13 ms·

Oh, yeah! Good old curl | sh via HTTP. Fucking awesome. I wonder how many people get unknowingly pwned while executing such curl | sh instructions. It's not har

by xkxx 10y ago

Oh, yeah! Good old curl | sh via HTTP. Fucking awesome. I wonder how many people get unknowingly pwned while executing such curl | sh instructions. It's not hard at all to MitM HTTP, detect if shellcode is being transmitted, then add your own instructions to it. Or you can just compile a list of known sources that encourage to execute curl | sh and MitM only them if you want to make your exploits even more discreet. What a nice way to get yourself your own little botnet. Way to go! There's a catch though. You need access to infrastructure of ISP. But is it that hard to get such access? No.

scrollaway 10y ago
curl sh is no more dangerous than running any script you haven't read, or binary you haven't decompiled for that matter. The odds of mitm are exactly the same.
- semi-extrinsic 10y ago
  No, installing a package using my package manager will a) ensure this exact binary/script is GPG signed by someone I ostensibly trust b) ensure it's not been tampered with by a MitM between the hosting server and my computer This reduces my risk exposure to "creator of software X (or distro packager Y) has turned rogue", which is many orders of magnitude less likely than "website of software X got pwned, or someone is MitM-ing me".
  - scrollaway 10y ago
    That does not invalidate what I said.
    - bigbugbag 10y ago
      It absolutely does. You trust the distro maintainer and have a security mechanism to ensure the scripts and binaries have not been tampered with. So virtually no risk of MitM and very little risk of malicious scripts and binaries. Reading script and decompiling binaries does not imply you understand every thing they do, but it does imply that you have an unlimited amount of time which is impractical at best.
      - scrollaway 10y ago
        No, it really doesn't. I was not comparing to distro packages (which are an excellent solution to the problem, like I said elsewhere) but to download links.
  - jpgvm 10y ago
    Assuming script being fetched by cURL is hosted using HTTPS that is reasonably well configured it basically provides the same guarantees. Unlike a distro package you can also just -not- pipe it to the shell immediately and actually read it. Even if you did unpack every distro package source before you installed it with the amount of crap and boiler plate you would almost never be able to work out -exactly- what it will do. The way I see it the "curl | sh" people have found somewhat of a middle ground. It achieves similar convenience to "apt-get blah" but with simplicity level closer to binary tarball. It's almost as easy to work out what it's going to do as the tarball but it will also do it for you automatically.
    - semi-extrinsic 10y ago
      > Unlike a distro package you can also just -not- pipe it to the shell immediately and actually read it. IDK about other distros, but for the one I use (ArchLinux) it's trivial to inspect the install script, and they (PKGBUILDs) are usually well structured and easy to read.
      - jpgvm 10y ago
        Unfortunately the majority of package managers are bloated and awful. Pacman/PKGBUILD and emerge/ebuilds are notable exceptions, though there is also Nix and many super simple based tarball systems that are also very good. But all of that is irrelevant when 99% of the Linux world is running RPM/APT.
- qzio 10y ago
  Yes. But this site doesn't use https even...
- xkxx 10y ago
  There are 2 types of "any script you haven't read, or binary you haven't decompiled": 1. scripts and binaries you obtained from somebody you trust in a safe authenticated way; 2. everything else. When I update my Debian distro, I get binaries via HTTP, that's true. But I also have the public keys of my distro's maintainers whom I trust. The authenticity of every binary I download is automatically checked using those public keys. It's an example of "any script you haven't read, or binary you haven't decompiled" type 1. curl | sh via HTTP is an example of "any script you haven't read, or binary you haven't decompiled" type 2. curl | sh via HTTPS is an example of something that is very-very close to "any script you haven't read, or binary you haven't decompiled" type 1.
  - scrollaway 10y ago
    The presence of https prevents most mitm vectors. It doesn't prevent the far more likely scenario of the website in question being broken into and serving malware or backdoorware. Point is, don't run binaries you don't have some way of vetting. curl sh is no worse offender than "download link here".
    - xkxx 10y ago
      > don't run binaries you don't have some way of vetting Thank you for your recommendations regarding operational security. We do really appreciate them.
      - sctb 10y ago
        Please comment civilly and substantively on Hacker News or not at all. https://news.ycombinator.com/newswelcome.html https://news.ycombinator.com/newswelcome.html https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
        xkxx 10y ago
        The comment I was replying to was not and is not substantive and informative at all. I wanted to communicate my displeasure to the comment's author, because I'm a mere human. Because I didn't have enough karma yet, I couldn't just downvote it and move on. (NH's policy regarding downvotes from new users encourages them to post unnecessary comments.) That's why I decided to notify the comment's author that his comment was very informative and interesting, even though it was not the case. It's called irony. Is irony uncivil? I don't think so. I do agree that my comment was not substantive, just like the comment I was replying to. That's why I kindly ask to delete that comment too, like you deleted mine. Of course, I expect my request to be most likely ignored, because I'm not some karma [redacted] like the person I was replying to. In fact, I hope I will never become a karma [redacted]. I hope I will always post anything I believe should be posted, regardless of my expectations of being upvoted or downvoted. Thanks for your attention.
- dijit 10y ago
  It's not exactly the same, and http injection by ISP's is definitely a thing. https://www.djm.org.uk/posts/protect-yourself-from-non-obvious-dangers-curl-url-pipe-sh/index.html https://www.djm.org.uk/posts/protect-yourself-from-non-obvio...
  - scrollaway 10y ago
    I know of the attack. It's very unlikely to matter in practice. There's a ton of potential issues when you're curl-piping; all those issues are present in some form when you're simply doing curl first then sh. It's far more egregious to download a hard-to-inspect binary then run it, than it is to download a shell script then run it. Although it's harder to inject code on the fly, if you're at the stage where you're worried about these kinds of attacks it makes very little difference. I don't see people bitching about https://www.terraform.io/ https://www.terraform.io/ offering download links for example. So yeah, it gets tiresome to always see "oh! curl|sh! boo! bad!" - there's actually no better way of sharing such scripts short of making and vetting a package with a high-entry-bar distribution. And a two-step curl + sh instead of a pipe is security theater. https would certainly be appreciated on that site but that's a general issue, regardless of the download script.
    - dijit 10y ago
      if you believe shell scripts are hard enough to write that systemd can take over. Then you should also believe that they're hard enough to inspect that you want some level of auditing. RPM's are inspectable, signed by default and integrate better with your system. (the same is true of apt). And if they're in the package repository then there is a maintainer who is ultimately responsible for ensuring the quality of the code.
      - scrollaway 10y ago
        For the second time here, I'm not dissing package managers... I even explicitly said the solution is "vetting a package with a high-entry-bar distribution". But the whole point of high-entry-bar distros is that it's highly curated. Some random script from the web will not be in there. How do you serve those that need to casually distribute trivial software? There's some answers to that question - they're not widespread at all. It's one of the major failures of package management on Linux. macOS gets it mostly right.
- ithkuil 10y ago
  I read OP's comment as ".... via HTTP!!!"
- eeZah7Ux 10y ago
  No. https://jordaneldredge.com/blog/one-way-curl-pipe-sh-install-scripts-can-be-dangerous/ https://jordaneldredge.com/blog/one-way-curl-pipe-sh-install...
  - scrollaway 10y ago
    A two-letter word is not a good rebuttal to a point I addressed in one of the replies you did not bother reading.
StreamBright 10y ago
The first thing I looked for is an installer that actually does something else than curl | sh.
bjackman 10y ago
For me the insecurity isn't even the worst thing about curl | sh. I like package managers, and I tolerate tarballs, because I know what they do and how to reverse it. I care about the organisation of my filesystem and suspect that the people who suggest I pipe their script into my shell do not care at all.
- awalGarg 10y ago
  I have similar concerns. Also, these scripts pretty much never have an accompanying "uninstall" or "reset system state" scripts. For parent: check out http://github.com/awalGarg/curl-tap-sh http://github.com/awalGarg/curl-tap-sh (disclaimer: I am the author, and it was on HN's frontpage already a while ago)
  - wsdjeg 10y ago
    Will add uninstall func, and reset func. I will have a look at your project
dkersten 10y ago
You need access to infrastructure of ISP. You don't even need that. You could spoof a wifi network with a PineAP or similar and MitM at that level.
ageofwant 10y ago
I'm guessing almost nobody. What you have is an acute case of righteous rage against a flaming straw-man. The only medicine against this affliction is girding your loins and guarding your mind against those seemingly plausible but ultimately horseshit security theater tropes, so popular among the impressionable today. Attacking curl yielding nerds is not going to get you a botnet.
bigbugbag 10y ago
Even before looking at curl | sh over http, simple copy and paste of code from a web page is a very real security concern. https://news.ycombinator.com/item?id=5508225 https://news.ycombinator.com/item?id=5508225 http://www.ush.it/team/ascii/hack-tricks_253C_CCC2008/wysinwyc/what_you_see_is_not_what_you_copy.txt http://www.ush.it/team/ascii/hack-tricks_253C_CCC2008/wysinw...
bonaldi 10y ago
> It's not hard at all to MitM HTTP, detect if shellcode is being transmitted, then add your own instructions to it. Is there any evidence of this ever happening, anywhere?
the_duke 10y ago
I'm so exhausted with the top comment being some off topic rant that doesn't contribute anything to the actual discussion but attracts a lot of reactions because it's easy to say something about it... And yes, I am aware of the irony of this being completely off topic. ;)
- adamors 10y ago
  I really wish comments like the GP were removed. It's like reading Comic Book Guy's thoughts.
eeZah7Ux 10y ago
Relevant: https://curlpipesh.tumblr.com/ https://curlpipesh.tumblr.com/
sethish 10y ago
The -f option cleans up the security concern of executing an incomplete download at least: > -f, --fail > (HTTP) Fail silently (no output at all) on server errors.
wsdjeg 10y ago
I have replacs http with https now.

by xkxx 10y ago

scrollaway 10y ago

curl sh is no more dangerous than running any script you haven't read, or binary you haven't decompiled for that matter. The odds of mitm are exactly the same.

semi-extrinsic 10y ago
No, installing a package using my package manager will a) ensure this exact binary/script is GPG signed by someone I ostensibly trust b) ensure it's not been tampered with by a MitM between the hosting server and my computer This reduces my risk exposure to "creator of software X (or distro packager Y) has turned rogue", which is many orders of magnitude less likely than "website of software X got pwned, or someone is MitM-ing me".
- scrollaway 10y ago
  That does not invalidate what I said.
  - bigbugbag 10y ago
    It absolutely does. You trust the distro maintainer and have a security mechanism to ensure the scripts and binaries have not been tampered with. So virtually no risk of MitM and very little risk of malicious scripts and binaries. Reading script and decompiling binaries does not imply you understand every thing they do, but it does imply that you have an unlimited amount of time which is impractical at best.
    - scrollaway 10y ago
      No, it really doesn't. I was not comparing to distro packages (which are an excellent solution to the problem, like I said elsewhere) but to download links.
- jpgvm 10y ago
  Assuming script being fetched by cURL is hosted using HTTPS that is reasonably well configured it basically provides the same guarantees. Unlike a distro package you can also just -not- pipe it to the shell immediately and actually read it. Even if you did unpack every distro package source before you installed it with the amount of crap and boiler plate you would almost never be able to work out -exactly- what it will do. The way I see it the "curl | sh" people have found somewhat of a middle ground. It achieves similar convenience to "apt-get blah" but with simplicity level closer to binary tarball. It's almost as easy to work out what it's going to do as the tarball but it will also do it for you automatically.
  - semi-extrinsic 10y ago
    > Unlike a distro package you can also just -not- pipe it to the shell immediately and actually read it. IDK about other distros, but for the one I use (ArchLinux) it's trivial to inspect the install script, and they (PKGBUILDs) are usually well structured and easy to read.
    - jpgvm 10y ago
      Unfortunately the majority of package managers are bloated and awful. Pacman/PKGBUILD and emerge/ebuilds are notable exceptions, though there is also Nix and many super simple based tarball systems that are also very good. But all of that is irrelevant when 99% of the Linux world is running RPM/APT.
qzio 10y ago
Yes. But this site doesn't use https even...
xkxx 10y ago
There are 2 types of "any script you haven't read, or binary you haven't decompiled": 1. scripts and binaries you obtained from somebody you trust in a safe authenticated way; 2. everything else. When I update my Debian distro, I get binaries via HTTP, that's true. But I also have the public keys of my distro's maintainers whom I trust. The authenticity of every binary I download is automatically checked using those public keys. It's an example of "any script you haven't read, or binary you haven't decompiled" type 1. curl | sh via HTTP is an example of "any script you haven't read, or binary you haven't decompiled" type 2. curl | sh via HTTPS is an example of something that is very-very close to "any script you haven't read, or binary you haven't decompiled" type 1.
- scrollaway 10y ago
  The presence of https prevents most mitm vectors. It doesn't prevent the far more likely scenario of the website in question being broken into and serving malware or backdoorware. Point is, don't run binaries you don't have some way of vetting. curl sh is no worse offender than "download link here".
  - xkxx 10y ago
    > don't run binaries you don't have some way of vetting Thank you for your recommendations regarding operational security. We do really appreciate them.
    - sctb 10y ago
      Please comment civilly and substantively on Hacker News or not at all. https://news.ycombinator.com/newswelcome.html https://news.ycombinator.com/newswelcome.html https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
      - xkxx 10y ago
        The comment I was replying to was not and is not substantive and informative at all. I wanted to communicate my displeasure to the comment's author, because I'm a mere human. Because I didn't have enough karma yet, I couldn't just downvote it and move on. (NH's policy regarding downvotes from new users encourages them to post unnecessary comments.) That's why I decided to notify the comment's author that his comment was very informative and interesting, even though it was not the case. It's called irony. Is irony uncivil? I don't think so. I do agree that my comment was not substantive, just like the comment I was replying to. That's why I kindly ask to delete that comment too, like you deleted mine. Of course, I expect my request to be most likely ignored, because I'm not some karma [redacted] like the person I was replying to. In fact, I hope I will never become a karma [redacted]. I hope I will always post anything I believe should be posted, regardless of my expectations of being upvoted or downvoted. Thanks for your attention.
dijit 10y ago
It's not exactly the same, and http injection by ISP's is definitely a thing. https://www.djm.org.uk/posts/protect-yourself-from-non-obvious-dangers-curl-url-pipe-sh/index.html https://www.djm.org.uk/posts/protect-yourself-from-non-obvio...
- scrollaway 10y ago
  I know of the attack. It's very unlikely to matter in practice. There's a ton of potential issues when you're curl-piping; all those issues are present in some form when you're simply doing curl first then sh. It's far more egregious to download a hard-to-inspect binary then run it, than it is to download a shell script then run it. Although it's harder to inject code on the fly, if you're at the stage where you're worried about these kinds of attacks it makes very little difference. I don't see people bitching about https://www.terraform.io/ https://www.terraform.io/ offering download links for example. So yeah, it gets tiresome to always see "oh! curl|sh! boo! bad!" - there's actually no better way of sharing such scripts short of making and vetting a package with a high-entry-bar distribution. And a two-step curl + sh instead of a pipe is security theater. https would certainly be appreciated on that site but that's a general issue, regardless of the download script.
  - dijit 10y ago
    if you believe shell scripts are hard enough to write that systemd can take over. Then you should also believe that they're hard enough to inspect that you want some level of auditing. RPM's are inspectable, signed by default and integrate better with your system. (the same is true of apt). And if they're in the package repository then there is a maintainer who is ultimately responsible for ensuring the quality of the code.
    - scrollaway 10y ago
      For the second time here, I'm not dissing package managers... I even explicitly said the solution is "vetting a package with a high-entry-bar distribution". But the whole point of high-entry-bar distros is that it's highly curated. Some random script from the web will not be in there. How do you serve those that need to casually distribute trivial software? There's some answers to that question - they're not widespread at all. It's one of the major failures of package management on Linux. macOS gets it mostly right.
ithkuil 10y ago
I read OP's comment as ".... via HTTP!!!"
eeZah7Ux 10y ago
No. https://jordaneldredge.com/blog/one-way-curl-pipe-sh-install-scripts-can-be-dangerous/ https://jordaneldredge.com/blog/one-way-curl-pipe-sh-install...
- scrollaway 10y ago
  A two-letter word is not a good rebuttal to a point I addressed in one of the replies you did not bother reading.

StreamBright 10y ago

The first thing I looked for is an installer that actually does something else than curl | sh.

bjackman 10y ago

For me the insecurity isn't even the worst thing about curl | sh. I like package managers, and I tolerate tarballs, because I know what they do and how to reverse it. I care about the organisation of my filesystem and suspect that the people who suggest I pipe their script into my shell do not care at all.

awalGarg 10y ago
I have similar concerns. Also, these scripts pretty much never have an accompanying "uninstall" or "reset system state" scripts. For parent: check out http://github.com/awalGarg/curl-tap-sh http://github.com/awalGarg/curl-tap-sh (disclaimer: I am the author, and it was on HN's frontpage already a while ago)
- wsdjeg 10y ago
  Will add uninstall func, and reset func. I will have a look at your project

dkersten 10y ago

You need access to infrastructure of ISP. You don't even need that. You could spoof a wifi network with a PineAP or similar and MitM at that level.

ageofwant 10y ago

I'm guessing almost nobody. What you have is an acute case of righteous rage against a flaming straw-man. The only medicine against this affliction is girding your loins and guarding your mind against those seemingly plausible but ultimately horseshit security theater tropes, so popular among the impressionable today. Attacking curl yielding nerds is not going to get you a botnet.

bigbugbag 10y ago

Even before looking at curl | sh over http, simple copy and paste of code from a web page is a very real security concern. https://news.ycombinator.com/item?id=5508225 https://news.ycombinator.com/item?id=5508225 http://www.ush.it/team/ascii/hack-tricks_253C_CCC2008/wysinwyc/what_you_see_is_not_what_you_copy.txt http://www.ush.it/team/ascii/hack-tricks_253C_CCC2008/wysinw...

bonaldi 10y ago

> It's not hard at all to MitM HTTP, detect if shellcode is being transmitted, then add your own instructions to it. Is there any evidence of this ever happening, anywhere?

the_duke 10y ago

I'm so exhausted with the top comment being some off topic rant that doesn't contribute anything to the actual discussion but attracts a lot of reactions because it's easy to say something about it... And yes, I am aware of the irony of this being completely off topic. ;)

adamors 10y ago
I really wish comments like the GP were removed. It's like reading Comic Book Guy's thoughts.

eeZah7Ux 10y ago

Relevant: https://curlpipesh.tumblr.com/ https://curlpipesh.tumblr.com/

sethish 10y ago

The -f option cleans up the security concern of executing an incomplete download at least: > -f, --fail > (HTTP) Fail silently (no output at all) on server errors.

wsdjeg 10y ago

I have replacs http with https now.