3 ms·
Boy if they only used Rust, then these curl commands that no one would ever enter would have been memory safe.
by andrewmcwatters 4y ago
Boy if they only used Rust, then these curl commands that no one would ever enter would have been memory safe.
- woodruffw 4y ago`curl` is widely integrated via its CLI: you'll find all kinds of programs (from simple shell scripts to actual compiled binaries) that interact with `curl` through command-line arguments. So the attacker model here isn't "nobody would type this" it's "does your SoHo router or other software shell out to cURL in an attacker-controllable way."
- verall 4y agoIf an attacker could control the curl CLI on your SoHo router, couldn't they just direct it to download their evil payload, and then use one of a million more common problems to run the evil? Or directly exfiltrate data through HTTP requests made by curl? I don't think anyone runs curl as root so there is no privilege escalation. Seriously I can't understand the threat model here.
- woodruffw 4y agoThere are different scopes: it's not the case that every controllable CLI invocation is also one where an attacker could change the URL entirely. There are cases where they might only be able to change the behavior of a single flag or option, or a subrange of characters in a specific protocol's URLs, etc. I think the realistic attack model here is: 1. SoHo router that has a public accessible endpoint that takes inputs boiling down to "safe" cURL flags; 2. Those flags can actually induce memory corruption; 3. An attacker is able to execute arbitrary remote code in the context of the cURL subprocess through a payload packed into the "safe" flag.
- deleted 4y ago[deleted]
- bolanyo 4y agoyour car has libcurl on it, but not Rust.
- deleted 4y ago[deleted]
- tomjakubowski 4y agoNot yet https://crates.io/keywords/canbus https://crates.io/keywords/canbus
- justinsaccount 4y agoMost people actively avoid having rust anywhere near their cars.
- leafario2 4y agoThere are quite some cars that do, actually :)
- dralley 4y agoVW is using Rust in the entertainment system. There is both interest and a bit of actual adoption.