3 ms·

Pastejacking should be mitigated if you use zsh, as it will never run pasted commands automatically. From quick test it seems that recent(?) versions of bash al

Pastejacking should be mitigated if you use zsh, as it will never run pasted commands automatically. From quick test it seems that recent(?) versions of bash also implemented this feature and have it enabled by default. I don't know about fish or other shells.

Un1corn 7y ago
Pastejacking is not the only possible attack by a compromised server, you can also change the content of the script when the user download it through curl or wget. Oh My Zsh use GitHub for their script so I trust it more than if they hosted it themselves for example
- Carpetsmoker 7y ago
  If people have access to change the content of the script then they can also change foo-1.2.3-src.tar.gz or foo-1.2.3-linux-amd64.gz. These are all general problems with downloading anything from the internet.
  - Un1corn 7y ago
    Right but the attacker can make it look legit even for someone that look at the script. The attacker can change the content of the script by the user agent or even by detecting when you pipe it to bash[0] [0] https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server-side/ https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-b...
    - marcthe12 7y ago
      Well there is a way to resolve that. Have command in between curl and sh that effectively only prints to stdout once stdin receive EOF. A double tac is an xample
      - mike_hock 7y ago
        Or, you know, pipe to a file and verify the content, then execute.
  - CoryG89 7y ago
    The set of people who have access to the GitHub project (push privileges) might not be the same as the set of people who have access to said project's website.
minitech 7y ago
Not running pasted commands automatically isn’t a security feature on its own, because the paste “brackets” of bracketed paste can be inside the clipboard. It’s kind of ridiculous that most terminal emulators don’t defend against that by default.
heinrich5991 7y ago
Fish also does this.
Rapzid 7y ago
Are you talking about the shell or the terminal protecting against paste jacking? I'm aware of terminals now protecting against this.

Un1corn 7y ago

Pastejacking is not the only possible attack by a compromised server, you can also change the content of the script when the user download it through curl or wget. Oh My Zsh use GitHub for their script so I trust it more than if they hosted it themselves for example

Carpetsmoker 7y ago
If people have access to change the content of the script then they can also change foo-1.2.3-src.tar.gz or foo-1.2.3-linux-amd64.gz. These are all general problems with downloading anything from the internet.
- Un1corn 7y ago
  Right but the attacker can make it look legit even for someone that look at the script. The attacker can change the content of the script by the user agent or even by detecting when you pipe it to bash[0] [0] https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server-side/ https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-b...
  - marcthe12 7y ago
    Well there is a way to resolve that. Have command in between curl and sh that effectively only prints to stdout once stdin receive EOF. A double tac is an xample
    - mike_hock 7y ago
      Or, you know, pipe to a file and verify the content, then execute.
- CoryG89 7y ago
  The set of people who have access to the GitHub project (push privileges) might not be the same as the set of people who have access to said project's website.

minitech 7y ago

Not running pasted commands automatically isn’t a security feature on its own, because the paste “brackets” of bracketed paste can be inside the clipboard. It’s kind of ridiculous that most terminal emulators don’t defend against that by default.

heinrich5991 7y ago

Fish also does this.

Rapzid 7y ago

Are you talking about the shell or the terminal protecting against paste jacking? I'm aware of terminals now protecting against this.