131–140 of 146 posts
Earlier quoted context omitted.
Homebrew packages verify checksums, so very unlikely to be affected.
And where do the checksums come from?
Are there any good alternatives to Transmission on OS X?
RTorrent https://pmukhanov.wordpress.com/2014/01/19/installing-rtorre... Text console based, so it can run headless and/or in the background in a screen/tmux session.
Earlier quoted context omitted.
C&P is not really more secure than curl as with some javascript you can easily mislead users as to what they're copying. Check https://thejh.net/misc/website-terminal-copy-paste and similar PoCs.
Yeah, I keep stuff like that disabled for this reason, and because random sites like to add urls when you copy text. Just set dom.event.clipboardevents.enabled = false. Some shells also handle the paste and try to detect anything funny going on or at least let you review before you execute.
Your parent's link's trickery is to do not with JavaScript (it just uses raw HTML), so this would not mitigate that attack:
git clone
/dev/null; clear; echo -n "Hello ";whoami|tr -d '\n';echo -e '!\nThat was a bad idea. Don'"'"'t copy code from websites you don'"'"'t trust!
Here'"'"'s the first line of your /etc/passwd: ';head -n1 /etc/passwd
git clone
git://git.kernel.org/pub/scm/utils/kup/kup.git
The link also mentions that bracketed paste mode does not prevent this attack:
> Please note that _Bracketed Paste Mode DOES NOT always fix this_ because the end sequence can be inside the text you paste unless your terminal emulator filters out the bracketed paste characters when pasting!
Earlier quoted context omitted.
And to run it from the clipboard: pbpaste | sh -
Why not this? curl https://gist.githubusercontent.com/kaizensoze/ca96d039b295db220951d42ca7c83d89/raw/ | bash
Earlier quoted context omitted.
Seemed pretty likely though don't you think?
I guess any security tools and scripts are bound to be used for naughty stuff at some point, but I thought "real" malware writers would put more effort (at least obfuscation) into their products. Keychaindump is a crude hacky PoC, and I honestly didn't expect it to get directly copy-pasted into "serious" malware.
Luckily, it was only the CLI version, which I was putting on an Ubuntu system...
Earlier quoted context omitted.
FYI: Transmission binaries are now hosted on GitHub, so it is very unlikely that anything like this can happen in the future without compromising developer machines.
Question is, how implausible do we think it is that a developer's computer gets compromised?