4 ms·

An example of "unsafe defaults:" NeXT used Display PostScript for the display manager. If you opened an email that had PostScript commands, the mail agent woul

An example of "unsafe defaults:" NeXT used Display PostScript for the display manager. If you opened an email that had PostScript commands, the mail agent would happily, automatically, execute them. A favorite payload sent around the computer lab would smear all pixels downward to "melt" whatever was rendered on your display. Note that there weren't that many interesting things to exfiltrate back then, so this wasn't a terrible default: there wasn't (any!) online commerce, online banking was rare, and even passwords were never echoed to the terminal.

icedchai 6y ago
You don't need a password to be echoed to exfiltrate it. You just need the key codes. Not sure about NeXTStep, but regular old X let you sniff keys really easily. Some systems (specifically, earlier versions of SGI IRIX) shipped with X authorization disabled by default. This is the equivalent of "xhost +". You could sniff a box as soon as it was plugged into the network, including capturing login session credentials, all terminal commands, and anything else. When they su'd to root, yes, you'd capture the root password. In those days (mid 90's) almost nobody was running firewalls. At least, nobody in these parts. Putting your "office on the Internet" meant raw, unfiltered IP.
- BlueTemplar 6y ago
  These days too, IPv6 tends to be firewall-free. In theory there are protections though, like regularly changing suffixes. Do MacOS and Ubuntu ship with firewalls?
  - icedchai 6y ago
    Most consumer routers should at least be doing basic inbound connection filtering for IPv6. Are they not? MacOS and Ubuntu ship with firewalls, though not sure if they're enabled by default.
    - BlueTemplar 6y ago
      I checked one big ISP, boasting 99% IPv6 coverage, and the IPv6 firewall is opt-in, and considering how many people change their settings... (For those that might not be aware of it : with IPv6, there's no NAT, since there's no need for it.)

icedchai 6y ago

You don't need a password to be echoed to exfiltrate it. You just need the key codes. Not sure about NeXTStep, but regular old X let you sniff keys really easily. Some systems (specifically, earlier versions of SGI IRIX) shipped with X authorization disabled by default. This is the equivalent of "xhost +". You could sniff a box as soon as it was plugged into the network, including capturing login session credentials, all terminal commands, and anything else. When they su'd to root, yes, you'd capture the root password. In those days (mid 90's) almost nobody was running firewalls. At least, nobody in these parts. Putting your "office on the Internet" meant raw, unfiltered IP.

BlueTemplar 6y ago
These days too, IPv6 tends to be firewall-free. In theory there are protections though, like regularly changing suffixes. Do MacOS and Ubuntu ship with firewalls?
- icedchai 6y ago
  Most consumer routers should at least be doing basic inbound connection filtering for IPv6. Are they not? MacOS and Ubuntu ship with firewalls, though not sure if they're enabled by default.
  - BlueTemplar 6y ago
    I checked one big ISP, boasting 99% IPv6 coverage, and the IPv6 firewall is opt-in, and considering how many people change their settings... (For those that might not be aware of it : with IPv6, there's no NAT, since there's no need for it.)