Attack and Defend: #Linux Privilege Escalation Techniques of 2016 LEIA E COMPARTILHE

Introduction Privilege escalation is an important step in an attacker’s methodology.

 Privilege escalation is the practice of leveraging system vulnerabilities to escalate privileges to achieve greater access than administrators or developers intended. Successful privilege escalation attacks enable attackers to increase their level of control over target systems, such that they are free to access any data or make any configuration changes required to ensure freedom of operation and persistent access to the target system (Williams, 2016).

 While organizations are statistically likely to have more Windows clients, Linux privilege escalation attacks are significant threats to account for when considering an organization's information security posture. Consider that an organization’s most critical infrastructure, such as web servers, databases, firewalls, etc. are very likely running a Linux operating system. 

Compromises to these critical devices have the potential to severely disrupt an organization’s operations, if not destroy them entirely. Furthermore, Internet of Things (IoT) and embedded systems are becoming ubiquitous in the workplace, thereby increasing the number of potential targets for malicious hackers. Given the prevalence of Linux devices in the workplace, it is of paramount importance that organizations harden and secure these devices. The challenge is that system administrators may be unaware of threats to their Linux system, and by extension, their organization. After all, it is easy to overlook Linux systems that are setup once and summarily forgotten about. Furthermore, administrators may lack the skill or knowledge to properly examine and secure Linux-based IoT devices and embedded devices. 

These shortcomings can be addressed through a detailed examination of the threats to enterprise Linux systems, remembering that offense informs defense. The purpose of this research is to examine Linux privilege escalation techniques in detail, particularly techniques that are in active use as of 2016. The techniques examined include current kernel exploits, exploiting weak system configurations, and also conducting physical access attacks where only a keyboard is present. 

Clique no texto para ler o arquivo original