Viewing profile — TheJH_

Re b): Yeah but, like, colloquially "root" means "a process in the init user namespace with all UIDs set to 0 and a full capability mask". Re a): If you are root in that sense (and…

seccomp does not use the eBPF userspace interface or any of the associated permission checks. seccomp (and also the classic socket filter interface) take cBPF (classic BPF), with n…

I think that on linux, you ideally don't want /dev/urandom, you want a recent kernel and getrandom(buf, len, 0). From the manpage: If the GRND_RANDOM bit is not set, then the /dev/…

Aaaactually, if you read the code, you'd see that he XORs the bytes from rand() with bytes from /dev/random. This project is horrible, but that's not one of the completely wrong pa…

You can embed \x1b (escape) into a webpage. When you copy-and-paste that, it has the same effect as hitting ESC in the editor. So, I'd just have to make you copy " #\x1b:wq\n" to a…

True, and that might also give you access to more traffic than just a random open wifi because people expect a wifi there and look for it.

I initially thought it'd work, but actually, this protection can be circumvented. See the updated version of http://thejh.net/misc/website-terminal-copy-paste .

Right... for a real attack, you'd have to hide the evil commands near the end of the normal-looking one (the string you see there is truncated). I thought about doing that, but it'…

Definitely, I didn't even know that command :D - but I had to `apt-get install sl` on my machine first. Maybe just do a telnet to a nonstandard port on my server and then send spec…

Maybe... unless you figure out a trick to manipulate the OCR results with invisible, nearly-white gray areas in the image or so.

You might want to mark the newlines in that command... without those, the attack would be pretty boring.

I feared someone would do that. :D Well, it'd be easy to work around this if you have JS enabled... without it, it would probably not be so easy to trick you into copying multiple …

That sounds like a really good approach.

Yes, I got the idea from all the sites that do it using Javascript, but I wanted to post the example to ##security, and half of the people there probably has the browser set to "bl…

Well, if I had really wanted to build a serious attack instead of a harmless PoC, I'd have downloaded a second stage via `curl | sh`, and that script would, for example, set aliase…

If the shell had a protection against text pasted together with an ending newline (and would just strip that newline), it would help, I think.