Silent Leaks: Harvesting Secrets from Shared Linux Environments
Explores techniques for harvesting cached credentials, environment tokens, and process memory artifacts across multi-tenant shared Linux systems.
Summary
The Attack Surface of Multi-User Linux Systems
Shared Linux servers, high-performance computing clusters, and container hosts often host multiple users and background processes with varying privilege levels.
Harvesting Secrets from Ephemeral Artifacts
Cernica Ionut Cosmin details stealthy techniques for recovering sensitive secrets from /proc filesystem pseudo-files, unlinked file descriptors, systemd service environments, and shared memory segments (/dev/shm).
Process Memory Dumping and Privilege Escalation
Unprivileged local users can monitor process execution timing, inspect inter-process communication pipes, and extract authentication tokens used by adjacent administrative processes.
Hardening Multi-User Linux Environments
Mitigating local secret leakage requires mounting /proc with hidepid=2, restricting ptrace permissions via Yama LSM, and adopting dedicated secret management services instead of shell environment variables.
Related talks
Creator Stage·46 min
Philip Young
Demonstrates practical attack paths against IBM z/OS Unix System Services, showing how weak file permissions and buffer overflows allow privilege escalation on mainframes.
Main Stage·43 min
Quentin Roland · Wilfried Bécard
Demonstrates how red teams can weaponize Active Directory Group Policy Objects (GPOs) into a stealthy, native command-and-control infrastructure.
Main Stage·34 min
Yuval Gordon
Discloses critical design flaws in delegated Managed Service Accounts (dMSAs) in Windows Server 2025, enabling unprivileged domain users to become Domain Admins.