Hacker News Reader

Comment by Mojah | Hacker News Reader

One of the potential problems here is the fact that even just inspecting the "curl" result of the file can trick sysadmins into executing code they did not wanted executed.

Imagine the following scenario:

$ curl something.tld > installer.sh

$ cat installer.sh

"Hey, that looks safe, I'll go ahead and execute it".

$ bash installer.sh

If the install-file had terminal escape sequences, it could have been used to trick anyone into executing code they had no intention to execute.

More here, if you're interested: https://ma.ttias.be/terminal-escape-sequences-the-new-xss-fo...

Bottom line: assume everything you download from the internet is malicious in nature and inspect it with every possible tool you have available. And even then, run it in a sandboxed environment wherever possible.

View on HN

use `cat -v installer.sh`

     -v      Displays non-printing characters so they are visible.  Control
             characters print as `^X' for control-X, with the exception of the
             tab and EOL characters, which are displayed normally.  The tab
             character, control-I, can be made visible via the -t option.  The
             DEL character (octal 0177) prints as `^?'.  Non-ASCII characters
             (with the high bit set) are printed as `M-' (for meta) followed
             by the character for the low 7 bits.

http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man1/...

Use "install.sh --oh-and-don't-delete-all-of-my-files=true".

If it's not the default, it's not what's going to happen.

> Bottom line: assume everything you download from the internet is malicious in nature and inspect it with every possible tool you have available. And even then, run it in a sandboxed environment wherever possible.

Ehhh. Ok that's not very actionable advice. I downloaded my entire OS from the internet.

There's a checksum for each package and for the CD. Back in the day, people cared about that.

How do you verify the checksum?

Very interesting. I'm always (ab)using cat for this, and I keep meaning to stop, but I forget. After seeing this I'll definitely stop.

Thanks!

So open it in an editor?

Yes, or view via `less` or a hexdumper.

But how many sysadmins do you know rely on `cat` for their day-to-day use? Too many, I reckon.

`cat` abuse is rampant

Add "alias cat='cat -v'" to your login profile then.

You should be cautious about running less on untrusted input: http://seclists.org/fulldisclosure/2014/Nov/74

Better python than bash or perl. At least the code shouldn't look like line noise. When's the last time you tried to read through a gnu ./configure file?

Reply on news.ycombinator.com