Don't Copy-Paste from Website to Terminal • Hacker News Board

Re: Don't Copy-Paste from Website to Terminal

#121

Post by ProblemFactory » Sun, Apr 07, 2013, 9:19 PM UTC

jneen wrote: post #89

I mean, untarring a downloaded tarball from somewhere and running `make` is just as dangerous, right? Only there you can make sure the checksum matches, but people skip that step all the time.

Running code that you don't trust is a bad idea. But the point of the article is:

* When copying from the web, what you see on the page might not be what ends up in your clipboard,

* When pasting into a terminal, any text with endlines will execute immediately.

As a result, just pasting anything from the web into a terminal window might execute arbitrary code, without any further action on your part.

Re: Don't Copy-Paste from Website to Terminal

#122

Post by coldtea » Sun, Apr 07, 2013, 9:20 PM UTC

hollerith wrote: post #4

One of many examples by which making the web a better "application-delivery" platform makes it less secure, less reliable, less predictable and more tedious in its original role of sharing text, images and links.

>One of many examples by which making the web a better "application-delivery" platform makes it less secure, less reliable, less predictable and more tedious in its original role of sharing text, images and links.

Or, in other words, "examples by which making the web do something useful, makes it less reliable and predictable that just letting it stagnate at the original goal it has in 1991 that people don't really care about".

Re: Don't Copy-Paste from Website to Terminal

#123

Post by jakub_g » Sun, Apr 07, 2013, 9:21 PM UTC

joliss wrote: post #21

I suspect that the only way to effectively mitigate this is in the terminal application, by displaying a confirmation with the pasted text before accepting any multi-line[1] paste. For example here: https://code.google.com/p/iterm2/issues/detail?id=594 [1] There may be other dangerous characters besides newlines, e.g. escape sequences. I'm not sure if it's possible to make an exhaustive list for something like Bash.…

It's still possible to circumvent this by creating a one-liner using semicolons. Just grab a code like [2] and append `; rm -rf` to the selection. If the original selection was a one-liner, it'll still be.

[2] http://stackoverflow.com/a/4777746/

Re: Don't Copy-Paste from Website to Terminal

#124

Post by LogicX » Sun, Apr 07, 2013, 9:22 PM UTC

TheJH_ wrote: post #107

LogicX wrote: post #8

Pasted result is: git clone /dev/null; clear; echo -n "Hello ";whoami|tr -d '\n';echo -e '!\nThat was a bad idea. Don'"'"'t copy code from websites you don'"'"'t trust! Here'"'"'s the first line of your /etc/passwd: ';head -n1 /etc/passwd git clone git://git.kernel.org/pub/scm/utils/kup/kup.git

You might want to mark the newlines in that command... without those, the attack would be pretty boring.

fixed.

Re: Don't Copy-Paste from Website to Terminal

#125

Post by runn1ng » Sun, Apr 07, 2013, 9:25 PM UTC

jneen wrote: post #89

I mean, untarring a downloaded tarball from somewhere and running `make` is just as dangerous, right? Only there you can make sure the checksum matches, but people skip that step all the time.

You should basically compile everything yourself and read all the source code yourself if you want to be secure.

Good luck with that though. (Escpecially with things like, I don't know, browsers.)

Re: Don't Copy-Paste from Website to Terminal

#126

Post by shakesbeard » Sun, Apr 07, 2013, 9:25 PM UTC

gizmo686 wrote: post #35

comex wrote: post #31

Well... yeah, but even without hidden text, what are you going to do after you clone the repository? Probably `make` or `ruby something.rb` or any number of other commands that can run arbitrary code. If you don't trust someone, you shouldn't be trying to clone their git repo in the first place.

But the code I am copying is "git clone git://git.kernel.org/pub/scm/utils/kup/kup.git" I know what "git clone" does, and I do trust code from git.kernel.org.

But do you trust the website, email, or other source, where you copied the command? If someone can spoof this link on the official kernel website, they may as well have access to other, way more sensitive resources.

Re: Don't Copy-Paste from Website to Terminal

#127

Post by FooBarWidget » Sun, Apr 07, 2013, 9:26 PM UTC

Scaevolus wrote: post #119

FooBarWidget wrote: post #91

Earlier quoted context omitted.

There are legit criticisms against the copy-paste-curl-command style of installations. But on the other hand, I've yet to see a critic proposing a viable alternative. With viable I mean that said proposal must: 1. Work on all major platforms. 2. Be easy for the developer to create. 3. Be easy for the user to execute, with as few steps as possible. There are those who advocate that the developer should create a platfo…

The only difference between "wget | sh" and "download and run our installer" is that you could inspect the installer before running it. You can still do that, "wget | sh" just simplifies the process for most users.

You can also inspect the wgetted/curl'ed script if you so choose. It's just a URL. I don't understand your point.

Even with the "exploit" in the article, it will be detected as soon as the user pastes the URL in his browser location bar. People who don't inspect what they run are screwed no matter what.

Re: Don't Copy-Paste from Website to Terminal

#128

Post by hac » Sun, Apr 07, 2013, 9:28 PM UTC

nkvoll wrote: post #88

NelsonMinar wrote: post #51

Why would I bother copying and pasting the code to my clipboard when common industry practice now is just to invoke the output of curl directly? ruby -e "$(curl -fsSL https://raw.github.com/mxcl/homebrew/go )

Are you going to type that string into your terminal manually, or are you just copy/pasting that line from a web page, still leaving yourself open to this issue? I find it hard to believe anyone will be reading that line on a web page, then typing it out correctly in their own terminal instead of just saying, "ok that line looks fine copy paste "

I might copy the command, quickly paste it in my URL bar to make sure it is indeed what I expected, and then paste it into Terminal

Re: Don't Copy-Paste from Website to Terminal

#129

Post by 0xbadcafebee » Sun, Apr 07, 2013, 9:29 PM UTC

LukeShu wrote: post #102

somesay wrote: post #93

Earlier quoted context omitted.

Oh, nice, you are right, should be compiled against OS' key storage. Actually it's wget who often doesn't care of that.

Um, GNU wget does check the key, and it requires the lengthy `--no-check-certificate` to disable it. Perhaps busybox wget doesn't check the key? But if you're using busybox, that's a whole other can of worms.

Wget does not validate certificates by default because there's no CA bundle provided with wget. It does check for /etc/ssl/cert.pem, but it doesn't provide one. So you have to provide one or set up /etc/ssl/certs/ as OpenSSL libraries expect.

Curl does provide a CA bundle (/usr/share/curl/ca-bundle.crt) and by default libcurl validates certs against it.

Re: Don't Copy-Paste from Website to Terminal

#130

Post by charlieok » Sun, Apr 07, 2013, 9:30 PM UTC

NelsonMinar wrote: post #51

Why would I bother copying and pasting the code to my clipboard when common industry practice now is just to invoke the output of curl directly? ruby -e "$(curl -fsSL https://raw.github.com/mxcl/homebrew/go )

I dislike this whole trend. How about we start thinking in terms of leaving the user's default environment, and system, alone, and “installing” software into nice sandboxed areas where we can easily enable/disable it, or delete it with a simple “rm -rf directory/path”