Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Let me describe a hypothetical attack.

E knows of some critical security update that needs to be installed in sensitive locations.

E also knows of some attack on the hashing algorithm that is in use by the filesystem to craft a small block containing mostly garbage but some key bits that they would like to control. (Yes this is the hypothetical, but prior algorithms /have/ fallen).

E thus arranges to have this 'duplicate' block stored before routine and predictable maintenance patterns.

A installs the updates and the 'duplicate' file is now E's datastream, but A's intended credentials.

E has caused system corruption, and potentially privilege escalation.



Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: