On Wed, Oct 02, 2019 at 07:03:59PM +1000, Keith Bainbridge wrote:
I wonder if having /home on a 'noexec' partition would stop this attack, please?
I don't know specifically about this attack, but noexec is trivial to circumvent. Here's three ways: bash -c "~/whatever" cp ~/whatever /tmp && /tmp/whatever /lib64/ld-linux-x86-64.so.2 ~/whatever -- 👱🏻 Jonathan Dowland ✎ jon@dow.land 🔗 https://jmtd.net