Questions tagged [root]
The root tag has no usage guidance.
78
questions
0
votes
0
answers
7
views
Can Samsung be rooted without computer? [migrated]
I have S20 Ultra Im thinking of rooting it. Is rooting possible without a computer? On some places they say you can do it, on other places they say you cant. If you google how to root s20 ultra ...
-1
votes
3
answers
182
views
What prevents Windows from being as secure as Linux? [duplicate]
According to wikipedia, Linux's security compared to Windows is generally due to "the malware's lack of root access."
Why doesn't Windows just fix this?
- 7
-1
votes
0
answers
17
views
Can a Samsung receive OTA updates normally with a systemless root? [migrated]
If a systemless root is done will software updates still appear in settings/show up as a notification that there is a new update available?
In case it does show up, can you download and install the ...
7
votes
2
answers
1k
views
/opt and sudo unzip to /opt, is it safe?
Usually we place things in /opt so they are owned by root but normal users can execute them. This prevents normal users modifying the binaries so they cannot execute arbitrary stuff. However, to put ...
- 405
0
votes
0
answers
49
views
Is it possible to inject code using physical memory access to jailbreak phones?
Is it possible to inject code into RAM using physical access? For example desolder the RAM chips, solder something between the original RAM chip and the phone motherboard, and use that to directly ...
3
votes
2
answers
212
views
Privilege escalation through arbitrary file delete
Assuming that I can delete arbitrary files on a linux system as a non-privileged user, what methods exist to escalate my privileges this way?
- 53
1
vote
1
answer
69
views
Why include the root certficiate in the chain, if it is already in receiving parts' truststore?
If I have a self-signed CA certificate in my truststore, and I am sent a chain of certificates where the root CA is missing, is this a problem and if so why? Say that the last certificate in the chain ...
0
votes
1
answer
39
views
Does adding a new user (instead of just using root) help WSL2 security?
Does adding a non-root user do anything except hinder your own ability to make mistakes? Given the new updates on file perms in WSL2 (docs on file perms, more docs), doing everything as root on linux ...
- 1,187
0
votes
1
answer
39
views
Read files protected with System Integrity Protection with sudo
I had a debate with a friend about the security model in new OS X versions. OS X El Capitan and newer have the System Integrity Protection security feature which protects aspects of the OS even from ...
- 583
1
vote
1
answer
224
views
Security implications of rooting a SmartTV (LG)
This webpage will exploit your LG webOS smart TV, gain local root
privileges, and install the webOS Homebrew Channel.
rootmy.tv
I really hate the constant ad breaks on YouTube and have rooted my LG ...
- 1,399
0
votes
2
answers
144
views
Disable everything but a hidden command for root access
linux security and root access question....
I'm setting up a server that has a validator node running on it for a blockchain. I was trying to harden the security of my server. I set up ufw for all ...
0
votes
1
answer
155
views
Do I need root access to install a certificate?
I need to have security certificates renewed soon on several RedHat servers. Will I need root access to install them?
2
votes
1
answer
1k
views
Root detection can be bypassed using Magisk hide: how to mitigate?
I have recently been assigned a new security fix for my Android App.
The Vulnerability Assessment and Penetration Testing (VAPT) team used Magisk and Magisk hide to bypass the Android root detection ...
- 121
0
votes
1
answer
94
views
Can I use root account if every server only runs one service [Debian/Ubuntu Server] [duplicate]
Usually people say directly using root account is a very bad idea. However, my current setting is like this: to achieve a higher level of isolation, all services have their own virtual machine ...
2
votes
2
answers
250
views
Secure boot for devices which don't have hardware security element
I understand that Root of Trust is necessary for implementing a secure boot on a device. Root of Trust is strong and trust worthy if this comes from hardware security elements like HSM/TPM/..
So for ...
- 163
1
vote
0
answers
39
views
School wants me to install a root certificate to connect to their network on my personal laptop [duplicate]
What would this do? I'm a bit of a beginner to root certificates so stay with me here, I Don't want it to be able to see what I'm doing at home.
- 11
1
vote
2
answers
127
views
What is the added security of “PermitRootLogin no” alone?
Referring to this Q&A:
The setting PermitRootLogin no alone does not prevent su - after logging in as a normal user.
As described in the referenced answer, there it is possible to prevent su with ...
- 179
1
vote
3
answers
299
views
Why is it not recommended to permanently use the root account for all tasks?
Yes, I did read this answer: https://apple.stackexchange.com/questions/192365/is-it-ok-to-use-the-root-user-as-a-normal-user/192422#192422
But I still fail to understand the reasoning behind this ...
- 5,587
2
votes
1
answer
129
views
Possible to inject in the middle of a ROOT NOPASSWD command with a wild card?
I'm testing for privilege escalations on a Ubuntu 18.04 host, and after running sudo -l , I've discovered a couple of root NOPASSWD commands for a standard user (w/unknown password). These commands ...
- 41
0
votes
1
answer
116
views
Should root certificates have OCSP or CRL for it? [duplicate]
Should root certificates have OCSP or CRL for its own revocation status?
So here is what I mean:
Intermediate Cert -> http://example.com/root.crl
SAN Cert -> https://example.com/intermediate.crl
...
- 163
0
votes
0
answers
28
views
How should an application verify a servers certificate? [duplicate]
Im developing an application and i want this application to connect to my server via ssl (using openssl currently). I want this application to verify my servers certificate. The problem is i dont ...
0
votes
1
answer
235
views
offline root CA workflow
I have reviewed several discussions here regarding offline root CA management. While useful, none quite capture my question.
Firstly it presumably would not be generally assessed as an 'offline' root ...
- 21
1
vote
0
answers
84
views
Running non-root process in docker vs bare metal
Recently I faced argument that threw me a bit off balance. I've been suggested that running application bare metal is actually more secure than running it in container.
Reasoning behind that is that ...
- 197
2
votes
2
answers
1k
views
How do I gain root access to a system using a setuid root binary?
Assuming that I have no ability to use sudo and rather limited permissions, but I have a shell script exploit that allows to me change the file ownership of a file to the current user by running a ...
- 23
1
vote
0
answers
248
views
SECURITY VIOLATION: Root login attempted - Which password is affected?
Logwatch shows that proftpd was tried to be logged into using root
0.0.0.0 (111.254.68.221[111.254.68.221]) - SECURITY VIOLATION: Root login attempted
I found:
Normally, proftpd does not allow root ...
- 11
2
votes
0
answers
867
views
What are the security risks of running QEMU/KVM as root?
Context: I own a machine; I trust root and all the accounts. I virtualize untrusted guests using KVM, and don't want them to escape.
When /dev/kvm has the right permissions, non-root users can run KVM ...
- 121
0
votes
2
answers
235
views
How do I access a website on my phone without it being able to determine that it was accessed from the same phone and location?
How is it possible to create an account in a website with completely different credentials without the website being able to link the user of the first account and this new one?
Tor is not a viable ...
- 101
0
votes
0
answers
109
views
SOC2 and the CentOS root user
One of our customers has the following requirement: according to SOC2 they need to block access to the CentOS root account.
They mean any access, even with su root or sudo su.
We have blocked the SSH ...
- 1,457
1
vote
0
answers
637
views
Can an SSL certificate be signed by two issuers at the same time? [duplicate]
Can an SSL certificate be signed by two issuers at the same time?
Let's take an intermediate certificate as an example.
It is usually signed by a root. A root certificate is often self-signed.
In my ...
- 117
0
votes
3
answers
299
views
Does sudo ever de-escalate privilege while the program/command/service is running?
For Example
Is it safer to do:
$ sudo [cmd] [args] [enter user password]
or
$ su - [enter root password]
# [cmd] [args]
I always assumed they are the exact same thing, because sudo utilizes ...
- 335
1
vote
1
answer
207
views
Can not setting password for root when installing linux be exploited?
Recently I've been thinking about how I installed my linux system (I went for debian). When I installed it, I chose not to enter password for root and only entered password for my user account. My ...
- 13
-1
votes
1
answer
84
views
MAC OS full admin rights and software removal in a corp environment
We have MAC OS for our developers (running with root). We also deploy an DLP endpoint agent. Now what happens, in some cases they just sudo and uninstall the agent because it slows down the machine. ...
- 1,498
1
vote
1
answer
1k
views
Self Signed Certificate in Certificate of Chain [closed]
I setup an internal Root CA with another Intermediate CA, which will issue and sign the certificates for other internal servers.
When I did the "openssl s_client -connect :443"
it shows the error ...
- 11
0
votes
0
answers
129
views
Sufficient to only require 2FA for su elevation?
I have a small web-facing server on my home network. It is headless, and the only way to log in is to ssh with pubkey authentication from within the local network.
I wanted to turn on a 2FA ...
2
votes
3
answers
268
views
Do I need to worry about vulnerabilities that require administrative privileges to exploit?
I am currently evaluating the impact that the recent NUC Firmware Advisory has on our machines.
What confuses me is that fact that those vulerabilities are scored with
a high risk score, but
require(...
- 2,914
0
votes
0
answers
114
views
Government Root CA installed on computer/browser and Man-In-The-Middle [duplicate]
Some countries already have their government Root CA installed on computer/browsers. Is it possible for these countries to read Google etc. mails by using Man-In-The-Middle or similar technique(s)?
- 1
33
votes
2
answers
5k
views
Ability To Change Root User Password (Vulnerability?)
I am studying for my RHCSA exam, and one of the topics is the ability to "change a forgotten root user password." This is an official exam objective and even has official Redhat documentation.
How ...
- 662
4
votes
1
answer
211
views
How can a bad process obtain root by waiting for a user to run a command as sudo?
A comment on this answer states:
The whole linux desktop provides very little protection against bad processes running as the user. A bad process could just watch the keyboard input and wait for ...
- 143
0
votes
1
answer
135
views
Employer Self Signed Root Certificate
I don't have knowledge into programming/cybersecurity so I stumbled upon this site and figured I'd ask a quick question. I worked for about 3 years at company and left as of last week. I don't know ...
1
vote
1
answer
275
views
Using SUID program to avoid having entries in sudoers
Well, I've done a lot of reading and documentation around possible exploitation of sudoers files and SUID programs, but don't have a deep enough knowledge to pick up the wisest possible solution for ...
- 33
0
votes
2
answers
970
views
Is the root certificate issued from one Certificate Authority is same for all the requesting organisation?
Let me please explain the question a bit more through an example:
There are lots of companies who have their certificates signed by Verisign (or any CA). I understand that Verisign signs these certs ...
- 215
2
votes
1
answer
101
views
What is the impact of leaving disabled root key on AWS instance?
I have a user which, when asked to create an IAM root user account, left the now disabled root key on the instance.
When asked to remove the root key, he said it's disabled now so what's the ...
- 185
0
votes
3
answers
9k
views
Leveraging curl to spawn a shell
So I'm doing a HTB challenge where I have leveraged the targets box use of reading a file that sets a url for curl in order to transverse down the directory and display the root flag in a report that ...
- 139
1
vote
1
answer
87
views
Does it make sense to check command integrity after running it as root?
The other day Dave was hurrying for his project at night. He wanted to install homebrew on his Mac. He typed "homebrew" in Safari search bar, pressed return, and clicked into the first link. He copied ...
- 2,247
65
votes
4
answers
13k
views
Are most Linux systems that allow non-root users to execute code straightforwardly rootable?
long story short if you can execute code on a box it is usually straightforward to get root
(quote source)
The immediate implication of this quote (if it's accurate) is that if you're running a ...
- 5,587
35
votes
8
answers
12k
views
Why do companies not give root access to employees on their desktop machines? [duplicate]
Why do companies typically not give their employees root access to their desktop machines that are only used by a single employee?
If what I can do on my machine poses a threat to the rest of the ...
- 477
1
vote
2
answers
516
views
Is an unencrypted log in android's storage considered insecure?
I'm currently checking the logs an Android app creates. There, I found an interesting entry: In android's
/data/data/app.being.checked/cache/ok_http_cache_dir
There are quite a lot of files and ...
-4
votes
1
answer
211
views
Reason behind Chrome not running in root user in kali Linux?
Why does Google Chrome not run as root user by default in Kali Linux? Is it a security issue?
1
vote
2
answers
777
views
Add main user account to docker group
I recently installed ubuntu on my home system. As I am going to mainly use it for machine learning research, I tried to set up a python environment. I tried doing this with docker to make things ...
- 13
4
votes
1
answer
3k
views
How to add a custom CA to androids trusted root system folder
As of Android 7.0 no custom certificate will be used by android apps. App developers need to specifically write codes and change app settings to follow a custom CA.
But this is difficult while ...
- 1,382