For logical reasons, every bug that affects a system's security must be taken seriously and fixed as soon as possible. Linux environments usually respond faster than other platforms, but this error surprised many by its sheer absurdity. According to two researchers from the Polytechnic University of Valencia, simply pressing the backspace key 28 times in GRUB2 activates the rescue shell, granting total access to the computer.
We know to the point of exhaustion that Hollywood "hackers" and TV shows are pure fiction. From that ridiculous movie with Angelina Jolie (I went to see it in theaters, I am Spartacus) to the horrors of CSI, there is basically no way to take what they show on screen seriously. Compromising a system's security requires effort, research, testing, mistakes, creativity, and determination, which ultimately make that system more secure. Even so... there are exceptions to the rule. Some are serious, and others fall into the realm of the ridiculous, to such an extent that we must appeal directly to our sense of humor to process them.
The Vulnerability
Take the case of Héctor Marco and Ismael Ripoll, two researchers from the Cybersecurity Group at the Polytechnic University of Valencia. According to their official presentation, all versions of GRUB from 1.98 to 2.02 are affected by a very particular bug: pressing the backspace key a total of 28 times—and only 28 times—can cause two things: either the system reboots, or a rescue shell opens, providing access to the computer's contents without any additional security checks. In very relaxed terms, the bug is induced by an out-of-bounds write, followed by an overflow.
Can you imagine someone hacking a Linux terminal by pressing backspace 28 times? Honestly, that situation fits more in a comedy show (in the style of The IT Crowd) than in real life... but that's the bug. The best part is that it already belongs to the realm of the anecdotal. The vast majority of distros using GRUB2 pushed the corresponding update that fixes this strange error, and if we add the detail that physical access to the computer was required to activate it, the risk wasn't that great in the end. The good thing is that Linux comes out of this more secure, but we must keep watching and auditing the code. Nobody knows what might appear tomorrow...
