3 ms·
I must confess I clicked on the article because I thought I would learn that there are terminal control codes that are security risks! (The author’s title is f
by gumby 2y ago
I must confess I clicked on the article because I thought I would learn that there are terminal control codes that are security risks!
(The author’s title is fine — just uses a different meaning of “safe”)
I suspect that in a sufficiently fast terminal emulator you could get up to some shenanigans with some judiciously chosen terminal controls.
- kragen 2y agowhat, are you going to do rowhammer in ansi?
- gumby 2y agoChallenge accepted! Now just have to find a terminal that works with a 6 GHz serial line…
- kragen 2y agohmm, i'd think getting it to access a new row every 100 ns would be enough... but i don't really understand rowhammer
- Brian_K_White 2y agoThere are several terminal codes that perform actions on the client, if the terminal impliments them. Even just the code that changes the window title could even possibly be a security risk. But the mother of all, in commercial terminals it's even a critical feature to have an escape code that literally executes an arbitrary string sent from the host to be executed on the client. Usually just to launch a browser or local document viewer, but could be anything. I used it to scan and upload documents from a scanner attached to the users pc back to the host for instance. In years past it would be used to launch excel etc before pretty much everything became doable over the net in a browser.
- its-summertime 2y agoThere are, for iTerm2 for example: https://www.cvedetails.com/vulnerability-list/vendor_id-17010/Iterm2.html https://www.cvedetails.com/vulnerability-list/vendor_id-1701... To not pick on iTerm2, the problem isn't iTerm2 in general (except for some of it), but the "standards" per say sorta assume trusted terminals, which made sense for VTNNN, but not so much since the internet started existing.