Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Don't copy paste from a website to a terminal

thejh.net

Post reply on HN
Print view View original

141–150 of 257 posts

Re: Don't copy paste from a website to a terminal

#141

Post by redthrowaway »

maratd wrote: post #135
redthrowaway wrote: post #121

Earlier quoted context omitted.

It would make for a good spearphishing attack. If you know the target's stack and can guess what sorts of issues they might run into, you can throw up a few pages detailing fixes for those issues. Give half-right answers on stack and link to your honeypot for "more in-depth discussion of the issue". Then sit back and wait for a dev to run your "fix" on one of their servers.

That's too much work. It would be easier to just tell them to curl | sh and put all your malicious stuff in the script. That way they won't actually see anything malicious on their screen.

That requires more stupidity on the target's part. I think most devs know not to `curl | sh` random scripts, but something as innocuous as `ps -ef | grep /some/longish/annoying/path/to/script` would seem both safe at first glance and long enough to want to avoid typing.

Re: Don't copy paste from a website to a terminal

#142

Post by Mojah »

This is an excellent example that shows the dangers of terminal escape sequences. Just a shameless plug, but here's a more detailed post (of mine) on the subject:

Terminal escape sequences – the new XSS for Linux sysadmins: https://ma.ttias.be/terminal-escape-sequences-the-new-xss-fo...

Re: Don't copy paste from a website to a terminal

#143

Post by steveklabnik »

brunosutic wrote: post #44

Another reason against copy-pasting from the web is using unicode characters that look like ASCII ones. This was on HN a week or so ago, but it doesn't hurt to repeat. Example shell command: eⅽho 'hello world' Copy-pasting the above command will fail with the message `eⅽho: command not found`. The reason? 'ⅽ' in 'eⅽho' is a unicode character "SMALL ROMAN NUMERAL ONE HUNDRED" that looks identical to regular ascii 'c'.…

It looks very different on my system.

Re: Don't copy paste from a website to a terminal

#144

Post by kbutler »

jacquesm wrote: post #79

So, ok. Don't copy and paste from a website to a terminal, I get it and I got it the last time that this kind of thing was posted. But if I look around I put so incredibly much trust in total strangers all the time that compared to say ordering a pizza (where the cook could put anything in the food they wanted), driving on the highway (where anybody could swerve any moment if they wanted) and simply walking down the…

It's not just trust in strangers - its trust in the strangers and whomever may have infected the stranger with a mind-control parasite.

For web-sites, that includes direct hacks that make the site distribute malware, as well as "malvertising", etc.

So that old lady next to you may actually be the gang of thugs waiting in a dark alley.

But I don't think that the malware distributors are likely to choose an uncommon channel like copy-and-paste as a distribution vector, so you're probably still OK.

Re: Don't copy paste from a website to a terminal

#145

Post by vidarh »

ctdonath wrote: post #97
jacquesm wrote: post #79

So, ok. Don't copy and paste from a website to a terminal, I get it and I got it the last time that this kind of thing was posted. But if I look around I put so incredibly much trust in total strangers all the time that compared to say ordering a pizza (where the cook could put anything in the food they wanted), driving on the highway (where anybody could swerve any moment if they wanted) and simply walking down the…

Not sure whether this anecdote fits the thread well, but does address "don't copy and paste from a website to, well, anywhere without examining what you just pasted": I was administering a final exam to a programming class. Exam was done on class computers, so with me in the front of the room most of the time I couldn't actually see what everyone was doing (and given the nature of the class, if you cheated it probabl…

And I thought it was ridiculous when someone had cut and pasted a page from an Oracle manual in response to a set of pre-screening questions for a hiring round, headers included (for a generic SQL question we expected a one sentence answer to).

At least that guy didn't pay for it - to my knowledge at least (he did cut and paste most of his answers from various places, though, and got many of them wrong, including an word-for-word copy of an answer from a forum where the answer he had quoted was torn to pieces by other commenters right below).

Re: Don't copy paste from a website to a terminal

#146

Post by kbutler »

redthrowaway wrote: post #141
maratd wrote: post #135

Earlier quoted context omitted.

That's too much work. It would be easier to just tell them to curl | sh and put all your malicious stuff in the script. That way they won't actually see anything malicious on their screen.

That requires more stupidity on the target's part. I think most devs know not to `curl | sh` random scripts, but something as innocuous as `ps -ef | grep /some/longish/annoying/path/to/script` would seem both safe at first glance and long enough to want to avoid typing.

Do you download binaries? Do you build or install projects you've downloaded?

Those have the same risk as curl|sh

Re: Don't copy paste from a website to a terminal

#147

Post by ChuckMcM »

jacquesm wrote: post #79

So, ok. Don't copy and paste from a website to a terminal, I get it and I got it the last time that this kind of thing was posted. But if I look around I put so incredibly much trust in total strangers all the time that compared to say ordering a pizza (where the cook could put anything in the food they wanted), driving on the highway (where anybody could swerve any moment if they wanted) and simply walking down the…

Not sure you will anything more than anecdotal evidence but the propensity of people I've interviewed to go to a site like Stack Overflow and cut/paste "solutions" into their shell or terminal is sadly quite large. I much prefer people who can internalize the core knowledge of their craft over those who are living with all their technical knowlege currently swapped out to the web.

Re: Don't copy paste from a website to a terminal

#148

Post by vidarh »

jacquesm wrote: post #110
dedward wrote: post #87

Earlier quoted context omitted.

Paste into a text buffer first, which is generally a good idea anyway to deal with formatting issues.

I do that regardless because I'm super paranoid about stuff like this but I'm really wondering if I'm not taking it a bit too far. I've also yet to run into any kind of attempt to pull a stunt like this in a very long time of activity so I'm wondering what the actual incidence is.

I generally find it worth it for the simple risk that you may end up breaking stuff without anything malicious on behalf of the site.

E.g. cut and paste a command and get a linebreak in the wrong location and the "rm -rf /var/tmp/foo" turns into "rm -rf /var/". Fun times.

These days I'm more and more often just spinning up temporary containers as well. Not so much for security as to avoid making a mess of my environment with all the stuff I'm testing. So trivial to start out with a "docker run --rm -t -i ubuntu -v /some/suitable/host/dir:/mnt /bin/bash -l" or similar to get a fresh container with a directory I can dump anything I decide I want to keep in.

Re: Don't copy paste from a website to a terminal

#149

Post by meric »

ChuckMcM wrote: post #147
jacquesm wrote: post #79

So, ok. Don't copy and paste from a website to a terminal, I get it and I got it the last time that this kind of thing was posted. But if I look around I put so incredibly much trust in total strangers all the time that compared to say ordering a pizza (where the cook could put anything in the food they wanted), driving on the highway (where anybody could swerve any moment if they wanted) and simply walking down the…

Not sure you will anything more than anecdotal evidence but the propensity of people I've interviewed to go to a site like Stack Overflow and cut/paste "solutions" into their shell or terminal is sadly quite large. I much prefer people who can internalize the core knowledge of their craft over those who are living with all their technical knowlege currently swapped out to the web.

I could never quite get those tar flags right and often have to `man tar`.

Re: Don't copy paste from a website to a terminal

#150

Post by tgokh »

jonas21 wrote: post #120
ctdonath wrote: post #97

Earlier quoted context omitted.

Not sure whether this anecdote fits the thread well, but does address "don't copy and paste from a website to, well, anywhere without examining what you just pasted": I was administering a final exam to a programming class. Exam was done on class computers, so with me in the front of the room most of the time I couldn't actually see what everyone was doing (and given the nature of the class, if you cheated it probabl…

Does your school really have a "three strikes and you're out" policy for plagiarism? It seems like that would almost encourage cheating, up to the point where someone gets their second strike.

My school gives undergrads one warning before kicking you out for academic dishonesty. However, we've been repeatedly reminded that graduate students know better and we'll get kicked out for a first instance of plagarism
Post reply on HN