Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

"cat readme.txt" is not safe if you use iTerm2

blog.calif.io

Post reply on HN
Print view View original

151–160 of 197 posts

Re: "cat readme.txt" is not safe if you use iTerm2

#151

Post by ptx »

Hmm. So the issue is, says the article, that:

> iTerm2 accepts the SSH conductor protocol from terminal output that is not actually coming from a trusted, real conductor session. In other words, untrusted terminal output can impersonate the remote conductor.

...which, the article strongly implies, but does not explicitly state, results in code execution on the local client machine.

But what about the case when it's working as designed, when the output does come from the remote conductor? It sounds like the server, where the conductor is running, is in that case trusted to execute arbitrary code on the client? Assuming the client doesn't use some sort of remote attestation, how can the remote conductor really be trusted?

Re: "cat readme.txt" is not safe if you use iTerm2

#152

Post by cryptbe »

dang wrote: post #77
nine_k wrote: post #64

The title is sensationalist; cat is fine. What is unsafe is iTerm's ssh integration, which is pretty obviously unsafe, because it includes a side control channel that is not cleanly separated from the the data stream. Don't use it, use normal ssh, and all should be fine.

Ok, we've put the article's let-me-walk-this-back qualifier in the title above. Thanks!

This is a good title, thanks! There was iTerm2 in the original title, but it overflowed to the subtitle in Substack.

I've now updated the blog post.

Re: "cat readme.txt" is not safe if you use iTerm2

#153

Post by f30e3dfed1c9 »

I think this article is horribly written. The second paragraph, in its entirety, reads:

> It turns out that it is NOT, if you use iTerm2.

And as far as I can tell, that is a vast overstatement. I think an actually true statement would be "It may not be, if you use iTerm2 and its optional 'Shell Integration' feature."

As far as I can tell, the "Shell Integration" feature under discussion is entirely optional and disabled by default. If it's not enabled, then there is no problem here. End of story.

Happy to be corrected if I'm wrong about this.

Re: "cat readme.txt" is not safe if you use iTerm2

#154

Post by jerf »

saddist0 wrote: post #13
ezoe wrote: post #12

Earlier quoted context omitted.

I guess traditional moratorium period for vulnerability publication is going to be fade away as we rely on AI to find it. If publicly accessible AI model with very cheap fee can find it, it's very natural to assume the attackers had found it already by the same method.

It’s a wrong way to look at things. Just because CIA can know your location (if they want to), would you share live location to everyone on the internet? LLM is a tool, but people still need to know — what where how.

You and I would need to know "what where how".

There are many attackers that are just going to feed every commit of every project of interest to them into their LLMs and tell it "determine if this is patching an exploit and if so write the exploit". They don't need targeting clues. They're already watching everything coming out of

Do not make the mistake of modeling the attackers as "some guy in a basement with a laptop who decided just today to start attacking things". There are nation-state attackers. There are other attackers less funded than that but who still may not particularly blink at the plan I described above. Putting out the commit was sufficient to tell them even today exactly what the exploit was and the cheaper AI time gets the less targeting info they're going to need as the just grab everything.

I suggest modeling the attackers like a Dark Google. Think of them as well-funded, with lots of resources, and this is their day job, with dedicated teams and specialized positions and a codebase for exploits that they've been working on for years. They're not just some guy who wants to find an exploit maybe and needs huge hints about what commit might be an issue.

Re: "cat readme.txt" is not safe if you use iTerm2

#155

Post by anamexis »

f30e3dfed1c9 wrote: post #153

I think this article is horribly written. The second paragraph, in its entirety, reads: > It turns out that it is NOT, if you use iTerm2. And as far as I can tell, that is a vast overstatement. I think an actually true statement would be "It may not be, if you use iTerm2 and its optional 'Shell Integration' feature." As far as I can tell, the "Shell Integration" feature under discussion is entirely optional and disab…

The entire article is "horribly written" based on that one overstatement?

Re: "cat readme.txt" is not safe if you use iTerm2

#156

Post by ncr100 »

JSR_FDED wrote: post #91
nostrademons wrote: post #30

Earlier quoted context omitted.

Makes me wonder if Claude Code has similar vulnerabilities, as it has a pretty rich terminal interface as well. I think the real solution is that you shouldn't try to bolt colors, animations, and other rich interactivity features onto a text-based terminal protocol. You should design it specifically as a GUI protocol to begin with, with everything carefully typed and with well-defined semantics, and avoid using hacks…

Spoofing the source of a string that controls colors and animations isn’t really a problem. Spoofing the source of a string that get executed is in an entirely different league.

Unless the colors meaningfully change the represented text/information eg hiding or highlighting key details leading to tactically dangerous misinterpretation.

Re: "cat readme.txt" is not safe if you use iTerm2

#157

Post by cryptbe »

f30e3dfed1c9 wrote: post #153

I think this article is horribly written. The second paragraph, in its entirety, reads: > It turns out that it is NOT, if you use iTerm2. And as far as I can tell, that is a vast overstatement. I think an actually true statement would be "It may not be, if you use iTerm2 and its optional 'Shell Integration' feature." As far as I can tell, the "Shell Integration" feature under discussion is entirely optional and disab…

The feature is enabled by default. You can test it by yourself.

Re: "cat readme.txt" is not safe if you use iTerm2

#158

Post by f30e3dfed1c9 »

anamexis wrote: post #155
f30e3dfed1c9 wrote: post #153

I think this article is horribly written. The second paragraph, in its entirety, reads: > It turns out that it is NOT, if you use iTerm2. And as far as I can tell, that is a vast overstatement. I think an actually true statement would be "It may not be, if you use iTerm2 and its optional 'Shell Integration' feature." As far as I can tell, the "Shell Integration" feature under discussion is entirely optional and disab…

The entire article is "horribly written" based on that one overstatement?

Pretty much, yes. It is meant to be the takeaway from the article and as far as I can tell, the statement as written is false. Pretty serious problem, I think.

Re: "cat readme.txt" is not safe if you use iTerm2

#159

Post by anamexis »

f30e3dfed1c9 wrote: post #158
anamexis wrote: post #155

Earlier quoted context omitted.

The entire article is "horribly written" based on that one overstatement?

Pretty much, yes. It is meant to be the takeaway from the article and as far as I can tell, the statement as written is false. Pretty serious problem, I think.

I would say iTerm 2 has a pretty serious problem. A detailed analysis of the issue having a sentence implying it affects all users rather than many or most users is a minor problem.

Re: "cat readme.txt" is not safe if you use iTerm2

#160

Post by f30e3dfed1c9 »

anamexis wrote: post #159
f30e3dfed1c9 wrote: post #158

Earlier quoted context omitted.

Pretty much, yes. It is meant to be the takeaway from the article and as far as I can tell, the statement as written is false. Pretty serious problem, I think.

I would say iTerm 2 has a pretty serious problem. A detailed analysis of the issue having a sentence implying it affects all users rather than many or most users is a minor problem.

I agree that the problem in iTerm2 is serious. I do not agree that having the takeway sentence in the article being false is a "minor problem."

I cannot speculate on what fraction of iTerm2 users enable this optional feature. Is it "many or most"? No idea.

I note that the article nowhere mentions the fact that the feature is optional. That would be a huge improvement.

We can disagree over whether the article is horribly written or not. My firm opinion is that it is.

Post reply on HN