sudo without password

[Alan McKinnon]

On Monday 12 June 2006 16:52, ubuntu at rio.vg wrote:


> Not only that, but I'm not sure there's a method for iptables to
> hold the connection while it asks another program if it's alright
> to allow. And, of course, it'd never work for servers... but
> hopefully the server is being run by someone who knows what they
> are doing...

-j QUEUE ??

> (Something just occurred to me, perhaps someone could put my mind
> to rest: Sudo only asks for a password once every x number of
> minutes. Could someone write a trojan that sits there waiting for
> the user to run sudo, then runs it itself right afterward,
> bypassing the password prompt?)


Hmmmm, I think that is very possible:

1. user runs a trojan.
2. trojan appends itself to .bashrc as a nohup
3. trojan waits for sudo. 'ps ax | grep sudo" will do as a first and 
very crude cut
4. ???
5. profit!!!

weak points: the trojan has to run as the user, hence using .bashrc.
The .bashrc entry is right there in full view

-- 
If only me, you and dead people understand hex, 
how many people understand hex?

Alan McKinnon
alan at linuxholdings dot co dot za
+27 82, double three seven, one nine three five