6 ms·
One of the potential problems here is the fact that even just inspecting the "curl" result of the file can trick sysadmins into executing code they did not want
by Mojah 11y ago
One of the potential problems here is the fact that even just inspecting the "curl" result of the file can trick sysadmins into executing code they did not wanted executed.
Imagine the following scenario:
$ curl something.tld > installer.sh
$ cat installer.sh
"Hey, that looks safe, I'll go ahead and execute it".
$ bash installer.sh
If the install-file had terminal escape sequences, it could have been used to trick anyone into executing code they had no intention to execute.
More here, if you're interested: https://ma.ttias.be/terminal-escape-sequences-the-new-xss-for-linux-sysadmins/ https://ma.ttias.be/terminal-escape-sequences-the-new-xss-fo...
Bottom line: assume everything you download from the internet is malicious in nature and inspect it with every possible tool you have available. And even then, run it in a sandboxed environment wherever possible.
- xienze 11y agoSo open it in an editor?
- Mojah 11y agoYes, or view via `less` or a hexdumper. But how many sysadmins do you know rely on `cat` for their day-to-day use? Too many, I reckon.
- mrbig4545 11y agoVery interesting. I'm always (ab)using cat for this, and I keep meaning to stop, but I forget. After seeing this I'll definitely stop. Thanks!
- slasaus 11y agouse `cat -v installer.sh` -v Displays non-printing characters so they are visible. Control characters print as `^X' for control-X, with the exception of the tab and EOL characters, which are displayed normally. The tab character, control-I, can be made visible via the -t option. The DEL character (octal 0177) prints as `^?'. Non-ASCII characters (with the high bit set) are printed as `M-' (for meta) followed by the character for the low 7 bits. http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man1/cat.1?query=cat http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man1/...
- ketralnis 11y agoUse "install.sh --oh-and-don't-delete-all-of-my-files=true". If it's not the default, it's not what's going to happen.
- DonHopkins 11y agoBetter python than bash or perl. At least the code shouldn't look like line noise. When's the last time you tried to read through a gnu ./configure file?
- skrebbel 11y ago> Bottom line: assume everything you download from the internet is malicious in nature and inspect it with every possible tool you have available. And even then, run it in a sandboxed environment wherever possible. Ehhh. Ok that's not very actionable advice. I downloaded my entire OS from the internet.