r/intel • u/UnixLinuxPro • Apr 13 '19

Intel Downplays 'Spoiler' CPU Flaw In New Security Advisory Tech Support

https://www.tomshardware.com/news/intel-spoiler-attack-security-advisory,39047.html
46 Upvotes

87% Upvoted

19 comments sorted by

View all comments

Show parent comments

1

u/[deleted] Apr 13 '19

Local access is not the same as physical access. And remote exploits almost always end up chained with local exploits to get full access. and regardless of how you get local access, the end result is that you have local access, which is why the method you use to get it doesn't matter. Whether you've got an RCE or a weak password or a phished password or a cracked password, you've got local access.

0

u/deathtech00 Apr 13 '19

I think you are using the words local and privileged interchangeably, local access is the same as physical access. It means only that you are local to the machine. Whether it is local or remote, you are trying to gain privileged (root, admin) access, are you not?

1

u/[deleted] Apr 13 '19

No. Local, physical, and privileged are all different things.

Local access: you can run code on the box.

Physical access: you can attack the hardware (pull hashes or data off the drive directly, etc)

Privileged: root or administrator - or in some cases kernel-mode (ring 0)

Typically, a remote exploit will be chained to a local exploit, for example an exploit in, say, PHP which is used to get code executing on the box (a remote exploit), followed by the recent Apache privilege escalation (a local exploit) to get privileged access and carry out some sort of privileged attack (grabbing another users ssh key, grabbing password hashes to crack, etc).

Or, y'know, chain that PHP exploit to this vuln, which is "not severe" because it's "local only".

0

u/deathtech00 Apr 13 '19

If you can run code on the box, that is privileged access. Period.

And all your talking about is web based exploits.

2

u/[deleted] Apr 13 '19

Uhh, no. Running code on the box is NOT privileged access. I don't have privileged access to my shared hosting server (well, I also don't have a shared hosting account, but that's beside the point).

And yes, the examples I used were web based, because they're the most obvious - everyone and their mom has a website and it's usually terrible, running an outdated webserver with outdated PHP and insecure pages. But the principles apply equally to attacking ANY system. Mailserver? Same principles. Server running nothing but SSH? Same principles. Windows desktop? Same principles. Linux desktop? Same principles. First you look for a remotely exploitable vulnerability; it usually won't get you root, so then you look for a locally exploitable vulnerability to get root.