3 ms·

It would make for a good spearphishing attack. If you know the target's stack and can guess what sorts of issues they might run into, you can throw up a few pa

• maratd 11y ago
  That's too much work. It would be easier to just tell them to curl | sh and put all your malicious stuff in the script. That way they won't actually see anything malicious on their screen.
  • redthrowaway 11y ago
    That requires more stupidity on the target's part. I think most devs know not to `curl | sh` random scripts, but something as innocuous as `ps -ef | grep /some/longish/annoying/path/to/script` would seem both safe at first glance and long enough to want to avoid typing.
    • kbutler 11y ago
      Do you download binaries? Do you build or install projects you've downloaded? Those have the same risk as curl|sh
      • redthrowaway 11y ago
        With both binaries and curl|sh, trust in the source is a major factor in whether or not you do it. But copying an innocuous-looking terminal command (like `ps | grep`) doesn't seem like it would require trust. I'll absolutely grab a binary or `curl | sh` from slack.com. I won't do it from a forum. But I would copy a terminal command that didn't look like it was doing anything fishy from a forum.
        • jacquesm 11y ago
          For a long time I had the bash fork bomb without any further explanation as my signature line on /, I'd just about forgotten about it when I got a really angry email from someone telling me that I'd blown up his server and thanks very much for that.