Live data from Hacker News

Don't copy paste from a website to a terminal

thejh.net

81–90 of 257 posts

Re: Don't copy paste from a website to a terminal

#81
post #34
post #14

> Hello scdf! > That was a bad idea. Don't copy code from websites you don't trust! Or indeed, download software from websites you don't trust. I guess the worry would be that hackers would, as an example, take over brew.sh and do bad stuff with installation url. As opposed to taking over brew.sh (in an alternate world where brew.sh hosts a dmg file or something) and hosting an entirely different file. Bar the relati…

Most terminal users these days are intelligent enough not to download a random executable from a google result and run it locally under root (without researching it). We've been well inundated not to ever run sketchy programs that you've never heard of. However, a huge portion of people (who this article is targeting), will freely copy and paste a terminal command from a random google result. That makes it a great at…

I'm not so sure we're really capable of distinguishing between "random executable" and everything else. What do you have to go on in making the distinction? Let's say you're installing a new version of Sublime, or curl, or Chrome. These aren't 'random executables' - or are they? If someone poisons DNS, they could be. If someone MITMs them, they could be.

What about stack overflow? Surely they are trustworthy. But if someone hacks them, and inserts an attack like the OP's, then you are in trouble.

There are two problems. First, the hardware we own is almost comically powerful, both in compute and network bandwidth. Second, that same hardware mediates between us and everything that is important to us: our lovers, friends, business partners, banks, and so forth. A subtle enough hacker might get into our system and we might not know it, ever. (Indeed, if the hardware manufacturer put some secret code into their stuff then such a hack might be very subtle and very universal indeed.)

I'm not throwing my hands up and saying it's all pointless. But consider that your typical gigabyte program has a tremendous amount of surface area to check. And no, you can't discount "dumb" resources like images and videos because they aren't executable. A smart attacker will encode instructions in, say, a viral YouTube video that will trigger those hidden CPU instructions that will load a steganographically encoded program. For now we have to be practical, and not freak out. For the future, we have to move toward smaller, more efficient software that makes unexpected computation and resource usage obvious from an outside observer. This means small code, short call-chains, and minimal screen, network or disk interaction.

(I'm particularly worried by the trend for basically all software to be constantly connected to multiple unknown external hosts, any of which could be controlling code on my machine at the same level as the program I installed!)

Re: Don't copy paste from a website to a terminal

#82
Can't remember which oh-my-zsh plugin it is but you can prevent pasting-and-executing in the terminal. What it does is that you still have to hit enter when you paste something, even if there are breaklines in it. That way you can read what you will execute.

Re: Don't copy paste from a website to a terminal

#83
post #18

Should I consider my browser betraying me by selecting stuff that's outside the viewport without a hint / warning ? (absolute positioned element, (-100,-100)). It's simply too convenient to copy/paste from the browser. P.S. I have a paranoid habit of pasting copied text into the address bar or a notepad to quickly check for unwanted characters. For once, I don't feel like I'm crazy.

It's because for the browser the visual selection is not the same as the textual selection. I'd say this qualifies as a browser bug rather than a user failure. What you see is not what you get.

Re: Don't copy paste from a website to a terminal

#84

This is properly viewed as a bug in bash (and most other shells). Shells can tell terminals to do "bracketed paste": the start and end of a pasted block is marked with escape sequences. The correct behavior is to use bracketed paste, and to treat newlines inside pastes as multiline text input, not as a ready-to-execute signal. Apparently that hasn't happened because of compatibility problems with broken terminals, pl…

Bracketed paste can save you from accidental damage, but not from malicious pastes. As the fine article says, the end sequence can be inside the text you paste unless your terminal emulator filters out the bracketed paste characters (and last time I checked, at least urxvt didn't).

Besides, teaching shell about bracketed paste could only help for pasting directly to shell; it won't help if you're pasting to vim (think of "^[:q!echo pwned^J") or cat (think of "^Decho pwned^J").

Re: Don't copy paste from a website to a terminal

#85

Earlier quoted context omitted.

or copy them to a text editor first?

Is that safe? (Legitimate question)

one can target specific editors...

for instance, if I know you are using VI I can create a series of characters that will escape out of insert mode and run a shell command (note: ^[ is ESC (ascii 27))

git status

^[

:!echo foo

Re: Don't copy paste from a website to a terminal

#87

So, ok. Don't copy and paste from a website to a terminal, I get it and I got it the last time that this kind of thing was posted. But if I look around I put so incredibly much trust in total strangers all the time that compared to say ordering a pizza (where the cook could put anything in the food they wanted), driving on the highway (where anybody could swerve any moment if they wanted) and simply walking down the…

Paste into a text buffer first, which is generally a good idea anyway to deal with formatting issues.

Re: Don't copy paste from a website to a terminal

#88
post #32

Off-topic/meta: "Oh, and it seems that other people wrote a detailed text about this issue in 2008." Well ... yeah. We've known about this. And yes, we need to keep making people aware. I'm also amused by all the young people and their containers: always doing things in a root shell. I'm waiting for that to implode in a few more years. My point here is that maybe it's time we started designing some curricula around t…

Further from the main topic but related to your sentiment. One of the best ways to deal with this is to have more experienced guys who have faced these difficulties hanging around. I am a theorist in an experimental laser group, and the group head remarked on a possible counter-intuitive arcing between two separated plates (for the sake of making an electric field) when pumping out the air in a chamber. One would exp…

> physically counterintuitive

Not entirely sure about that; my first intuition here was "temperature and pressure do pretty similar things to chromodynamic interactions—so if materials become more conductive [or even superconductive] at low temperature, then gas media probably become more conductive [or even superconductive] at low pressures, too."

Re: Don't copy paste from a website to a terminal

#90

So, ok. Don't copy and paste from a website to a terminal, I get it and I got it the last time that this kind of thing was posted. But if I look around I put so incredibly much trust in total strangers all the time that compared to say ordering a pizza (where the cook could put anything in the food they wanted), driving on the highway (where anybody could swerve any moment if they wanted) and simply walking down the…

This is a great point, and something I often wonder about as well. I think it's reasonable to think that only a compromised site or site run by someone with ill-intent would pose any real risk. And in such a scenario, it's going to get out pretty quickly that the site is compromised/dangerous.

While this doesn't help that theoretical set of initial victims, it just doesn't feel like a credible risk worthy of too much worry, especially for information from higher profile sites with reputable backing.

Perhaps the solution here is better mechanisms for validating what a script can do - "script is attempting to access xyz, allow? y/n".

Post reply on HN