Code Monkey home page Code Monkey logo

poc-ubuntutouch-pin-privesc's Introduction

screen

[UPDATE 09.09.2022] I got new CVE for this vulnerability: CVE-2022-40297.

Proof of Concept: Privilege escalation in Ubuntu Touch 16.04 - by Passcode Bruteforce

Ubuntu Touch allows you to "protect" devices with a 4-digit passcode. Such a code was set in a demonstration device. The problem is that the same 4-digit passcode then becomes a password that we can use with the sudo command and gain root privileges.

This means that a malicious application can do us double harm:

  1. Easily escalate privileges and take control of the device.
  2. It can pass the screen unlock passcode to a third party.

How does my Proof of Concept work?

  1. We run poc.py as a regular user.
  2. App is doing bruteforce attack on password. No rate limit in system!
  3. Passcode to unlock the screen = password for sudo su to obtain root.
  4. After 1-2 minutes we have passcode on the screen, which we also save to the file /root/passcode as evidence of system compromise.

Follow me

Follow me on Twitter @FilipKarc and on LinkedIn: LinkedIn.

screen

screen

poc-ubuntutouch-pin-privesc's People

Contributors

filipfk avatar filipkarc avatar

Stargazers

avatar avatar avatar avatar avatar

Watchers

avatar avatar

Forkers

grandblu07 polling-repo-continua 726232111

poc-ubuntutouch-pin-privesc's Issues

Your PoC glosses over some mitigating measures

Your PoC video to bruteforce the users pin code glosses over one important factor

  1. A pin is not the only way to secure your device. Using a full blown password is also an option
  2. Applications on Ubuntu Touch are confined by default. A confined application cannot use sudo.
  3. Unconfined applications can use sudo, (unconfined apps can do anything) but they cannot be uploaded to the Open Store without being open source and passing manual review.

A user could always randomly download a malicious click package from somewhere, but even so, the user would need to purposefully install this package.

In closing, why did you not follow the path of responsible disclosure if you felt this was a serious issue warranting a CVE? Dumping the code on GitHub without giving the project time to correct the issue, or decide it is an acceptable risk, is not in accordance with responsible disclosure practices.

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.