4 ms·
Not sure if Windows PowerShell scripts are the best way to target open source developers, as these power users are usually on Linux/OSX
by miohtama 10y ago
Not sure if Windows PowerShell scripts are the best way to target open source developers, as these power users are usually on Linux/OSX
- justinclift 10y agoThat's true, but it's not unreasonable to foresee the creators making OSX/Linux versions too if these Windows ones "go ok" from their point of view. :( What's worrying to me is the wording of the emails themselves. It's much better, and more likely appearing "legit" than the vast multitude of scam/trojan/similar .pdf/.xls/.doc/.lnk/etc emails I've seen. (several a day generally)
- pjmlp 10y agoWith the now current curl | sh pattern, one just needs some MTM attack, or even just trick someone to do it, as the majority never look to the contents of the shell script.
- jjirsa 10y agoIt's been demonstrated in the past that server can detect the pipe to shell and modify content - timing attack, if I recall correctly
- samsonradu 10y agoHow does it work? Any sources?
- drdaeman 10y agohttps://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server-side/ https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-b...
- samsonradu 10y agoThanks, that's very interesting.
- tomjen3 10y agoOr serve a different script based on browser headers. Out just develop a really useful node script that then gets a little extra.
- nthcolumn 10y agoWhich is why it could only be done in a vm. VM breakout is still a risk but at the end of the day it's only ever about mitigation not panacea. A startling number of people use this method too what with the plethora of package managers available. The evildoer's best friend laziness - just keeping going longer than someone on average would reasonably expect you to, i.e. not very.
- tonyedgecombe 10y agoI've been worrying about this for some time, I regularly get customers sending screenshots inside Word documents, a well targeted email could easily get past my defences.
- deleted 10y ago[deleted]
- pjmlp 10y agoAlso by default the security level doesn't allow for its execution, but I imagine most change it to run everything instead of only signed scripts.