TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

Gain control of a Linux System via an USB-Device due to strcpy

86 点作者 mrud大约 14 年前

9 条评论

_b8r0大约 14 年前
So this is completely unsurprising and is probably one of the biggest weaknesses in Linux at the moment. The kernel is not being effectively audited, and as a result OSes such as Android end up being shipped with kernel bugs. What this means is that any app you run can bounce out into kernel space through one of these vulnerabilities and back into root userland to take over your phone (incidentally kernel bugs no doubt exist on iOS too, but we're talking about Linux here).<p>In 2009 there were 110 Linux kernel vulns released. Think about it - that's an average of about two a week. This is your phone, your TV, your in-car entertainment system.<p>Finding these bugs isn't hard. Go and download the source tree and search through for strcpy, then trace it back to the function and see where it's used. Then try the same for kfree, kmalloc and vmalloc.<p>You don't even have to download the code for this. Here's an strcpy search on FreeBSD: <a href="http://fxr.watson.org/fxr/search?string=strcpy" rel="nofollow">http://fxr.watson.org/fxr/search?string=strcpy</a><p>Once you have one of these functions you can chart the call path and data structures back to something a user can control. Once you have that, you're in with a good chance of getting a working exploit.<p>For those that are interested in learning how to write exploit code, I'd highly recommend The Shellcoder's Handbook - <a href="http://www.amazon.co.uk/Shellcoders-Handbook-Discovering-Exploiting-Security/dp/0764544683" rel="nofollow">http://www.amazon.co.uk/Shellcoders-Handbook-Discovering-Exp...</a>
trotsky大约 14 年前
While the effects of a bug like this will be mostly short lived on desktop systems where patch management is usually pretty good in linux, the effects on embedded systems can reverberate for years. Look around your house or office and consider how many devices like TVs, dvd players, DVRs, broadband routers, access control devices, industrial control systems and the like run linux and have a usb port. Many of these will have a broad range of usb device drivers built into the kernel (even if they're not used) and often use a network port or wireless chip by design. Very few of these will have reasonable update policies, and even fewer of them will move to a new kernel or backport a vulnerable driver. Many rely on custom drivers that would need to be tested all over again to qualify a new kernel and have busy and relatively inexperienced staff on them.<p>The ability to use these devices as sniffers, network backdoors and MITM attackers is very much there. Most of the time devices like this are more less invisible, very few consumers will be watching their network traffic. Worse, even when an intrusion is detected on a network and all traditional computing devices are wiped or replaced few people will think to replace their blu-ray.<p>Just another brick in the pervasive insecurity wall.
评论 #2302261 未加载
评论 #2302148 未加载
lutorm大约 14 年前
I don't write much C, mostly C++. But one of the things I swear about most when using C is the totally primitive and error-prone string handling. (I realize that C is <i>supposed</i> to be "primitive", but this really is a domain where the pain goes up drastically.)
评论 #2301409 未加载
评论 #2301251 未加载
program大约 14 年前
Quick grep on linux-2.6.37.3:<p>strcpy -&#62; 2864<p>strncpy -&#62; 894
评论 #2300941 未加载
评论 #2302172 未加载
dave1010uk大约 14 年前
To get Administrator access on Windows (theoretically) you could plug in a USB hub with a virtual keyboard, USB mass storage and a random unknown device. The USB mass storage would have the payload you wanted to run in the form of a driver for the unknown device and the virtual keyboard would replay the keys needed to accept the warning messages about installing unsigned drivers.
评论 #2300827 未加载
评论 #2300962 未加载
评论 #2301220 未加载
joelhaasnoot大约 14 年前
Isn't this the same exploit (or very close to atleast) as was used to hack the PS3 initially? A buffer overrun during device initialization.
评论 #2301474 未加载
joshbaptiste大约 14 年前
meh... If someone has physical access to a GNU/Linux machine you'll most likely get pwned regardless.
评论 #2301207 未加载
评论 #2303417 未加载
评论 #2301256 未加载
jazzyb大约 14 年前
The only thing more dangerous than strcpy is strlcpy or strncpy. I can't tell you how many times I've seen:<p>strncpy(dst, src, sizeof(src));<p>And the developer thinks that the code is safer because he's using the "safer" function.
评论 #2300899 未加载
评论 #2302614 未加载
sagarun大约 14 年前
I am sure SELINUX will block these kind of buffer overruns. Unfortunately most people are disabling SELINUX in their machines.
评论 #2301176 未加载
评论 #2301126 未加载
评论 #2301510 未加载