0 Day Linux Exploitation

Zoltan · November 22, 2016, 10:04pm

There is an existing thread about this: please join the discussion there:

Tesla shill takes a ridiculous swing at Linux Linux - Other

So Chris Evans, a Tesla employee, has posted this very unlike scenario with a lot of publicity as a "zero-day exploit": He has not gone through the regular channels of security reporting in Linux, which are well known and very efficient. The situation he describes is not a Linux problem, but a proprietary software problem, because it's a problem of Chrome. Not even chromium would allow for this "security problem" to happen. Chrome nor Chromium are available in the Fedora repos, and the warnings of Fedora against using the crappily coded Google projects are well documented. Yet Chris Evans thinks that it's a serious security problem of Linux in general that a certain purely theoretical drive-by attack would be possible against Fedora 24 through Chrome. That is of course only if SELinux is not enabled and - as previously mentioned - the user would have installed the proprietary software Chrome, against which Fedora explicitely has warned, including the open source upstream project chromium, which has been kicked out of the Fedora repos because of lack of elementary quality, even though chromium is not concerned by this exploit. Furthermore is the exploit entirely dependant of an additional gstreamer-bad package that is not in the fedora repos, but has to be downloaded from rpmfusion. And after all this nonsense, the conclusion of Chris Evans at the bottom of his ridiculous hyped up article is: This was too easy. It should not be possible to find a serious memory corruption vulnerability in the default Linux desktop attack surface with just a few minutes of looking. Although it’s hard to say it, this is not the kind of situation that occurs with a latest Windows 10 default install. Is it possible that Linux desktop security has rotted? Of course... that explains everything... Tesla huh? Yeah, figures, probably employee of the month... one of those software developers at Tesla that couldn't make the new Autopilot compatible with the Tesla cars sold up to …

This thread will be closed