Introduction

Services that require special privilege present opportunities for adversaries.

Programming flaws in these services can often be leveraged to gain unauthorized access.

The degree of escalation depends on:
The privilege the adversary is allowed to hold.
Which privilege can be obtained in a successful attack.

SSH daemon retains privilege over its whole life time.
Private host keys for re-keying.
Allocation of pseudo-terminals.