3 ms·

Am I the only one a little concerned that no obvious attack has been found from this? It seems doubtful that a state actor is trying to use terminal escape seq

Am I the only one a little concerned that no obvious attack has been found from this? It seems doubtful that a state actor is trying to use terminal escape sequences to hide an error message... The state actor wants code execution, not the ability to backspace some warning on a developers terminal. Besides, using such a vulnerability seems far too dangerous - those escape sequences would be plainly obvious in any log file or any inspection of files on-disk. And at the same time, if you are an undercover state actor, there is no point in potentially revealing yourself by inserting some security problem that isn't exploitable.

bthrn 2y ago
The goal here is to submit what appears to be a sequence of innocuous changes, none of which on their own are “obvious” vulnerabilities. The truth is, we don’t know what the strategic depths of this actor are. It may be years before we know whether an attack is successful. For example — and this is just hypothetical - the author may have found that some consumer of this codebase uses it in a script, and consumes console output in some form. By modifying its output to behave differently, they may be able to influence the consumer’s execution in some clever way so as to create other conditions necessary for additional exploitation. Or - the PR could have just been a test to gauge the scrutiny of the approvers.
- Bluestein 2y ago
  The "funny" thing here is that this is (somewhat, perhaps?) how an AI intelligent beyond human capacity might execute an attack - or what an attack by one such might feel like: Lots of apparently unrelated actions, many or all of which make no sense ... ... (until and if you see the larger picture, which might be insurmountably difficult ... ... this, coupled with AI-level scalability of social engineering, at AI-level scale -and- with an AI-level understanding of "known-outcomes" that might be desirable towards given goals: "Leader change", etc.-)
omoikane 2y ago
There had been code execution exploits tied to escape sequences, for example: https://news.ycombinator.com/item?id=40428032 https://news.ycombinator.com/item?id=40428032 - Abusing url handling in iTerm2 and Hyper for code execution (2024-05-21)

bthrn 2y ago

The goal here is to submit what appears to be a sequence of innocuous changes, none of which on their own are “obvious” vulnerabilities. The truth is, we don’t know what the strategic depths of this actor are. It may be years before we know whether an attack is successful. For example — and this is just hypothetical - the author may have found that some consumer of this codebase uses it in a script, and consumes console output in some form. By modifying its output to behave differently, they may be able to influence the consumer’s execution in some clever way so as to create other conditions necessary for additional exploitation. Or - the PR could have just been a test to gauge the scrutiny of the approvers.

Bluestein 2y ago
The "funny" thing here is that this is (somewhat, perhaps?) how an AI intelligent beyond human capacity might execute an attack - or what an attack by one such might feel like: Lots of apparently unrelated actions, many or all of which make no sense ... ... (until and if you see the larger picture, which might be insurmountably difficult ... ... this, coupled with AI-level scalability of social engineering, at AI-level scale -and- with an AI-level understanding of "known-outcomes" that might be desirable towards given goals: "Leader change", etc.-)

omoikane 2y ago

There had been code execution exploits tied to escape sequences, for example: https://news.ycombinator.com/item?id=40428032 https://news.ycombinator.com/item?id=40428032 - Abusing url handling in iTerm2 and Hyper for code execution (2024-05-21)