I*******g
发帖数: 7600 | 1 【 以下文字转载自 Military 讨论区 】
发信人: mitbbs2715 (好吃不懒做), 信区: Military
标 题: 说linux安全就是个大笑话
发信站: BBS 未名空间站 (Thu Dec 17 22:30:48 2015, 美东)
You Can Break Into a Linux System by Pressing Backspace 28
http://lifehacker.com/you-can-break-into-a-linux-system-by-pres
Patrick Allan
Yesterday 1:30pmFiled to: SECURITY
Hitting a key over and over again actually works for once. Two security
researchers in Spain recently uncovered a strange bug that will let you into
most Linux machines just by hitting the backspace key 28 times. Here’s how
to fix it and keep your data protected.
The researchers, Hector Marco and Ismael Ripoll from the Cybersecurity Group
at Polytechnic University of Valencia, found that it’s possible to bypass
all security of a locked-down Linux machine by exploiting a bug in the Grub2
bootloader. Essentially, hitting backspace 28 times when the machine asks
for your username accesses the “Grub rescue shell,” and once there, you
can access the computer’s data or install malware. Fortunately, Marco and
Ripoll have made an emergency patch to fix the Grub2 vulnerability. Ubuntu,
Red Hat, and Debian have all issued patches to fix it as well.
Linux is often thought of as a super secure operating system, but this is a
good reminder to take physical security just as seriously as network
security (if not more). Take extra care when your machine is around people
you don’t know, especially if your system has sensitive data on it. | r**********g
发帖数: 22734 | 2 都可以看到grub，而且磁盘还没加密，那还不如直接把硬盘拔下来好了 | f*******t
发帖数: 7549 | 3 首先要物理接触到机器，这个bug有点蛋疼但至少没那么可怕 | m*f
发帖数: 3078 | 4 可以物理接触的话，直接single user mode进去了，密码都不用 | f*******l
发帖数: 964 | 5 grub 可以设密码，防止随便进入 single user mode。 这个文章提到的 bug 就是关于
突破 grub 的密码。
【在 m*f 的大作中提到】
: 可以物理接触的话，直接single user mode进去了，密码都不用
|
|
