bk99.de entertain the web since 1997

bk99.de
g · SecurityCurated

Security hole discovered in Red Star OS

Summary

In January 2015 security researcher David Jorm found the first hole in North Korea’s Linux distribution Red Star OS 3.0. The udev rules file 85-hplj10xx.rules was writable by all users, so anyone could add a rule with arbitrary commands. udev executed it with root privileges as soon as a matching HP LaserJet printer (or, after adjustment, any USB device) was connected.

Ideas

  • A wrongly set file permission was enough for privilege escalation.
  • udev executes rules with root privileges when devices are plugged in.
  • Connecting a USB device thus becomes the trigger of an attack.

Insights

  • Configuration files for root services need as much protection as the programs themselves.
  • Even a state-controlled system fails because of basic errors in assigning permissions.

Facts

  • The hole was published on the oss-security mailing list.
  • The file 85-hplj10xx.rules was affected.
  • In Red Star OS 2.0 even the startup script /etc/rc.d/rc.sysinit was writable by everyone.

References

Critique

  • The report does not assess whether the errors are negligence or deliberately open access.

Recommendations

  • Regularly check that files under /etc are not world-writable, for example with find -perm -o+w.
  • Use tools such as AIDE to detect changes to system configurations.

Read the original article

Search the Web Archive

g · 2026

Broadcom hole lets attackers knock out entire Wi-Fi networks

In January 2026 researchers from Black Duck found a hole in Broadcom Wi-Fi chipsets through which an attacker within radio range can knock out a 5 GHz network with a single packet, without logging in and regardless of WPA2 or WPA3. All clients lose their connection until the router is restarted, and the attack can be repeated immediately. Testing was done on an Asus RT-BE86U; Broadcom had already patched, but how far manufacturers had passed this on remained unclear.

g · 2025

17,000 Linux servers vulnerable to critical rsync hole

In January 2025 six holes in rsync became known, including the critical CVE-2024-12084, which in combination allows servers with only anonymous read access to be taken over. According to Shadowserver, 17,475 freely reachable rsync servers worldwide were vulnerable on 16 January, with Germany in fifth place with 956. All versions up to 3.3.0 were affected; the fixes came in 3.4.0 and 3.4.1.

g · 2023

Security hole in SugarCRM servers actively exploited

In early 2023 attackers exploited a critical hole in SugarCRM (CVE-2023-22952) to take over servers and install malware. Authentication could be bypassed via the path /index.php/, after which a POST request uploaded a PNG file containing PHP code that was executed when called up later. By 11 January Censys found 354 compromised servers, just under twelve percent of all 3,059 reachable instances.