Hacker News Reader

Comment by throwawayish | Hacker News Reader

An entirely different but similar issue is logs. If you aggregate logs in a simple, unstructed text file, then it becomes pretty easy to add faked log lines, or, if they're viewed in the terminal plain-and-easy, embed VT control characters in log lines that can hide other log lines. And with creative use of Unicode one can also often confuse readers.

View on HN

I saw an example of that with shellscript files you're supposed to run with 'curl http://example.com/script.sh | sh' or something, where if you pipe it to cat instead, it looks harmless enough, because it contains control characters that erase the dangerous parts. So you have to download the script, and load it up in an editor before you can see what it actually does.

...which of course is so much work that noone does it.

Opening it in a text editor is not sufficient. With clever use of 'sleep' you can even have the server return a malicious payload only if it thinks its getting immediately piped to sh[0].

If you're opening it in a browser to check, you've also got to worry that the server may be looking at curl's user agent to decide whether to serve up a malicious payload[1].

[0] https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-b... [1] https://jordaneldredge.com/blog/one-way-curl-pipe-sh-install...

Or open it in an actual text editor, like I do anyway to get syntax highlighting.

You can't embed control characters in URLs, though. Of course some web servers and web applications may blithely accept illegal unescaped control characters in URLs. If so, they're buggy.

    if invalid(input):
      log.warning('UberForm field wrong: ' + input)

(And many subtle variations thereof)

Reply on news.ycombinator.com