Top all-time · #11091
Guillaume Quéré
Personal blog · errno.frsecurityhardware
Guillaume Quéré's personal blog at errno.fr covers security and hardware. Since 2023, 7 different Hacker News readers have linked it 10 times, most often “The oldest privesc: injecting careless administrators’ terminals using TTY push”. No feed was found, so read it on the site itself.
Too few sampled comments (2) to say how often HN recommends it.?
Why HN links it
HN readers link this blog for its posts on Unix privilege dropping and terminal security. Comments discuss su misuse and the TIOCSTI TTY pushback risk, and dispute one of the posts' claims.
Summarised by Claude from a sample of 2 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Most-linked posts?
- The oldest privesc: injecting careless administrators’ terminals using TTY push4 people · 4 mentions · first linked 2023-03-11
What Hacker News says?
> This exit back to root is not a security hole Wait... Doing just "su bob" is vulnerable to a known decades old exploit. You should do either "exec su bob" or "su -P bob" or you just gave bob root rights on every Linux kernel older than 6.2 (and I think on 6.2 and more recent the default is still insecure?). It's explained here with a simple PoC exploit (I tried the exploit and it works/worked) and it's been frontp…
Comment linking /TTYPushback.html
on “Don't abuse su for dropping user privileges (2015)”Submitted Bypassing Bitlocker using a cheap logic analyzer on a Lenovo laptop as a story · 16 points
HN discussion> Interesting that the post's linked article does not even mention real, effective, and saved user/groupIDs. Even worse, the article doesn't even mention TIOCSTI, which is another big reason, you should not use `su` this way (see e.g. https://www.errno.fr/TTYPushback.html ). The program run under su keeps the same TTY and can use the TIOCSTI ioctl to push data back into the TTY input buffer. When the program exits a…
Comment linking /TTYPushback.html
on “Don't abuse su for dropping user privileges (2015)”Submitted The cost of a NAND chip off attack is 170.83€ as a story · 4 points
HN discussionSubmitted The oldest privesc: injecting careless administrators’ terminals using TTY push as a story · 4 points
HN discussionSubmitted Getting into EMFI for 30€ thanks to globalization as a story · 3 points
HN discussionSubmitted EMFI adventures part 2: target characterization on STM32H5 as a story · 1 points
HN discussionSubmitted A case of missing bytes: bruteforcing your way through Jenkins' CVE-2024-23897 as a story · 1 points
HN discussionSubmitted Dependency Confusions in Docker as a story · 1 points
HN discussionSubmitted The oldest privesc: injecting careless administrators' using TTY pushback as a story · 1 points
HN discussion
