Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

"cat readme.txt" is not safe if you use iTerm2

blog.calif.io

Post reply on HN
Print view View original

171–180 of 197 posts

Re: "cat readme.txt" is not safe if you use iTerm2

#171

Post by yjftsjthsd-h »

em-bee wrote: post #90
yjftsjthsd-h wrote: post #73

Earlier quoted context omitted.

> how do you pipe data through multiple applications in one command using a GUI for example? nobody has been able to solve that in a practical way yet. How about Arcan? https://arcan-fe.com/2021/04/12/introducing-pipeworld/

that looks pretty good, except i want to be able to use the pipes on a remote machine, yet still have the output graphically represented locally.

I haven't read through the blog posts in a hot minute, but I would be astonished if arcan isn't network transparent enough to let you do exactly that.

Re: "cat readme.txt" is not safe if you use iTerm2

#172

Post by em-bee »

WesolyKubeczek wrote: post #127
em-bee wrote: post #68

Earlier quoted context omitted.

that's actually not what i am after. what i envision is a graphical terminal, that is a terminal that uses graphic elements to display the output. consider something like grep on multiple files. it should produce a list of lines found. the graphical terminal takes that list and displays it. it can distinguish the different components of that list, the filenames, the lines matched, the actual match, etc. because it ca…

We call those “web browsers” nowadays, they even can execute untrusted code to make your UI livelier…

you are not wrong. but browsers haven't been able to replace terminals yet. we would need a browser that an interface with the commandline.

incidentally ttyphoon is a terminal that uses a browser base gui framework. maybe there is that browser for the teminal...

Re: "cat readme.txt" is not safe if you use iTerm2

#173

Post by anamexis »

f30e3dfed1c9 wrote: post #170
anamexis wrote: post #163

Earlier quoted context omitted.

Wait, hold on. iTerm 2's "conductor" is listening for the special escape sequences, whether or not you are using the shell integration features. The exploit affects all users, not just ones who have installed iTerm 2's shell integration.

I can't tell whether that's true or not. The article says: > The rough model is: > 1. iTerm2 launches SSH integration, usually through it2ssh. > 2. iTerm2 sends a remote bootstrap script, the conductor, over the existing SSH session. > 3. That remote script becomes the protocol peer for iTerm2. How can I tell whether this "conductor" is running on the remote host or not? I tried to reproduce this problem, following t…

The remote bootstrap script is not part of the exploit at all. It happens in iTerm locally without any ssh session. I just installed iTerm2 on a fresh machine (no shell integration installed), ran the exploit (generated the file with the python script, ran `cat readme.txt` locally), and it worked.

This is explained in the article in the "The core bug" section.

Re: "cat readme.txt" is not safe if you use iTerm2

#174

Post by f30e3dfed1c9 »

anamexis wrote: post #173
f30e3dfed1c9 wrote: post #170

Earlier quoted context omitted.

I can't tell whether that's true or not. The article says: > The rough model is: > 1. iTerm2 launches SSH integration, usually through it2ssh. > 2. iTerm2 sends a remote bootstrap script, the conductor, over the existing SSH session. > 3. That remote script becomes the protocol peer for iTerm2. How can I tell whether this "conductor" is running on the remote host or not? I tried to reproduce this problem, following t…

The remote bootstrap script is not part of the exploit at all. It happens in iTerm locally without any ssh session. I just installed iTerm2 on a fresh machine (no shell integration installed), ran the exploit (generated the file with the python script, ran `cat readme.txt` locally), and it worked. This is explained in the article in the "The core bug" section.

Cannot get it to work. Not worrying about it any more. Still think that the original article is horribly written, now think that their instructions are also.

Re: "cat readme.txt" is not safe if you use iTerm2

#175

Post by collinfunk »

connorboyle wrote: post #63

If I were a GNU core utils maintainer, I would not be too happy with this post title

I am one of them. The title of the substack seems fine since it mentions "if you use iTerm2".

The tweet has no mention of iTerm2 which makes it sound like an issue in 'cat', which is mildly annoying [1].

[1] https://x.com/calif_io/status/2045207168677503241

Re: "cat readme.txt" is not safe if you use iTerm2

#176

Post by Joker_vD »

chromacity wrote: post #17

This is cool work, but it's also somewhat unsurprising: this is a recurring problem with fancy, richly-featured terminal apps. I think we had at least ten publicly reported vulns of this type in the past 15 years. We also had vulnerabilities in tools such as less, in text editors such as vim, etc. And notably, many of these are logic bugs - i.e., they are not alleviated by a rewrite to Rust. I don't know what to do w…

> this is a recurring problem with fancy, richly-featured terminal apps.

This is a recurring problem with fancy, richly-featured programmer-oriented apps made by programmers for programmers because for some reason most of the tool-writing programmers apparently just love to put "execute arbitrary code" functionality in there. Perhaps they think that the user will only execute the code they themselves wrote/approved and will never make mistakes or be tricked; or something like that, I dunno.

Re: "cat readme.txt" is not safe if you use iTerm2

#177

Post by em-bee »

skydhash wrote: post #148
em-bee wrote: post #68

Earlier quoted context omitted.

that's actually not what i am after. what i envision is a graphical terminal, that is a terminal that uses graphic elements to display the output. consider something like grep on multiple files. it should produce a list of lines found. the graphical terminal takes that list and displays it. it can distinguish the different components of that list, the filenames, the lines matched, the actual match, etc. because it ca…

Isn't that Emacs?

hmm, actually, you got a point there. emacs could be the like that graphical terminal, except for now it is still stuck inside a traditional terminal itself. even the GUI version of it is mostly just looking like a terminal, not really taking advantage of the potential of graphical elements. we would need a real GUI and support for exchanging structured data with external commands. for now emacs is still kind of its own world.

Re: "cat readme.txt" is not safe if you use iTerm2

#178

Post by skydhash »

em-bee wrote: post #177
skydhash wrote: post #148

Earlier quoted context omitted.

Isn't that Emacs?

hmm, actually, you got a point there. emacs could be the like that graphical terminal, except for now it is still stuck inside a traditional terminal itself. even the GUI version of it is mostly just looking like a terminal, not really taking advantage of the potential of graphical elements. we would need a real GUI and support for exchanging structured data with external commands. for now emacs is still kind of its…

> even the GUI version of it is mostly just looking like a terminal, not really taking advantage of the potential of graphical elements.

Emacs is text based (mostly), but customization happens through the the concept of Faces, not ansi escape codes. You can then embed properties in the text objects and have them react to click events. The only element missing is a 2D context that could be animated (if it's static, you can use SVG as Emacs can render it).

Re: "cat readme.txt" is not safe if you use iTerm2

#179

Post by m3047 »

skissane wrote: post #94
harrall wrote: post #32

Earlier quoted context omitted.

Well all these bugs (iTerm2’s, prompt injection, SQL injection, XSS) are one class of mistake — you sent out-of-band data in the same stream as the in-band data. If we can get that to raise a red flag with people (and agents), people won’t be trying to put control instructions alongside user content (without considering safeguards) as much.

This could be fixed with an extension to the kernel pty subsystem Allow a process to send control instructions out-of-band (e.g. via custom ioctls) and then allow the pty master to read them, maybe through some extension of packet mode (TIOCPKT) Actually, some of the BSDs already have this… TIOCUCNTL exists on FreeBSD and (I believe) macOS too. But as long as Linux doesn’t have it, few will ever use it Plus the FreeB…

Architecture Astronaut! TCP is a stream protocol. A terminal program is expected to honor the stream protocol: I can use a terminal program to speak SMTP or HTTP. I can paste binary shit into it and copy binary shit out of it (some caveats apply).

If you're gonna jack some control protocol into a session which is sitting directly on the stream protocol, that's on you. This is as airtight as injecting a control protocol into SMTP or HTTP. Encapsulate the entire protocol (obviously this requires presence on both ends), open a second channel (same), or go home. It's worth noting that the "protocol" drops a helper script on the other side; so theoretically it is possible for them to achieve encapsulation, but doing it properly might require additional permissions / access.

Obviously they published a fix, since that's how the exploit was reverse engineered. This is "...what happens when terminal output is able to impersonate one side of that feature's protocol."

Re: "cat readme.txt" is not safe if you use iTerm2

#180

Post by m3047 »

teddyh wrote: post #76

Many years ago, terminal emulators used to allow keyboard rebindings via escape codes. This is why it was then common knowledge to never “cat” untrusted files, and to use a program to display the files instead; either a pager, like “less”, or a text editor.

It some cases it was possible for the server to use escape sequences to "read back" parts of what the terminal displayed.
Post reply on HN