Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

LD_PRELOAD? ptrace?

Updated: Actually, I have no idea. The securelist link says "It uses techniques that don't require root access" but then later says "The module statically links PCAP libraries, and uses this code to get a raw socket".

I have no idea how one gets a raw socket without root, but I'm not in the business of creating raw sockets on linux...



Not sure I follow, can a non-root user observe raw packets (like SYN packets and sequence numbers) through these facilities?

Edit: well, a statically linked pcap is still just a bunch of user-mode assembly code. I didn't think linux kernel security hinged on keeping libraries secret :P


I tried interpreting the ars article (rookie mistake) and assumed it was stealing traffic from other programs running as the same user.


Aha, now I see why you brought up ptrace.

But they were talking about magic syn packets etc (in the securelist post linked from another comment, I got the sources mixed up)




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: