user

2 Articles

Escalating Privileges In Ubuntu 20.04 From User Account

November 11, 2020 by 28 Comments

Ubuntu 20.04 is an incredibly popular operating system, perhaps the most popular among the Linux distributions due to its ease-of-use. In general, it’s a fairly trustworthy operating system too, especially since its source code is open. However, an update with the 20.04 revision has led to security researcher [Kevin Backhouse] finding a surprisingly easy way to escalate privileges on this OS, which we would like to note is not great.

The exploit involves two bugs, one in accountservice daemon which handles user accounts on the computer, and another in the GNOME Display Manager which handles the login screen. Ubuntu 20.04 added some code to the daemon which looks at a specific file on the computer, and with a simple symlink, it can be tricked into reading a different file which locks the process into an infinite loop. The daemon also drops its privileges at one point in this process, a normal security precaution, but this allows the user to crash the daemon.

The second bug for this exploit involves how the GNOME Display Manager (gdm3) handles privileges. Normally it would not have administrator privileges, but if the accountservice daemon isn’t running it escalates itself to administrator, where any changes made have administrator privileges. This provides an attacker with an opportunity to create a new user account with administrator privileges.

Of course, this being Ubuntu, we can assume that this vulnerability will be immediately patched. It’s also a good time to point out that the reason that open-source software is inherently more secure is that when anyone can see the source code, anyone can find and report issues like this which allow the software maintainer (or even the user themselves) to make effective changes more quickly.

Update: What You See Is What You Laser Cut

August 26, 2015 by 41 Comments

If there’s one thing about laser cutters that makes them a little difficult to use, it’s the fact that it’s hard for a person to interact with them one-on-one without a clunky computer in the middle of everything. Granted, that laser is a little dangerous, but it would be nice if there was a way to use a laser cutter without having to deal with a computer. Luckily, [Anirudh] and team have been working on solving this problem, creating a laser cutter that can interact directly with its user.

The laser cutter is tied to a visual system which watches for a number of cues. As we’ve featured before, this particular laser cutter can “see” pen strokes and will instruct the laser cutter to cut along the pen strokes (once all fingers are away from the cutting area, of course). The update to this system is that now, a user can import a drawing from a smartphone and manipulate it with a set of physical tokens that the camera can watch. One token changes the location of the cut, and the other changes the scale. This extends the functionality of the laser cutter from simply cutting at the location of pen strokes to being able to cut around any user-manipulated image without interacting directly with a computer. Be sure to check out the video after the break for a demonstration of how this works.

Continue reading “Update: What You See Is What You Laser Cut” →