Hacker News Reader

Comment by andrewmcwatters | Hacker News Reader

Boy if they only used Rust, then these curl commands that no one would ever enter would have been memory safe.

`curl` is widely integrated via its CLI: you'll find all kinds of programs (from simple shell scripts to actual compiled binaries) that interact with `curl` through command-line arguments. So the attacker model here isn't "nobody would type this" it's "does your SoHo router or other software shell out to cURL in an attacker-controllable way."

If an attacker could control the curl CLI on your SoHo router, couldn't they just direct it to download their evil payload, and then use one of a million more common problems to run the evil? Or directly exfiltrate data through HTTP requests made by curl? I don't think anyone runs curl as root so there is no privilege escalation.

Seriously I can't understand the threat model here.

There are different scopes: it's not the case that every controllable CLI invocation is also one where an attacker could change the URL entirely. There are cases where they might only be able to change the behavior of a single flag or option, or a subrange of characters in a specific protocol's URLs, etc.

I think the realistic attack model here is:

1. SoHo router that has a public accessible endpoint that takes inputs boiling down to "safe" cURL flags;

2. Those flags can actually induce memory corruption;

3. An attacker is able to execute arbitrary remote code in the context of the cURL subprocess through a payload packed into the "safe" flag.

your car has libcurl on it, but not Rust.

VW is using Rust in the entertainment system. There is both interest and a bit of actual adoption.

As an ID.4 owner I can only remark it does not appear to help them.

I take it back, it was Volvo, not VW

https://news.ycombinator.com/item?id=32960768

Most people actively avoid having rust anywhere near their cars.

There are quite some cars that do, actually :)

Not yet https://crates.io/keywords/canbus

Reply on news.ycombinator.com