Hacking with LaTeX
0day.work
Hacking with LaTeX
1–10 of 41 posts
Re: Hacking with LaTeX
#2Quite helpful article got to know many useful information
Re: Hacking with LaTeX
#3> That's because Latex is turing complete and that means...
The article is of course interesting, but it's really annoying to read claims that Turing completeness has anything to do with security. The danger comes from interaction with the external environment, not whether or not the language is Turing complete. If HTML had a "\write" equivalent, it would be just as dangerous. Conversely, the script,
\newwrite\outfile
\openout\outfile=cmd.tex
\write\outfile{\imm\diate\wwrite\args}
\write\outfile{\inp\iput\cmd}
\closeout\outfile
Re: Hacking with LaTeX
#4It should be noted that shell escape is disabled by default in standard installations and the -shell-escape flag must be explicitly passed during compilation to enable it.
So if someone is knowledgeable enough to add this flag I would assume that they know what they are doing, such as the guys cited in the article who create an isolated Docker container for each compilation cycle [note: very nice use of Docker!].
Re: Hacking with LaTeX
#5> That's because Latex is turing complete and that means... The article is of course interesting, but it's really annoying to read claims that Turing completeness has anything to do with security. The danger comes from interaction with the external environment, not whether or not the language is Turing complete. If HTML had a "\write" equivalent, it would be just as dangerous. Conversely, the script, \newwrite\outfil…
Well, take things that way: if your language is not Turing-complete, you could lock things down so that no crazy stuff happens, and prove that there is no way to bypass the security --assuming this problem is decidable, which can be the case if the language is not Turin-complete, but is hopeless otherwise.
So it's a bit like saying "well, both are dogs so both can bite", when one is well-trained and leashed, and the other is loose and raging.
Re: Hacking with LaTeX
#6combining that with a docker container breakout would be interesting
https://news.ycombinator.com/item?id=7909622 (Docker container breakout?)
Re: Hacking with LaTeX
#7> That's because Latex is turing complete and that means... The article is of course interesting, but it's really annoying to read claims that Turing completeness has anything to do with security. The danger comes from interaction with the external environment, not whether or not the language is Turing complete. If HTML had a "\write" equivalent, it would be just as dangerous. Conversely, the script, \newwrite\outfil…
Well, take things that way: if your language is not Turing-complete, you could lock things down so that no crazy stuff happens, and prove that there is no way to bypass the security --assuming this problem is decidable, which can be the case if the language is not Turin-complete, but is hopeless otherwise. So it's a bit like saying "well, both are dogs so both can bite", when one is well-trained and leashed, and the…
Can you give an example of how the halting problem allows one to make it impossible/difficult to detect malicious code?
I sort of get what you are saying, that Turing completeness makes analysis more difficult, but I still don't see what it has to do with security.
Re: Hacking with LaTeX
#8Earlier quoted context omitted.
Well, take things that way: if your language is not Turing-complete, you could lock things down so that no crazy stuff happens, and prove that there is no way to bypass the security --assuming this problem is decidable, which can be the case if the language is not Turin-complete, but is hopeless otherwise. So it's a bit like saying "well, both are dogs so both can bite", when one is well-trained and leashed, and the…
Can you give an example of how the halting problem allows one to make it impossible/difficult to detect malicious code? I sort of get what you are saying, that Turing completeness makes analysis more difficult, but I still don't see what it has to do with security.
Well, if you can somehow inject arbitrary code, then you can inject an infinite loop. So a program will only halt on all inputs if you can not inject an infinite loop.
Re: Hacking with LaTeX
#9Earlier quoted context omitted.
Well, take things that way: if your language is not Turing-complete, you could lock things down so that no crazy stuff happens, and prove that there is no way to bypass the security --assuming this problem is decidable, which can be the case if the language is not Turin-complete, but is hopeless otherwise. So it's a bit like saying "well, both are dogs so both can bite", when one is well-trained and leashed, and the…
Can you give an example of how the halting problem allows one to make it impossible/difficult to detect malicious code? I sort of get what you are saying, that Turing completeness makes analysis more difficult, but I still don't see what it has to do with security.
The halting problem makes it impossible to consistently answer the question "Will this instruction be executed ?"
This is why you can't know if the code is malicious : you can't (always) infer meaningful properties about the code (Will it write something on the disk ?...).
Re: Hacking with LaTeX
#10> That's because Latex is turing complete and that means... The article is of course interesting, but it's really annoying to read claims that Turing completeness has anything to do with security. The danger comes from interaction with the external environment, not whether or not the language is Turing complete. If HTML had a "\write" equivalent, it would be just as dangerous. Conversely, the script, \newwrite\outfil…
> \newwrite\outfile
> \openout\outfile=cmd.tex
> \write\outfile{\imm\diate\wwrite\args}
> \write\outfile{\inp\iput\cmd}
> \closeout\outfile
Though a longtime TeXer, I've never used the output facilities very much, so it's probably my fault; but I can't understand what this does (hence what it illustrates), and some things seem like typos. For example, shouldn't `\imm\diate`, `\wwrite`, and `\iput` be `\immediate`, `\write`, and `\input`? (I don't know about `\inp`.) What does this do?