1. 7

  2. 5

    This was a rather interesting bug. Due to clocking in between 100-110 hours at work for a couple week s straight, I did make a few mistakes in handling this bug. Lessons learned.

    1. 3

      Until recently, HardenedBSD’s default configuration contained a somewhat serious flaw that could be exploited by a MITM to intercept requests from pkg(7) and let it execute code provided by the attacker with the privileges of the pkg user (usually root).

      I think this also calls out the need for FreeBSD to priv-sep/priv-reduce the ports and pkg systems. I don’t pretend to claim that a priv-reduced pkg(7) would have necessarily prevented this MITM vulnerability, but my educated guess is that it would have helped (as has been discussed in this story under the “Ports and Package” section).