5 ms·

Has running a curl-to-bash command found during normal user-initiated web browsing ever resulted in a malware infection? Even anecdotal evidence would be valuab

by sjy 7y ago

Has running a curl-to-bash command found during normal user-initiated web browsing ever resulted in a malware infection? Even anecdotal evidence would be valuable at this point.

Arnt 7y ago
Not as far as I know, but I have heard about people pasting the Wrong Thing into a root shell. In a way it's a casting error. A type safety violation. You paste text into a privileged shell and coerce it to be sh, and when it goes wrong the sh input is rich in < and > characters. Friends of mine have mentioned at least a) people accidentally pasting much more than the intended line into sh because they selected more than intended and b) sites that modify the cut buffer silently to add some "pasted from … blah … like us on facebook" or somesuch, I forget the details. The person who wrote the page intended one line to be castable to sh, another person who worked on the site added the script that transformed the cut/paste without realising that.
- m0xte 7y ago
  Yes. I had a pretty bad one from a commercial software company. Running any script someone else wrote badly intentionally or otherwise is dangerous. The source is moot. Rather than provide distribution packages they had a shell script that installed and updated their stuff. If you ran the update script it would evaluate rm -rf $(SOFTWARE_ROOT)/ That environment variable was not set if the software hadn’t been installed and it wouldn’t run unless it was a root shell. Guess who ran the update script instead of the install script and hosed the machine? I gave them a whole lifetime of bile over that. The product turned out to be horrible as well.
- aasasd 7y ago
  Funny thing, I've pasted wrong text into the terminal on multiple occasions—from having copypasted some paragraphs of text and immediately forgetting about that. Each time I expect my files to be botched, but the worst that's happened so far is some unwanted files appearing due to ‘>’ being there in the text.
- wibble10 7y ago
  Once I worked at a place where ooh support accidentally pasted an entire maint guide into putty (right click paste is not a good idea) on a prod oracle server, it was fine until the lines in the doc which read: Dbfile1 -> /path/to/dbfile1 ... Etc Which needless to say hosed the entire box... over Christmas... And this is why they don’t use putty anymore ;)
m0xte 7y ago
A close anecdote. I posted one on IRC about 15 years ago, before this was even a thing, which called home by calling curl to an endpoint I controlled only. The sales pitch for the script was setting up vim properly which it did do. 80% of the downloads executed instantly. I had 12 people run the script. No one read it first or downloaded it and ran it as the request count matched the callback count exactly and there wasn’t more than a couple of seconds before the request and callback. After the fact I realised I should have put if the account was root or not in the callback! Alas all it needs is some trust and a sales pitch and someone will run it. At the time I didn’t think of the security consequences until after I had done it.
- nabdab 7y ago
  The element of you story that deals with how you distributed your solution has no relevance to the rest of it. You could have been using any type of distribution it’s irrelevant that you actually used curl. If people trust you and ru. Your code, you can abuse that trust. You could argue that by not having high quality independent third party review on a controlled market place (like the Apple App Store) has security implications. Because that would have checked for and vetted against abuse. But again this has nothing to do with curl.
blablabla123 7y ago
It's also already more than a decade ago. But a friend of mine wanted to format a USB stick. So there was this tutorial online how to do it. I'm not sure if he copy&pasted it or typed the command himself. But anybody who used dd a lot, knows what happened, he damaged his root filesystem irreversibly by pointing to the wrong disk. I think repairing damaged filesystems with Norton suite or so was never a thing on Linux... ;) Long story short, even when typing well intended shell commands, you can damage your system. (Even on Windows or macOS!) Directly piping curl into bash shows a lot of trust. It's amazing how well-intended the web is, must be at least 99,999999% That said, I cannot count how many times following some tutorial blindly/some shell based installer made my carefully crafted *nix installation a bit worse. Nonetheless, most adware/spyware/malware I got through commercial download websites I think.
shakna 7y ago
Not intentionally malware. But the OPAM install [0] deleted my $PATH, and it took me a while how to fix that one. They've since fixed what allowed the problem to happen [1], well it was a combination of that (normal shell problems) and a power-outage that killed the installer just before completion (in which case the script may just think it's complete). But I'm sure similar catastrophic side-effects can occur in other install scripts out there. [0] https://opam.ocaml.org/doc/Install.html https://opam.ocaml.org/doc/Install.html [1] https://github.com/ocaml/opam/issues/2165 https://github.com/ocaml/opam/issues/2165
mceachen 7y ago
I've had a server become unbootable after applying a curl|sh (and I actually wget'ed, skimmed the script, then executed), and it errored out. I'd just taken a backup so I didn't do much forensics before I restored. I know, badware ≠ malware

by sjy 7y ago

Has running a curl-to-bash command found during normal user-initiated web browsing ever resulted in a malware infection? Even anecdotal evidence would be valuable at this point.

Arnt 7y ago

Not as far as I know, but I have heard about people pasting the Wrong Thing into a root shell. In a way it's a casting error. A type safety violation. You paste text into a privileged shell and coerce it to be sh, and when it goes wrong the sh input is rich in < and > characters. Friends of mine have mentioned at least a) people accidentally pasting much more than the intended line into sh because they selected more than intended and b) sites that modify the cut buffer silently to add some "pasted from … blah … like us on facebook" or somesuch, I forget the details. The person who wrote the page intended one line to be castable to sh, another person who worked on the site added the script that transformed the cut/paste without realising that.

m0xte 7y ago
Yes. I had a pretty bad one from a commercial software company. Running any script someone else wrote badly intentionally or otherwise is dangerous. The source is moot. Rather than provide distribution packages they had a shell script that installed and updated their stuff. If you ran the update script it would evaluate rm -rf $(SOFTWARE_ROOT)/ That environment variable was not set if the software hadn’t been installed and it wouldn’t run unless it was a root shell. Guess who ran the update script instead of the install script and hosed the machine? I gave them a whole lifetime of bile over that. The product turned out to be horrible as well.
aasasd 7y ago
Funny thing, I've pasted wrong text into the terminal on multiple occasions—from having copypasted some paragraphs of text and immediately forgetting about that. Each time I expect my files to be botched, but the worst that's happened so far is some unwanted files appearing due to ‘>’ being there in the text.
wibble10 7y ago
Once I worked at a place where ooh support accidentally pasted an entire maint guide into putty (right click paste is not a good idea) on a prod oracle server, it was fine until the lines in the doc which read: Dbfile1 -> /path/to/dbfile1 ... Etc Which needless to say hosed the entire box... over Christmas... And this is why they don’t use putty anymore ;)

m0xte 7y ago

A close anecdote. I posted one on IRC about 15 years ago, before this was even a thing, which called home by calling curl to an endpoint I controlled only. The sales pitch for the script was setting up vim properly which it did do. 80% of the downloads executed instantly. I had 12 people run the script. No one read it first or downloaded it and ran it as the request count matched the callback count exactly and there wasn’t more than a couple of seconds before the request and callback. After the fact I realised I should have put if the account was root or not in the callback! Alas all it needs is some trust and a sales pitch and someone will run it. At the time I didn’t think of the security consequences until after I had done it.

nabdab 7y ago
The element of you story that deals with how you distributed your solution has no relevance to the rest of it. You could have been using any type of distribution it’s irrelevant that you actually used curl. If people trust you and ru. Your code, you can abuse that trust. You could argue that by not having high quality independent third party review on a controlled market place (like the Apple App Store) has security implications. Because that would have checked for and vetted against abuse. But again this has nothing to do with curl.

blablabla123 7y ago

It's also already more than a decade ago. But a friend of mine wanted to format a USB stick. So there was this tutorial online how to do it. I'm not sure if he copy&pasted it or typed the command himself. But anybody who used dd a lot, knows what happened, he damaged his root filesystem irreversibly by pointing to the wrong disk. I think repairing damaged filesystems with Norton suite or so was never a thing on Linux... ;) Long story short, even when typing well intended shell commands, you can damage your system. (Even on Windows or macOS!) Directly piping curl into bash shows a lot of trust. It's amazing how well-intended the web is, must be at least 99,999999% That said, I cannot count how many times following some tutorial blindly/some shell based installer made my carefully crafted *nix installation a bit worse. Nonetheless, most adware/spyware/malware I got through commercial download websites I think.

shakna 7y ago

Not intentionally malware. But the OPAM install [0] deleted my $PATH, and it took me a while how to fix that one. They've since fixed what allowed the problem to happen [1], well it was a combination of that (normal shell problems) and a power-outage that killed the installer just before completion (in which case the script may just think it's complete). But I'm sure similar catastrophic side-effects can occur in other install scripts out there. [0] https://opam.ocaml.org/doc/Install.html https://opam.ocaml.org/doc/Install.html [1] https://github.com/ocaml/opam/issues/2165 https://github.com/ocaml/opam/issues/2165

mceachen 7y ago

I've had a server become unbootable after applying a curl|sh (and I actually wget'ed, skimmed the script, then executed), and it errored out. I'd just taken a backup so I didn't do much forensics before I restored. I know, badware ≠ malware