Questions tagged [root]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
0 answers
7 views

Can Samsung be rooted without computer? [migrated]

I have S20 Ultra Im thinking of rooting it. Is rooting possible without a computer? On some places they say you can do it, on other places they say you cant. If you google how to root s20 ultra ...
user avatar
-1 votes
3 answers
182 views

What prevents Windows from being as secure as Linux? [duplicate]

According to wikipedia, Linux's security compared to Windows is generally due to "the malware's lack of root access." Why doesn't Windows just fix this?
user avatar
-1 votes
0 answers
17 views

Can a Samsung receive OTA updates normally with a systemless root? [migrated]

If a systemless root is done will software updates still appear in settings/show up as a notification that there is a new update available? In case it does show up, can you download and install the ...
user avatar
7 votes
2 answers
1k views

/opt and sudo unzip to /opt, is it safe?

Usually we place things in /opt so they are owned by root but normal users can execute them. This prevents normal users modifying the binaries so they cannot execute arbitrary stuff. However, to put ...
user avatar
0 votes
0 answers
49 views

Is it possible to inject code using physical memory access to jailbreak phones?

Is it possible to inject code into RAM using physical access? For example desolder the RAM chips, solder something between the original RAM chip and the phone motherboard, and use that to directly ...
user avatar
3 votes
2 answers
212 views

Privilege escalation through arbitrary file delete

Assuming that I can delete arbitrary files on a linux system as a non-privileged user, what methods exist to escalate my privileges this way?
user avatar
1 vote
1 answer
69 views

Why include the root certficiate in the chain, if it is already in receiving parts' truststore?

If I have a self-signed CA certificate in my truststore, and I am sent a chain of certificates where the root CA is missing, is this a problem and if so why? Say that the last certificate in the chain ...
user avatar
0 votes
1 answer
39 views

Does adding a new user (instead of just using root) help WSL2 security?

Does adding a non-root user do anything except hinder your own ability to make mistakes? Given the new updates on file perms in WSL2 (docs on file perms, more docs), doing everything as root on linux ...
user avatar
  • 1,187
0 votes
1 answer
39 views

Read files protected with System Integrity Protection with sudo

I had a debate with a friend about the security model in new OS X versions. OS X El Capitan and newer have the System Integrity Protection security feature which protects aspects of the OS even from ...
user avatar
  • 583
1 vote
1 answer
224 views

Security implications of rooting a SmartTV (LG)

This webpage will exploit your LG webOS smart TV, gain local root privileges, and install the webOS Homebrew Channel. rootmy.tv I really hate the constant ad breaks on YouTube and have rooted my LG ...
user avatar
  • 1,399
0 votes
2 answers
144 views

Disable everything but a hidden command for root access

linux security and root access question.... I'm setting up a server that has a validator node running on it for a blockchain. I was trying to harden the security of my server. I set up ufw for all ...
user avatar
0 votes
1 answer
155 views

Do I need root access to install a certificate?

I need to have security certificates renewed soon on several RedHat servers. Will I need root access to install them?
user avatar
2 votes
1 answer
1k views

Root detection can be bypassed using Magisk hide: how to mitigate?

I have recently been assigned a new security fix for my Android App. The Vulnerability Assessment and Penetration Testing (VAPT) team used Magisk and Magisk hide to bypass the Android root detection ...
user avatar
0 votes
1 answer
94 views

Can I use root account if every server only runs one service [Debian/Ubuntu Server] [duplicate]

Usually people say directly using root account is a very bad idea. However, my current setting is like this: to achieve a higher level of isolation, all services have their own virtual machine ...
user avatar
2 votes
2 answers
250 views

Secure boot for devices which don't have hardware security element

I understand that Root of Trust is necessary for implementing a secure boot on a device. Root of Trust is strong and trust worthy if this comes from hardware security elements like HSM/TPM/.. So for ...
user avatar
1 vote
0 answers
39 views

School wants me to install a root certificate to connect to their network on my personal laptop [duplicate]

What would this do? I'm a bit of a beginner to root certificates so stay with me here, I Don't want it to be able to see what I'm doing at home.
user avatar
1 vote
2 answers
127 views

What is the added security of “PermitRootLogin no” alone?

Referring to this Q&A: The setting PermitRootLogin no alone does not prevent su - after logging in as a normal user. As described in the referenced answer, there it is possible to prevent su with ...
user avatar
  • 179
1 vote
3 answers
299 views

Why is it not recommended to permanently use the root account for all tasks?

Yes, I did read this answer: https://apple.stackexchange.com/questions/192365/is-it-ok-to-use-the-root-user-as-a-normal-user/192422#192422 But I still fail to understand the reasoning behind this ...
user avatar
  • 5,587
2 votes
1 answer
129 views

Possible to inject in the middle of a ROOT NOPASSWD command with a wild card?

I'm testing for privilege escalations on a Ubuntu 18.04 host, and after running sudo -l , I've discovered a couple of root NOPASSWD commands for a standard user (w/unknown password). These commands ...
user avatar
  • 41
0 votes
1 answer
116 views

Should root certificates have OCSP or CRL for it? [duplicate]

Should root certificates have OCSP or CRL for its own revocation status? So here is what I mean: Intermediate Cert -> http://example.com/root.crl SAN Cert -> https://example.com/intermediate.crl ...
user avatar
0 votes
0 answers
28 views

How should an application verify a servers certificate? [duplicate]

Im developing an application and i want this application to connect to my server via ssl (using openssl currently). I want this application to verify my servers certificate. The problem is i dont ...
user avatar
0 votes
1 answer
235 views

offline root CA workflow

I have reviewed several discussions here regarding offline root CA management. While useful, none quite capture my question. Firstly it presumably would not be generally assessed as an 'offline' root ...
user avatar
  • 21
1 vote
0 answers
84 views

Running non-root process in docker vs bare metal

Recently I faced argument that threw me a bit off balance. I've been suggested that running application bare metal is actually more secure than running it in container. Reasoning behind that is that ...
user avatar
  • 197
2 votes
2 answers
1k views

How do I gain root access to a system using a setuid root binary?

Assuming that I have no ability to use sudo and rather limited permissions, but I have a shell script exploit that allows to me change the file ownership of a file to the current user by running a ...
user avatar
  • 23
1 vote
0 answers
248 views

SECURITY VIOLATION: Root login attempted - Which password is affected?

Logwatch shows that proftpd was tried to be logged into using root 0.0.0.0 (111.254.68.221[111.254.68.221]) - SECURITY VIOLATION: Root login attempted I found: Normally, proftpd does not allow root ...
user avatar
2 votes
0 answers
867 views

What are the security risks of running QEMU/KVM as root?

Context: I own a machine; I trust root and all the accounts. I virtualize untrusted guests using KVM, and don't want them to escape. When /dev/kvm has the right permissions, non-root users can run KVM ...
user avatar
  • 121
0 votes
2 answers
235 views

How do I access a website on my phone without it being able to determine that it was accessed from the same phone and location?

How is it possible to create an account in a website with completely different credentials without the website being able to link the user of the first account and this new one? Tor is not a viable ...
user avatar
  • 101
0 votes
0 answers
109 views

SOC2 and the CentOS root user

One of our customers has the following requirement: according to SOC2 they need to block access to the CentOS root account. They mean any access, even with su root or sudo su. We have blocked the SSH ...
user avatar
  • 1,457
1 vote
0 answers
637 views

Can an SSL certificate be signed by two issuers at the same time? [duplicate]

Can an SSL certificate be signed by two issuers at the same time? Let's take an intermediate certificate as an example. It is usually signed by a root. A root certificate is often self-signed. In my ...
user avatar
  • 117
0 votes
3 answers
299 views

Does sudo ever de-escalate privilege while the program/command/service is running?

For Example Is it safer to do: $ sudo [cmd] [args] [enter user password] or $ su - [enter root password] # [cmd] [args] I always assumed they are the exact same thing, because sudo utilizes ...
user avatar
  • 335
1 vote
1 answer
207 views

Can not setting password for root when installing linux be exploited?

Recently I've been thinking about how I installed my linux system (I went for debian). When I installed it, I chose not to enter password for root and only entered password for my user account. My ...
user avatar
  • 13
-1 votes
1 answer
84 views

MAC OS full admin rights and software removal in a corp environment

We have MAC OS for our developers (running with root). We also deploy an DLP endpoint agent. Now what happens, in some cases they just sudo and uninstall the agent because it slows down the machine. ...
user avatar
  • 1,498
1 vote
1 answer
1k views

Self Signed Certificate in Certificate of Chain [closed]

I setup an internal Root CA with another Intermediate CA, which will issue and sign the certificates for other internal servers. When I did the "openssl s_client -connect :443" it shows the error ...
user avatar
  • 11
0 votes
0 answers
129 views

Sufficient to only require 2FA for su elevation?

I have a small web-facing server on my home network. It is headless, and the only way to log in is to ssh with pubkey authentication from within the local network. I wanted to turn on a 2FA ...
user avatar
2 votes
3 answers
268 views

Do I need to worry about vulnerabilities that require administrative privileges to exploit?

I am currently evaluating the impact that the recent NUC Firmware Advisory has on our machines. What confuses me is that fact that those vulerabilities are scored with a high risk score, but require(...
user avatar
  • 2,914
0 votes
0 answers
114 views

Government Root CA installed on computer/browser and Man-In-The-Middle [duplicate]

Some countries already have their government Root CA installed on computer/browsers. Is it possible for these countries to read Google etc. mails by using Man-In-The-Middle or similar technique(s)?
user avatar
  • 1
33 votes
2 answers
5k views

Ability To Change Root User Password (Vulnerability?)

I am studying for my RHCSA exam, and one of the topics is the ability to "change a forgotten root user password." This is an official exam objective and even has official Redhat documentation. How ...
user avatar
4 votes
1 answer
211 views

How can a bad process obtain root by waiting for a user to run a command as sudo?

A comment on this answer states: The whole linux desktop provides very little protection against bad processes running as the user. A bad process could just watch the keyboard input and wait for ...
user avatar
  • 143
0 votes
1 answer
135 views

Employer Self Signed Root Certificate

I don't have knowledge into programming/cybersecurity so I stumbled upon this site and figured I'd ask a quick question. I worked for about 3 years at company and left as of last week. I don't know ...
user avatar
1 vote
1 answer
275 views

Using SUID program to avoid having entries in sudoers

Well, I've done a lot of reading and documentation around possible exploitation of sudoers files and SUID programs, but don't have a deep enough knowledge to pick up the wisest possible solution for ...
user avatar
0 votes
2 answers
970 views

Is the root certificate issued from one Certificate Authority is same for all the requesting organisation?

Let me please explain the question a bit more through an example: There are lots of companies who have their certificates signed by Verisign (or any CA). I understand that Verisign signs these certs ...
user avatar
  • 215
2 votes
1 answer
101 views

What is the impact of leaving disabled root key on AWS instance?

I have a user which, when asked to create an IAM root user account, left the now disabled root key on the instance. When asked to remove the root key, he said it's disabled now so what's the ...
user avatar
  • 185
0 votes
3 answers
9k views

Leveraging curl to spawn a shell

So I'm doing a HTB challenge where I have leveraged the targets box use of reading a file that sets a url for curl in order to transverse down the directory and display the root flag in a report that ...
user avatar
  • 139
1 vote
1 answer
87 views

Does it make sense to check command integrity after running it as root?

The other day Dave was hurrying for his project at night. He wanted to install homebrew on his Mac. He typed "homebrew" in Safari search bar, pressed return, and clicked into the first link. He copied ...
user avatar
  • 2,247
65 votes
4 answers
13k views

Are most Linux systems that allow non-root users to execute code straightforwardly rootable?

long story short if you can execute code on a box it is usually straightforward to get root (quote source) The immediate implication of this quote (if it's accurate) is that if you're running a ...
user avatar
  • 5,587
35 votes
8 answers
12k views

Why do companies not give root access to employees on their desktop machines? [duplicate]

Why do companies typically not give their employees root access to their desktop machines that are only used by a single employee? If what I can do on my machine poses a threat to the rest of the ...
user avatar
  • 477
1 vote
2 answers
516 views

Is an unencrypted log in android's storage considered insecure?

I'm currently checking the logs an Android app creates. There, I found an interesting entry: In android's /data/data/app.being.checked/cache/ok_http_cache_dir There are quite a lot of files and ...
user avatar
-4 votes
1 answer
211 views

Reason behind Chrome not running in root user in kali Linux?

Why does Google Chrome not run as root user by default in Kali Linux? Is it a security issue?
user avatar
1 vote
2 answers
777 views

Add main user account to docker group

I recently installed ubuntu on my home system. As I am going to mainly use it for machine learning research, I tried to set up a python environment. I tried doing this with docker to make things ...
user avatar
  • 13
4 votes
1 answer
3k views

How to add a custom CA to androids trusted root system folder

As of Android 7.0 no custom certificate will be used by android apps. App developers need to specifically write codes and change app settings to follow a custom CA. But this is difficult while ...
user avatar