8 ms·

> Hello scdf! > That was a bad idea. Don't copy code from websites you don't trust! Or indeed, download software from websites you don't trust. I guess the w

by SCdF 11y ago

> Hello scdf! > That was a bad idea. Don't copy code from websites you don't trust! Or indeed, download software from websites you don't trust. I guess the worry would be that hackers would, as an example, take over brew.sh and do bad stuff with installation url. As opposed to taking over brew.sh (in an alternate world where brew.sh hosts a dmg file or something) and hosting an entirely different file. Bar the relative ease of hiding bad stuff in copy paste compared to making a fake dmg file, this seems to be basically the same situation no?

kedean 11y ago
Most terminal users these days are intelligent enough not to download a random executable from a google result and run it locally under root (without researching it). We've been well inundated not to ever run sketchy programs that you've never heard of. However, a huge portion of people (who this article is targeting), will freely copy and paste a terminal command from a random google result. That makes it a great attack vector for, say, intro to CS students who just want to make this linux thing work right.
- javajosh 11y ago
  I'm not so sure we're really capable of distinguishing between "random executable" and everything else. What do you have to go on in making the distinction? Let's say you're installing a new version of Sublime, or curl, or Chrome. These aren't 'random executables' - or are they? If someone poisons DNS, they could be. If someone MITMs them, they could be. What about stack overflow? Surely they are trustworthy. But if someone hacks them, and inserts an attack like the OP's, then you are in trouble. There are two problems. First, the hardware we own is almost comically powerful, both in compute and network bandwidth. Second, that same hardware mediates between us and everything that is important to us: our lovers, friends, business partners, banks, and so forth. A subtle enough hacker might get into our system and we might not know it, ever. (Indeed, if the hardware manufacturer put some secret code into their stuff then such a hack might be very subtle and very universal indeed.) I'm not throwing my hands up and saying it's all pointless. But consider that your typical gigabyte program has a tremendous amount of surface area to check. And no, you can't discount "dumb" resources like images and videos because they aren't executable. A smart attacker will encode instructions in, say, a viral YouTube video that will trigger those hidden CPU instructions that will load a steganographically encoded program. For now we have to be practical, and not freak out. For the future, we have to move toward smaller, more efficient software that makes unexpected computation and resource usage obvious from an outside observer. This means small code, short call-chains, and minimal screen, network or disk interaction. (I'm particularly worried by the trend for basically all software to be constantly connected to multiple unknown external hosts, any of which could be controlling code on my machine at the same level as the program I installed!)
  - kedean 11y ago
    Of course there's always going to be attack vectors, but clearly it's safer to execute a known program (Firefox) from a trusted website (firefox.com) than it is to use an unknown program (Jons Legit Calculator App) from an unknown website (some bit.ly link). Sure there's still attack vectors at play, but you've mitigated the easy ones. This is the same thing. Everyone needs to know not to go copying terminal commands unless they really trust the source. Obviously there's still a security issue there, but its significantly lower, and that's really all we can aim for.
- collyw 11y ago
  It was somewhat hyperbolic, showing the first line of /etc/psswd. With a normal user account that doesn't actually give you much, while giving the impresion that your password has been revealed (certainly those were my first thought upon reading the message). I imediately saw there was more going into the terminal than I expected (and was surprised) but it would have needed me to actually type a password to do much harm. (OK, some securtiy expert point can probably point out where I am wrong, but as a general rule....)

by SCdF 11y ago

kedean 11y ago

Most terminal users these days are intelligent enough not to download a random executable from a google result and run it locally under root (without researching it). We've been well inundated not to ever run sketchy programs that you've never heard of. However, a huge portion of people (who this article is targeting), will freely copy and paste a terminal command from a random google result. That makes it a great attack vector for, say, intro to CS students who just want to make this linux thing work right.

javajosh 11y ago
I'm not so sure we're really capable of distinguishing between "random executable" and everything else. What do you have to go on in making the distinction? Let's say you're installing a new version of Sublime, or curl, or Chrome. These aren't 'random executables' - or are they? If someone poisons DNS, they could be. If someone MITMs them, they could be. What about stack overflow? Surely they are trustworthy. But if someone hacks them, and inserts an attack like the OP's, then you are in trouble. There are two problems. First, the hardware we own is almost comically powerful, both in compute and network bandwidth. Second, that same hardware mediates between us and everything that is important to us: our lovers, friends, business partners, banks, and so forth. A subtle enough hacker might get into our system and we might not know it, ever. (Indeed, if the hardware manufacturer put some secret code into their stuff then such a hack might be very subtle and very universal indeed.) I'm not throwing my hands up and saying it's all pointless. But consider that your typical gigabyte program has a tremendous amount of surface area to check. And no, you can't discount "dumb" resources like images and videos because they aren't executable. A smart attacker will encode instructions in, say, a viral YouTube video that will trigger those hidden CPU instructions that will load a steganographically encoded program. For now we have to be practical, and not freak out. For the future, we have to move toward smaller, more efficient software that makes unexpected computation and resource usage obvious from an outside observer. This means small code, short call-chains, and minimal screen, network or disk interaction. (I'm particularly worried by the trend for basically all software to be constantly connected to multiple unknown external hosts, any of which could be controlling code on my machine at the same level as the program I installed!)
- kedean 11y ago
  Of course there's always going to be attack vectors, but clearly it's safer to execute a known program (Firefox) from a trusted website (firefox.com) than it is to use an unknown program (Jons Legit Calculator App) from an unknown website (some bit.ly link). Sure there's still attack vectors at play, but you've mitigated the easy ones. This is the same thing. Everyone needs to know not to go copying terminal commands unless they really trust the source. Obviously there's still a security issue there, but its significantly lower, and that's really all we can aim for.
collyw 11y ago
It was somewhat hyperbolic, showing the first line of /etc/psswd. With a normal user account that doesn't actually give you much, while giving the impresion that your password has been revealed (certainly those were my first thought upon reading the message). I imediately saw there was more going into the terminal than I expected (and was surprised) but it would have needed me to actually type a password to do much harm. (OK, some securtiy expert point can probably point out where I am wrong, but as a general rule....)