you want, whenever you want, no password
> required.

[toc] | [prev] | [next] | [standalone]

#251069

In article <n5jgfh$vg5$1@dont-email.me>
edevils <use_replyto_address@devils.com> wrote:
>
> On 22/12/2015 22:01, Big Bad Bob wrote:
> > On 12/21/15 10:21, edevils so wittily quipped:
> >> On 21/12/2015 19:01, Peter Köhlmann wrote:
> >>> edevils wrote:
> >>>
> >>>> On 21/12/2015 18:06, Big Bad Bob wrote:
> >>>>> On 12/20/15 16:38, Chris Ahlstrom so wittily quipped:
> >>>>>> Anonymous wrote this copyrighted missive and expects royalties:
> >>>>>>
> >>>>>>> Though most of you likely don't run Linux—specifically, one
> >>>>>>> using the Grub2 bootloader—you'll surely appreciate the
> >>>>>>> unintended humor of a brand-new exploit that was recently found
> >>>>>>> for said bootloader.
> >>>>>>>
> >>>>>>> http://www.pcmag.com/article2/0,2817,2496870,00.asp
> >>>>>>
> >>>>>> What took you so long to post this?  It's been bandied about
> >>>>>> for many days now.
> >>>>>>
> >>>>>> Already fixed, by the way.
> >>>>>>
> >>>>>> Pretty stupid bug, though.  Should never have happened.
> >>>>>>
> >>>>>
> >>>>> with physical access to the machine, there's nothing stopping anyone
> >>>>> from removing the hard drive, plugging in a USB hard drive adaptor
> >>>>> thingy, and then reading it directly with another computer.
> >>>>>
> >>>>> so the bug is funnier than it is dangerous.
> >>>>
> >>>> Unless data is encrypted. If you remove the hard drive and plug it
> >>>> somewhere, you are still left with ciphered data.
> >>>>
> >>>> On the contrary, if you read Hector Marco and Ismael Ripoll's original
> >>>> article, you'll find out how they used the GRUB2 vulnerability to access
> >>>> the GRUB rescue shell and deploy a malware from there.
> >>>>
> >>>> "Since the data is ciphered, the strategy we will use is to infect the
> >>>> system and wait until the user decrypts the data (by login into the
> >>>> system) and then access to the information in plain."
> >>>>
> >>>> http://hmarco.org/bugs/CVE-2015-8370-Grub2-authentication-bypass.html
> >>>
> >>> With physical access to the machine they could just as well install the
> >>> logging software the standard way.
> >>
> >> Could they, if GRUB is password protected?
> >
> > yes.  just install "no password" grub onto a different hard drive,
>
>
> Looks like you have not read previous posts.
>
> Again, I am talking about keyboard access, in a scenario where both GRUB
> and BIOS settings are  password protected. No *unrestricted* physical
> access, no tampering with hardware.
>
> Therefore, no "different hard drive" available, no "boot from CD/USB",
> no easy shortcuts available,

Pull the drive and put it in another box.  Now what good are 
your passwords?

> > and
> > set it up (cloned without password) to boot that image from a separate
> > HD [USB plug in for example], then put the "new" HD into the hard drive
> > slot, and voila!  boot whatever you want, whenever you want, no password
> > required.

[toc] | [prev] | [next] | [standalone]

#250763

In article <n59elc$p3l$1@dont-email.me>
Peter =?UTF-8?B?S8O2aGxtYW5u?= <peter-koehlmann@t-online.de> 
wrote:
>
> edevils wrote:
>
> > On 21/12/2015 18:06, Big Bad Bob wrote:
> >> On 12/20/15 16:38, Chris Ahlstrom so wittily quipped:
> >>> Anonymous wrote this copyrighted missive and expects royalties:
> >>>
> >>>> Though most of you likely don't run Linux—specifically, one
> >>>> using the Grub2 bootloader—you'll surely appreciate the
> >>>> unintended humor of a brand-new exploit that was recently found
> >>>> for said bootloader.
> >>>>
> >>>> http://www.pcmag.com/article2/0,2817,2496870,00.asp
> >>>
> >>> What took you so long to post this?  It's been bandied about
> >>> for many days now.
> >>>
> >>> Already fixed, by the way.
> >>>
> >>> Pretty stupid bug, though.  Should never have happened.
> >>>
> >>
> >> with physical access to the machine, there's nothing stopping anyone
> >> from removing the hard drive, plugging in a USB hard drive adaptor
> >> thingy, and then reading it directly with another computer.
> >>
> >> so the bug is funnier than it is dangerous.
> >
> > Unless data is encrypted. If you remove the hard drive and plug it
> > somewhere, you are still left with ciphered data.
> >
> > On the contrary, if you read Hector Marco and Ismael Ripoll's original
> > article, you'll find out how they used the GRUB2 vulnerability to access
> > the GRUB rescue shell and deploy a malware from there.
> >
> > "Since the data is ciphered, the strategy we will use is to infect the
> > system and wait until the user decrypts the data (by login into the
> > system) and then access to the information in plain."
> >
> > http://hmarco.org/bugs/CVE-2015-8370-Grub2-authentication-bypass.html
>
> With physical access to the machine they could just as well install the
> logging software the standard way. No need for a Grub exploit
>
> Physical access means all bounds are off. You can not secure such a system
> in any meaningful way, encrypted or not

Bottom line, someone would have to have be present with access 
to the equipment to accomplish this correct?

That would narrow down the scope of possible suspects 
considerably.

[toc] | [prev] | [next] | [standalone]

Page 1 of 2  [1] 2  Next page →

Back to top | Article view | alt.comp.freeware

csiph-web