> For the near and medium term, having access to a low-privileged account on an operating system, that isn’t up-to-date on its latest available patches should be considered functionally equivalent to root access for a well-resourced threat actor.
*buries head in sand*
*cries*
LPEs are frequent enough that people no longer use low-privilege user accounts to sandbox potentially malicious software. They are only used to control access for well-behaved users without any intent to subvert the system, not attackers.
The difference here reminds me of the distinction between the regular Paxos algorithm and the Byzantine Paxos algorithm.
> people no longer use low-privilege user accounts to sandbox potentially malicious software
Is it the same for containers and VMs? If not, what makes them less vulnerable?
This has been true for DECADES.
Regular LPEs are not novel. The frequency has just increased a lot.
Some distros even include LPE as a feature (cough Ubuntu Server)
Id count windows and macos in there because you just need an admin pass and you have full rights. Average users might reuse that password everywhere too, plus no password requirements, no expiration.
So many guides online for various stuff have users typing sudo or run as administrator too, so they don’t look at it with a side eye either if the attack went in via social engineering instead of brute force or using a leaked pass associated with the user.