Discussion
RE: https://infosec.exchange/@ryanc/117184229708073331
Oh look, neat new supply chain attack vector just dropped, potentially targeting every shell script ever! (Good intentions, but it's one github update away from letting attackers intercept and munge any set of arguments passed to a shell script anywhere. Neat proof of concept, now needs armouring against malicious modification.)
@cstross
Eh, LD_PRELOAD shenanigans are an old hat. But one of the reasons why every successful supply chain attack on system packages is considered a system compromise.
@cstross Methinks Ryan is having a laugh... the FAFOPL license is telling, eg:
"The sole accepted venue for dispute resolution shall be a trial by combat at the South Pole."
@cstross @quixoticgeek It’s an LD_PRELOAD rootkit deployed with good intentions. But plenty of evil examples already exist.
@hal_pomeranz @cstross @quixoticgeek used to use LD_PRELOAD to override the read/write functions of closed source binaries to force them to write zipped or encrypted files to disk
Install bonfire.cafe
Get the full app experience
