3 ms·

This part of the readme makes me a bit worried: curl https://raw.githubusercontent.com/MegaManSec/SSH-Snake/main/Snake.nocomments.sh | stdbuf -o0 bash Comb

This part of the readme makes me a bit worried: curl https://raw.githubusercontent.com/MegaManSec/SSH-Snake/main/Snake.nocomments.sh | stdbuf -o0 bash Combined with the admission that the tool is intended for hacking, I would be concerned that it would suddenly start to phone home with all keys and hosts at some point after users have started using it.

BossingAround 3y ago
You should always inspect a script before executing it. You can even pass it to AI and query the AI about it.
- trashtester 3y ago
  Agree, and especially if it's from a dubious source. Piping it directly from curl to bash makes that near impossible if you run it multiple times. Even suggesting that for something like this in the readme is a red flag to me. It's probably just a bad habit on the part of the author, but it may very well be intended to promote such unsafe practices with the intent to at least have the option to exploit it at some point later.
  - mmsc 3y ago
    >Piping it directly from curl to bash makes that near impossible if you run it multiple times. I’m not sure whether pressing the „fork” button and inspecting it in your local repository is “near impossible”.
    - trashtester 3y ago
      "near impossible" referred to the specific act re-reading the code every time you run it, which you should do if you use the exact method for executing it that is in the readme. There are many ways more competent/sane users who realize the danger can work around those. My concern is that some percentage of users are likely to follow the method in the readme to the letter, without knowing or caring about the danger. Either the author knows this (if not-> incompetent, which is not likely), doesn't care (maybe it's mostly intended for black hack hacking). Or it's actually a trap, where it's first presented as a useful tool, but where a phone home addon is injected at some point later, and able to collect massive numbers of keys before it's detected.
mmsc 3y ago
You can download it to somewhere else then curl where you’ve downloaded it (with the settings changed which are set at the beginning of the file). The tool is marketed as fileless. How are you going to run it on a system which has no writable space?
- trashtester 3y ago
  > You can download it to somewhere Obviously, but the howto in the readme does lay the groundwork for a huge security concern if some admins start to run it recurrently in that way, without reading the code every time. > The tool is marketed as fileless. Which is great if your purpose is indeed to use it for hacking, and you run it on machines that you've already compromised, not on your own. For anyone else, I think it's vital to only run it from an instance where you can download it and examine the code every time there is a change. I would do a git pull for that, not a curl command. Git makes it easier to go through all changes every time you do a pull.

BossingAround 3y ago

You should always inspect a script before executing it. You can even pass it to AI and query the AI about it.

trashtester 3y ago
Agree, and especially if it's from a dubious source. Piping it directly from curl to bash makes that near impossible if you run it multiple times. Even suggesting that for something like this in the readme is a red flag to me. It's probably just a bad habit on the part of the author, but it may very well be intended to promote such unsafe practices with the intent to at least have the option to exploit it at some point later.
- mmsc 3y ago
  >Piping it directly from curl to bash makes that near impossible if you run it multiple times. I’m not sure whether pressing the „fork” button and inspecting it in your local repository is “near impossible”.
  - trashtester 3y ago
    "near impossible" referred to the specific act re-reading the code every time you run it, which you should do if you use the exact method for executing it that is in the readme. There are many ways more competent/sane users who realize the danger can work around those. My concern is that some percentage of users are likely to follow the method in the readme to the letter, without knowing or caring about the danger. Either the author knows this (if not-> incompetent, which is not likely), doesn't care (maybe it's mostly intended for black hack hacking). Or it's actually a trap, where it's first presented as a useful tool, but where a phone home addon is injected at some point later, and able to collect massive numbers of keys before it's detected.

mmsc 3y ago

You can download it to somewhere else then curl where you’ve downloaded it (with the settings changed which are set at the beginning of the file). The tool is marketed as fileless. How are you going to run it on a system which has no writable space?

trashtester 3y ago
> You can download it to somewhere Obviously, but the howto in the readme does lay the groundwork for a huge security concern if some admins start to run it recurrently in that way, without reading the code every time. > The tool is marketed as fileless. Which is great if your purpose is indeed to use it for hacking, and you run it on machines that you've already compromised, not on your own. For anyone else, I think it's vital to only run it from an instance where you can download it and examine the code every time there is a change. I would do a git pull for that, not a curl command. Git makes it easier to go through all changes every time you do a pull.