|
2020-08-14
, 11:14
|
Community Council |
Posts: 4,920 |
Thanked: 12,867 times |
Joined on May 2012
@ Southerrn Finland
|
#3
|
The Following 2 Users Say Thank You to juiceme For This Useful Post: | ||
|
2020-08-15
, 00:28
|
Posts: 35 |
Thanked: 26 times |
Joined on Oct 2018
|
#5
|
The Following User Says Thank You to Sunset_Shimmer For This Useful Post: | ||
|
2020-08-15
, 05:06
|
Posts: 35 |
Thanked: 26 times |
Joined on Oct 2018
|
#6
|
The Following User Says Thank You to Sunset_Shimmer For This Useful Post: | ||
|
2020-08-17
, 19:54
|
|
Posts: 4,118 |
Thanked: 8,901 times |
Joined on Aug 2010
@ Ruhrgebiet, Germany
|
#8
|
The Following 2 Users Say Thank You to peterleinchen For This Useful Post: | ||
/var/lib/aegis/refhashlist (or some path like this)
The file has a rw-rw-rw- permission which means any user could read and write it.
So,a malware executed by user(with lowest permission) could just write it to an empty file to break the Aegis and crash the MeeGo OS.
For example:
-----------
Don't try this on your phone!!!!
----------
I tried this on a newly flashed N9 device with a 3rd party terminal without developer mode.
I just simply run:
echo ''>>The path to the refhashlist file.
And
echo ''>>There is also a refhashlist.bak file.
If you do so,any executable with root permission won't run again.The device won't shutdown unless you force it by long-press the power button.
The device reports OS error and request fixing when you try to boot it after the force shutdown.
I'm afraid that this would be a critical safety problem for MeeGo.
By the way,is there a security problem with the OpenSSH Server installed by Developer Mode?
Last edited by Sunset_Shimmer; 2020-08-14 at 09:14.