6 ms·
I like the theory behind this and the motivation. But this has to stop: ># Usage (as root): $ bash <(curl -s https://gitlab.com/grownetics/devops/raw/master/to
by UI_at_80x24 8y ago
I like the theory behind this and the motivation.
But this has to stop:
># Usage (as root): $ bash <(curl -s https://gitlab.com/grownetics/devops/raw/master/tor_ssh.sh https://gitlab.com/grownetics/devops/raw/master/tor_ssh.sh)
Spoon feeding like this is why Windows has such a disgusting history of malware, and only encourages people to not think about what they are doing.
- NickBusey 8y agoI mean, that command is linked to in the actual script itself. I figure if you're already reading it, it's probably pretty safe to run. It's also what, a seven line script? Not too many places to hide anything nefarious in there. Sure, I suppose the install directions should be more like, wget the file, cat it to be sure gitlab didn't serve you a malicious file instead(?), then run it. Really not sure what this has to do with malware on Windows though.
- gpm 8y agoIt's better to tell people 'clone this repo and run this script'? I'm pretty sure people have exactly the same chance of auditing it. curl | sh is slightly problematic from untrusted servers that might change the script depending on whether or not it's piped to a shell, but from gitlab I just don't see a difference.
- v_lisivka 8y agoOf course, it's better, because we can link to specific commit by sha256 hash, which is way more secure.
- bouk 8y agoYou can do that with a direct link too: bash <(curl -s https://gitlab.com/grownetics/devops/raw/ef053050065c4928714edd94bedfc83a1225372a/tor_ssh.sh https://gitlab.com/grownetics/devops/raw/ef053050065c4928714...)
- v_lisivka 8y agoNo, you can't. Nothing will check SHA256 of a malware downloaded in this way, so nothing will stop malware from owning your host. To check, just put "127.0.0.1 gitlab.com" into your /etc/hosts and try to serve your own file from your URL. Git will detect this, curl will not.
- vegardx 8y agoYes, try it. Unless something has changed drastically curl still checks that certificates are valid.
- v_lisivka 8y agoIt looks like you assume that SSL guarantees correctness of the file. First, I had experience with substituted SSL certificates (by our government, at revolution), when errors were reported by Chrome only due to certificate pinning for Google services. Second, site can be hacked and replaced directly at the site.
- vegardx 8y agoWhen your threat level is government agencies then, sure, you have issues. But git wouldn't solve anything, unless you have a way to verify the hash or signature.
- tsukurimashou 8y agoThe command is only found in the script itself when you look at the source from gitlab. Also the script contains 7 lines in total if you remove the comments. I get what you're trying to say but in that specific case I don't think it really applies.
- acdha 8y agoWhat specific threat do you believe your advice is protecting people against?
- v_lisivka 8y agomalware
- acdha 8y agoThink about this more: what malware are you going to get by running that command that you wouldn't get by downloading the file and running it locally? You'll eventually realize that the answer is that this advice has no value. What could potentially have value is reviewing the code before running it, which can be done either way.
- jdeca568 8y agoThere is one difference still, by downloading it locally, you only have to check it once and not everytime you want to use the script. You definitely have to trust more parties by piping from the web, and these parties could be compromised at some point. This might be fine, it depends on your own security policy.
- v_lisivka 8y agoOf course, I can get malware in both ways, so recommended way is to trust a third party, a maintainer, which will review code, and then will create signed package.
- acdha 8y agoRight, so rather than talking about curl | bash it would really be better to talk about your review process since, for example, the same concerns apply if you do something like "npm install" without vetting every dependency.
- LinuxBender 8y agosudo -n is a start. Here is one I wrote that shows your internet speed, but will also check to see if you have passwordless sudo. Even without sudo, I could spawn and persist a gateway port ssh proxy outbound to a VPS node, but with sudo, I could do much more. curl -A Mozilla -s https://tinyvpn.org/misc/url_test.txt | bash
- ithkuil 8y agoI wish curl (or a similar tool shipped by default on all distros) had a flag that accepts a hash and verifies that that downloaded file matches that flag before streaming it out I played around with that idea in https://github.com/mkmik/runck https://github.com/mkmik/runck but it obviously can used for installation instructions only if it's rather ubiquitous.
- swixmix 8y agoIntegrity of the file after transfer isn't the problem.
- kej 8y agoOne possible curl/bash attack is to serve a safe file to browsers but a malicious one to curl. In that case a step where you verify the integrity of the file curl downloads would be useful. (I seem to recall there being a way for the server to reliably guess whether the file was being piped or saved to disc, as well, which would let you restrict the malicious version even more. Google is failing me at the moment, though.)
- badideaprojects 8y agoThis post demonstrates detecting the difference between a user piping the output from curl to bash OR curl to stdout. https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server-side/ https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-b...
- teddyh 8y agoI recently saw the term “curlbashware”, and I like it.
- dev_dull 8y agoCan you name even a single instance of this ever distributing malware in history? If downloading an anonymous binary makes you feel safer then I think your criticism lacks merit.
- deleted 8y ago[deleted]
- aboutruby 8y agoBetter usage would be: - wget https://gitlab.com/grownetics/devops/raw/master/tor_ssh.sh https://gitlab.com/grownetics/devops/raw/master/tor_ssh.sh - less tor_ssh.sh - sudo bash tor_ssh.sh
- NickBusey 8y agoThanks, added. https://gitlab.com/grownetics/devops/blob/master/tor_ssh.sh#L10 https://gitlab.com/grownetics/devops/blob/master/tor_ssh.sh#...