[tor-relays] Re: Ebury 1.8.3 on two Quetzalcoatl relay servers: timeline, lessons, open questions

[Jonathan Proulx via tor-relays <tor-relays@xxxxxxxxxxxxxxxxxxxx>]

On Wed, Oct 07, 2026 at 06:38:38PM +0200, Toralf Förster via tor-relays wrote:
:On 07/10/2026 14:29, Dr Remmiz via tor-relays wrote:
:> and the operator account's password was also its sudo password, sat in
:> cleartext in a helper script
:
:Does the issue boils down to this?

That is clearly the accelerarnt to privelege escalation and lateral
movement.

It doesn't explain the initial ingress.

Given the avalanche of recent security issues in just about everything
(the kernel especially) any ingress is likely to eventually result in
privelege escalation and lateral movement.

So I'd be very skeptical of putting all blame on a single issue.

It *may* point to a pattern or carelessness that *did* lead to the
initial ingress.  But I'm sure we've all done at least one dumb thing
we've lived to regret, so let's not get too accusatory from afar.

-Jon

-- 
Jonathan Proulx (he/him)
Sr. Technical Architect
The Infrastructure Group
MIT CSAIL
_______________________________________________
tor-relays mailing list -- tor-relays@xxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to tor-relays-leave@xxxxxxxxxxxxxxxxxxxx