Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

"cat readme.txt" is not safe if you use iTerm2

blog.calif.io

Post reply on HN
Print view View original

161–170 of 197 posts

Re: "cat readme.txt" is not safe if you use iTerm2

#161

Post by jcgl »

em-bee wrote: post #68
kps wrote: post #62

Earlier quoted context omitted.

A network-transparent graphics protocol? Who would ever think of such a thing?

that's actually not what i am after. what i envision is a graphical terminal, that is a terminal that uses graphic elements to display the output. consider something like grep on multiple files. it should produce a list of lines found. the graphical terminal takes that list and displays it. it can distinguish the different components of that list, the filenames, the lines matched, the actual match, etc. because it ca…

That'd be really cool. I'd never thought about enabling deeper graphical capabilities in a shell. But if you were to have a shell with rich objects rather than dumb bytes, that is a world that would open up!

PowerShell, for instance, has Format.ps1xml[0] that allows you to configure how objects get displayed by default (i.e. when that object gets emitted at the end of the pipeline). Such a concept could in principle be extended to have graphical elements. How cool would it be to have grep's output let you collapse matches from the same file!

[0] https://learn.microsoft.com/en-us/powershell/module/microsof...

Re: "cat readme.txt" is not safe if you use iTerm2

#162

Post by hmokiguess »

gnachman wrote: post #115

iTerm2 author here. This could be used as a link in an exploit chain but by itself the claim in the title is massively overblown. I’m on a family vacation but I’ll release a fix when I get back.

Thank you for iTerm2, I appreciate your response here, enjoy your vacation!

Re: "cat readme.txt" is not safe if you use iTerm2

#163

Post by anamexis »

f30e3dfed1c9 wrote: post #160
anamexis wrote: post #159

Earlier quoted context omitted.

I would say iTerm 2 has a pretty serious problem. A detailed analysis of the issue having a sentence implying it affects all users rather than many or most users is a minor problem.

I agree that the problem in iTerm2 is serious. I do not agree that having the takeway sentence in the article being false is a "minor problem." I cannot speculate on what fraction of iTerm2 users enable this optional feature. Is it "many or most"? No idea. I note that the article nowhere mentions the fact that the feature is optional. That would be a huge improvement. We can disagree over whether the article is horri…

Wait, hold on. iTerm 2's "conductor" is listening for the special escape sequences, whether or not you are using the shell integration features. The exploit affects all users, not just ones who have installed iTerm 2's shell integration.

Re: "cat readme.txt" is not safe if you use iTerm2

#164

Post by f30e3dfed1c9 »

cryptbe wrote: post #157
f30e3dfed1c9 wrote: post #153

I think this article is horribly written. The second paragraph, in its entirety, reads: > It turns out that it is NOT, if you use iTerm2. And as far as I can tell, that is a vast overstatement. I think an actually true statement would be "It may not be, if you use iTerm2 and its optional 'Shell Integration' feature." As far as I can tell, the "Shell Integration" feature under discussion is entirely optional and disab…

The feature is enabled by default. You can test it by yourself.

Thank you. If correct, that is helpful. I only checked my own copy and as far as I can tell, the feature is disabled. It may well be that I disabled it, I don't remember. Seems like the kind of thing I would disable if I noticed it but iTerm2 has so many features and so many settings that I have no idea whether I ever noticed it before this.

I note that the documentation says this:

> Shell Integration

> iTerm2 may be integrated with the unix shell so that [blah blah blah]

> How To Enable Shell Integration

> [blah blah blah]

And that does not make it sound as if it's enabled by default. I really don't know. I only started using iTerm2 about three or four weeks ago.

Re: "cat readme.txt" is not safe if you use iTerm2

#165

Post by coldtea »

jerf wrote: post #154
saddist0 wrote: post #13

Earlier quoted context omitted.

It’s a wrong way to look at things. Just because CIA can know your location (if they want to), would you share live location to everyone on the internet? LLM is a tool, but people still need to know — what where how.

You and I would need to know "what where how". There are many attackers that are just going to feed every commit of every project of interest to them into their LLMs and tell it "determine if this is patching an exploit and if so write the exploit". They don't need targeting clues. They're already watching everything coming out of Do not make the mistake of modeling the attackers as "some guy in a basement with a lap…

>Do not make the mistake of modeling the attackers as "some guy in a basement with a laptop who decided just today to start attacking things". There are nation-state attackers.

The parent's point is that if those capable attackers can exploit it anyway, doesn't mean it should be given on a silver platter to any script kiddie and guy in some basement with a laptop. The first have a much smaller target group than the latter.

Re: "cat readme.txt" is not safe if you use iTerm2

#166

Post by staticassertion »

cryptbe wrote: post #149
KerrickStaley wrote: post #5

> At the time of writing, the fix has not yet reached stable releases. Why was this disclosed before the hole was patched in the stable release? It's only been 18 days since the bug was reported to upstream, which is much shorter than typical vulnerability disclosure deadlines. The upstream commit ( https://github.com/gnachman/iTerm2/commit/a9e745993c2e2cbb30... ) has way less information than this blog post, so I th…

Disclosure: I didn't discover the vulnerability. I wrote the blog post. >The author was able to develop an exploit by prompting an LLM with just the upstream commit Yes, I was able to do this. I believe anyone watching iTerm2's commits would be able to do this too. >but I still think this blog post raises the visibility of the vulnerability. Yes, I wanted to raise the visibility of the vulnerability, and it works! Th…

> The author of iTerm2 initially didn’t consider it severe enough to warrant an immediate release, but they now seem to have reconsidered.

It's funny that we still have the same conversation about disclosure timelines. 18 days is plenty of time, the commit log is out there, etc.

The whole "responsible disclosure" thing is in response to people just publishing 0days, which itself was a response to vendors threatening researchers when vulns were directly reported.

Re: "cat readme.txt" is not safe if you use iTerm2

#167

Post by staticassertion »

coldtea wrote: post #165
jerf wrote: post #154

Earlier quoted context omitted.

You and I would need to know "what where how". There are many attackers that are just going to feed every commit of every project of interest to them into their LLMs and tell it "determine if this is patching an exploit and if so write the exploit". They don't need targeting clues. They're already watching everything coming out of Do not make the mistake of modeling the attackers as "some guy in a basement with a lap…

> Do not make the mistake of modeling the attackers as "some guy in a basement with a laptop who decided just today to start attacking things". There are nation-state attackers. The parent's point is that if those capable attackers can exploit it anyway, doesn't mean it should be given on a silver platter to any script kiddie and guy in some basement with a laptop. The first have a much smaller target group than the…

This ignores that by publicly releasing the patch is motivated.

Re: "cat readme.txt" is not safe if you use iTerm2

#168

Post by em-bee »

boomlinde wrote: post #99
em-bee wrote: post #69

Earlier quoted context omitted.

X11 or any network transparent graphics protocol doesn't solve the problems that a terminal solves. how do you pipe data through multiple applications in one command using a GUI for example? nobody has been able to solve that in a practical way yet. what we really want is being able to pipe semantic data that can be output to some kind of graphical device/interface that uses that semantic information to display the d…

> X11 or any network transparent graphics protocol doesn't solve the problems that a terminal solves. how do you pipe data through multiple applications in one command using a GUI for example? nobody has been able to solve that in a practical way yet. It seems to me that you are conflating the role of the terminal with the role of the shell. The terminal accepts streams of text and commands to instruct the terminal,…

i am not conflating them, the problem is rather that the current terminals define or restrict what the shell can do. shells are being rewritten already. b they could not do what i want them to do without the terminals changing too, so the terminal needs to be next.

Re: "cat readme.txt" is not safe if you use iTerm2

#169

Post by em-bee »

red_admiral wrote: post #102
em-bee wrote: post #37

Earlier quoted context omitted.

i think part of the problem is the archaic interface that is needed to enable feature rich terminal apps. what we really want is a modern terminal API that does not rely on in-band command sequences. that is we want terminals that can be programmed like a GUI, but still run in a simple (remote) terminal like before.

I shudder at the amount of backwards compatibility that would break. Is there anything more complicated than a simple input-output pipe (cat, grep, ...) that doesn't use terminal escapes? Even `ls --color` needs them!

right, envision that we get tmux working in that new terminal (and that's already happening, just look at tmux -CC), then it can be there for all the backwards compatibility stuff while modern apps and maybe a new modern multiplexer work without.

Re: "cat readme.txt" is not safe if you use iTerm2

#170

Post by f30e3dfed1c9 »

anamexis wrote: post #163
f30e3dfed1c9 wrote: post #160

Earlier quoted context omitted.

I agree that the problem in iTerm2 is serious. I do not agree that having the takeway sentence in the article being false is a "minor problem." I cannot speculate on what fraction of iTerm2 users enable this optional feature. Is it "many or most"? No idea. I note that the article nowhere mentions the fact that the feature is optional. That would be a huge improvement. We can disagree over whether the article is horri…

Wait, hold on. iTerm 2's "conductor" is listening for the special escape sequences, whether or not you are using the shell integration features. The exploit affects all users, not just ones who have installed iTerm 2's shell integration.

I can't tell whether that's true or not. The article says:

> The rough model is:

> 1. iTerm2 launches SSH integration, usually through it2ssh.

> 2. iTerm2 sends a remote bootstrap script, the conductor, over the existing SSH session.

> 3. That remote script becomes the protocol peer for iTerm2.

How can I tell whether this "conductor" is running on the remote host or not?

I tried to reproduce this problem, following their instructions, but was unable to. I think but am not sure that's because my environment is pretty much nothing like one that would allow this to work.

For example, whether it's the default or not, my iTerm2 just doesn't have shell integration enabled. With my profile "Command:" set to "Login Shell," it doesn't look like I could enable it if I wanted to: "Load shell integration automatically" is disabled, apparently because "Automatic loading doesn't work with ksh."

Post reply on HN