Sudo lets an administrator delegate the ability to run commands as root or another user, with an audit trail. MITRE tracks the abuse of its convenience features as T1548.003, Sudo and Sudo Caching, a privilege escalation technique on Linux and macOS.
How attackers use it
Two pieces of sudo configuration matter.
The first is credential caching. The timestamp_timeout setting is the number of minutes between sudo runs before it asks for a password again. Sudo creates or touches a file under /var/db/sudo to record when it last ran. MITRE explains that malware can watch that timestamp, and if it falls inside the timeout, run sudo commands without supplying a password.
The second is tty_tickets, which treats each terminal session separately. If it is disabled, the same trick works from any tty belonging to that user. MITRE notes that in the wild, malware has disabled it by appending Defaults !tty_tickets to the sudoers file, then restarting Terminal for the change to take effect. As of macOS Sierra, tty_tickets is enabled by default.
The sudoers file, /etc/sudoers, can also state when not to prompt, with a line such as user1 ALL=(ALL) NOPASSWD: ALL. Editing it needs elevated privileges, so a NOPASSWD line is usually a sign that something already went wrong, or a convenience that outlived its need.
How to detect it
MITRE's detection strategy has two parts.
- Correlate sudo command executions with an effective user ID of 0, especially when
tty_ticketsis disabled or the timestamp timeout is being used. - Detect
NOPASSWDentries in/etc/sudoersor the disabling oftty_tickets, followed right away by privileged commands.
File integrity monitoring on /etc/sudoers and /etc/sudoers.d gives you the edit itself.
How to reduce the risk
MITRE lists three mitigations.
- Operating System Configuration: keep
tty_ticketsenabled so the cache does not leak across sessions. - Privileged Account Management: require a password, so terminal access alone is not enough. Setting
timestamp_timeoutto 0 requires the password on every sudo. - Restrict File and Directory Permissions: edit sudoers strictly so passwords are always required and users cannot start risky processes as more privileged users.
Check your own environment
Read-only commands for Linux or macOS.
sudo -l
sudo grep -rn "NOPASSWD" /etc/sudoers /etc/sudoers.d
sudo grep -rn "tty_tickets\|timestamp_timeout" /etc/sudoers /etc/sudoers.d
- Which accounts have
NOPASSWD, and is each one still needed? - Is
tty_ticketsever negated? - Is the timeout set to something you chose on purpose?
Quick check
What does setting timestamp_timeout to 0 do?
Sudo asks for the password every time it runs, so there is no cached window to abuse.
Sources
- MITRE ATT&CK, Abuse Elevation Control Mechanism: Sudo and Sudo Caching: https://attack.mitre.org/techniques/T1548/003
