Hacker News new | ask | show | jobs
by sumtechguy 979 days ago
This is ripe for this sort of security problem https://en.wikipedia.org/wiki/Confused_deputy_problem
1 comments

Maybe people will realize you should not deputize someone that's neither aligned nor loyal to you (even if in a bounded but known way).
Heh cute. But usually it is used in privilege escalation style attacks. Get the program that has enough permission to do one thing on your behalf that calls something else to get you more privilege. Depending on what level these programs are running at they could do some interesting things that maybe most programs can not do at all just because the code is not there. These style of programs are going to be a wild time for awhile. I called the same thing when I saw people fuzzing cpus and the different instructions they could generate. We ended up with a whole class of attacks out of that which crippled CPUs for a decade.