LPEs are frequent enough that people no longer use low-privilege user accounts to sandbox potentially malicious software. They are only used to control access for well-behaved users without any intent to subvert the system, not attackers.
replyThe difference here reminds me of the distinction between the regular Paxos algorithm and the Byzantine Paxos algorithm.
> people no longer use low-privilege user accounts to sandbox potentially malicious software
replyIs it the same for containers and VMs? If not, what makes them less vulnerable?
This has been true for DECADES.
replyRegular LPEs are not novel. The frequency has just increased a lot.
replySome distros even include LPE as a feature (cough Ubuntu Server)
replyId count windows and macos in there because you just need an admin pass and you have full rights. Average users might reuse that password everywhere too, plus no password requirements, no expiration.
replySo many guides online for various stuff have users typing sudo or run as administrator too, so they don’t look at it with a side eye either if the attack went in via social engineering instead of brute force or using a leaked pass associated with the user.