Hacker News Reader

Comment by judge2020 | Hacker News Reader

judge2020

Not Apple related, but you could log into any linux box using a specific few versions of grub2 by hitting backspace 28 times: https://motherboard.vice.com/en_us/article/ezpdqz/hack-into-...

View on HN

This bug only applied to grub authentication, which isn't a widely used feature. And you could achieve the same result with boot from disk/USB if that is enabled.

The vuln doesn't give you access to the actual accounts on the computer.

Let's not forget https://www.cvedetails.com/cve/CVE-2013-1050/ and https://www.cvedetails.com/cve/CVE-2015-7496/ and https://www.cvedetails.com/cve/CVE-2017-8900/ (to a lesser extent). Check out https://www.cvedetails.com/vulnerability-list.php?vendor_id=... for more fun.

http://i.imgur.com/rG0p0b2.gif

But the Windows 95 login was just for logging into the network, not the computer

I think that if you hit Cancel there it would work just as well. You wouldn't get it logged into the domain though

Yes - from what I recall there was not even a pretense of security. Everything was just unencrypted FAT (VFAT rather than FAT32) and if you logged in as one user all other user's data was clearly visible - it was just a means to have your own user workspace and customisations applied. Windows 95 and everything up to (not including) XP was a toy OS for home users ... If you wanted "grown up" features you had to go for NT.

Oh dear, I remember something similar was possible on iOS lockscreen multiple times. What version of Windows was that?

95. 98 had an even better one... just hitting cancel on some login boxes would let you in.

I believe that was by design: the dialog was an opportunity to authenticate with the domain. If you just wanted local access you could hit cancel. Remember Win9x was not a secure OS itself.

Pretty sure I've seen a similar trick on XP or later as well. (I learned it from someone I didn't meet until long after I last saw a 95/98/2000 machine.)

not forgetting https://www.jwz.org/blog/2015/04/i-told-you-so-again/

!WARNING! - This now redirects to an image of a hairy testicle. I think the site owner noticed the traffic and put in a redirect.

It's been that way for years (i.e. visitors from HN get redirected).

Ah you are right, should have experimented with that.

Heh just saw/posted the same. I think you’re right - jwz being a little trolly.

wtf. Clicking your link brought me to http://i.imgur.com/rG0p0b2.gif somehow. jwz doing a referrer troll?? Anyone else see this?

Probably Referer check, copy-pasting the URL works.

This was the worst one for me:

https://www.cvedetails.com/cve/CVE-2017-12712/

I remember an article somewhere about these kinds of bugs. A lot of medical hardware/software combos are/can be compromised. And here comes the problem: do you disclose the vulnerabilities since it means potentially killing people? How long do you wait before manufacturers acknowledge and fix the problem (and they often don't)?

So yeah, these types of vulnerabilities are very very scary.

Also, you can bypass screen lock in Ubuntu by removing the HDD [1]. The bug still is not fixed.

[1] https://bugs.launchpad.net/ubuntu/+source/unity/+bug/1777415

That's a bug in Unity. They dropped their own desktop environment in 18.04 for GNOME.

So it's likely it won't ever be fixed.

Honestly, I wouldn’t but that in the same class if bugs as those that preceded it because if the attacker he removed the HDD he will have access to your contents anyway (unless the HDD is encrypted) and it’s not a quick and convenient process either (unlike tapping backspace multiple times).

That said, I also don’t agree that this bug should never get fixed either.

This is a very naive estimation of what might happen when someone has access to all your running software. Since it is linux, it loads executables into memory and is able to run them even when they are deleted along with runtime dependencies.

Anything that caches anything to anywhere other than disk will be accessible. Your memcache, your redis, some databases, keychains, your non-userdata browser sessions.

I'm aware of that but it's a moot point because you'd be popping the storage device back in anyway. Which is why I didn't address that in my previous comment.

In any case, half the examples you've provided there are server specific and you really shouldn't be allowing untrusted physical access to your servers (nor running Xorg to be honest).

While I do agree, a lot of ideas here are still laden with hindsight.

Sometimes I feel like a relic using Slackware with lilo and SysV init, then I read about exploits like that and I smile.

I am afraid your system is _probably_ just bug ridden as any other, it is simply not popular enough to for people to find bugs.

It's actually the opposite situation. Slackware's policy is to stick to the original software as distributed by the author with only minimal patching where necessary, so if a particular program (say, KDE) has a big support community, Slackware benefits from all those eyes on the code. This leads to a very mature and stable system at the expense of running older versions of software (though there's always the -current branch for those wishing to live on the edge).

Beyond this, the small but dedicated Slackware team is working daily to find and patch bugs when they do appear. You can look at the changelogs for examples of that workflow[1].

There's no such thing as a software project without bugs, but Slackware is consistently one of the most stable and robust OSes out there.

[1] http://www.slackware.com/changelog/

Reply on news.ycombinator.com