[conspire] (forw) Re: [Felton LUG] Oh boy, this doesn't look good...

[Rick Moen]

Quoting Michael Paoli (Michael.Paoli at cal.berkeley.edu):

> "severe vulnerability exists in almost all signed versions of GRUB2
> bootloader"
> <cough, cough>
> Bug, sure.  Even a security bug.  But severe?  Come now.
> So, how many hundreds of thousands, or millions or more,
> computers have been taken over by bad actors by this
> "severe" vulnerability.  Oh, a few research computers in a security
> research lab ...
> where the researchers were given unrestricted root access on these
> hosts?  Uh huh.  Tell me again about how "severe" this
> vulnerability is.

In fact, as with many security news stories in popular-news IP magazines
and Web sites, they glossed over the fact that this alleged
vulnerability ('BootHole') doesn't permit any host compromise at all.
Using it to 'load arbitrary code' requires already being in full control
of the machine in the first place.  It's only a problem if you seriously
expect local root users to be kept out of the boot chain.  Which from a
Unix-ey perspective is a pretty bizarre use-case.

But popular-news IT sources mostly cater to readers who are not used to
thinking about security, and are ripe for clickbait.


> You want severe?  How 'bout something like this:
> https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-5902
> https://www.kb.cert.org/vuls/id/290915

Yeah, 'unauthenticated remote command execution': those are bad words.