cross-platform virus

[Florian Diesch]

Peter Garrett <peter.garrett at optusnet.com.au> wrote:

> On Sat, 8 Apr 2006 17:29:54 -0700
> "Brian Burger" <blurdesign at gmail.com> wrote:
>
>> > Is that really a possibility?
>> 
>> 
>> AFAIK, yes.
>> 
>> Try this: run 'sudo synaptic' as before, enter pw, then close Synaptic right
>> away
>> and try another sudo command from the same terminal you just used for Synaptic.
>> 
>> You shouldn't be asked for a password for the 2nd sudo.
>
> The balance of probabilities is still heavily stacked against the attacker
> - the time-out applies only to the shell from which the sudo command is
> run.

Not the shell but the virtual tty. He has just to start something like

  #!/bin/sh
  while ! echo|sudo -S /bin/true; do :
  done
  sudo do_something_evil

as a background process at session start to do something evil after the
user launched gksudo from the menu.


   Florian
-- 
Gib einem Hungrigen einen Fisch, und er ist für einen Tag satt. Zeig ihm, wie
man angelt, und er pöbelt Dich an, daß er besseres zu tun hätte, als Schnüre
ins Wasser hängen zu lassen. [David Kastrup in <x566arnpqc.fsf at tupik.goethe.zz>]