This is more than just a Telemetry, It as a Trojan in Ubuntu Distro.
A remote code-execution (RCE) vulnerability
in all Ubuntu of the world! Why?
Simple
curl is launched as root (not the best practice!),
and Ubuntu Distro fetch https://motd.ubuntu.com multiple times per day
if someone (like 3-letters or 4 letters) controls this Amazon Web server
knowing the version of curl (provided by the script) exploit any local
known vulnerability present in curl or use a curl zero day it will have
"root" access to any Ubuntu Server or Desktop, Laptop of the world!
Proof of Concept
Add the following before the for calling curl in /etc/update-motd.d/50-motd-news
This is more than just a Telemetry, It as a Trojan in Ubuntu Distro.
A remote code-execution (RCE) vulnerability
in all Ubuntu of the world! Why?
Simple
curl is launched as root (not the best practice!), /motd.ubuntu. com multiple times per day
and Ubuntu Distro fetch https:/
if someone (like 3-letters or 4 letters) controls this Amazon Web server
knowing the version of curl (provided by the script) exploit any local
known vulnerability present in curl or use a curl zero day it will have
"root" access to any Ubuntu Server or Desktop, Laptop of the world!
Proof of Concept
Add the following before the for calling curl in /etc/update- motd.d/ 50-motd- news
date +'%Y-%m-%d %H:%M:%S' >> /tmp/test
whoami >> /tmp/test
echo $USER_AGENT >> /tmp/test
wait 12 hours... or 12:00 / 00:00 or reboot
cat /tmp/test
2020-06-05 12:00:00 68.0-1ubuntu2 Ubuntu/20.04/LTS GNU/Linux/ ******* ***-generic/ x86_64 Intel(R) /Core(TM) /i7-*** ***/CPU/ @/***** GHz uptime/70.55/921.20 cloud_id/unknown
root
curl/7.