Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Curl to shell isn't so bad

arp242.net

Post reply on HN
Print view View original

21–30 of 201 posts

Re: Curl to shell isn't so bad

#21

Post by LIV2 »

tonyedgecombe wrote: post #17
mkup wrote: post #16

If curl loses connection to the source website while downloading the script, then partially downloaded script will be executed, no matter what. This is a main drawback of curl-to-shell piping approach, and the original article is missing it entirely.

Is that really much of a problem? I can't remember the last time I had a download fail part the way through and they are usually much bigger than a bootstrapping script.

I mean it's unlikely but imagine it did happen and something in the script like "rm -rf /some/path" gets truncated to "rm -rf /" & immediately run

Even if your connection is TLS secured an MITM attack of causing a connection reset after X bytes could be a viable attack

Re: Curl to shell isn't so bad

#22

Post by Un1corn »

Carpetsmoker wrote: post #20
Un1corn wrote: post #13

Earlier quoted context omitted.

Pastejacking is not the only possible attack by a compromised server, you can also change the content of the script when the user download it through curl or wget. Oh My Zsh use GitHub for their script so I trust it more than if they hosted it themselves for example

If people have access to change the content of the script then they can also change foo-1.2.3-src.tar.gz or foo-1.2.3-linux-amd64.gz. These are all general problems with downloading anything from the internet.

Right but the attacker can make it look legit even for someone that look at the script. The attacker can change the content of the script by the user agent or even by detecting when you pipe it to bash[0]

[0] https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-b...

Re: Curl to shell isn't so bad

#23

Post by LIV2 »

scbrg wrote: post #18
mkup wrote: post #16

If curl loses connection to the source website while downloading the script, then partially downloaded script will be executed, no matter what. This is a main drawback of curl-to-shell piping approach, and the original article is missing it entirely.

No. It's addressed in the second last bullet, Partial content

Yeah "it will happen anyway" misses the point that curl will notify you of the failed download before you run it, whereas piping it to sh will immediately run it

Re: Curl to shell isn't so bad

#24

Post by hising »

paxy wrote: post #15

The average non-technical user is never going to open up the terminal and run commands. The well educated technical user is going to be vary of untrusted sites and various forms of attacks (which I'm assuming the author of this post falls under). IMO this is good advice for those that fall in the middle of these two categories, i.e. slightly technical people who run into problems and copy-paste solutions from Stack O…

> copy-paste solutions from Stack Overflow

On the other hand, a solution on SO that would be a hidden attack would not gain upvotes and be an alternative for the one seeking advice there.

Re: Curl to shell isn't so bad

#26

Post by astrobe_ »

Carpetsmoker wrote: post #14
lokedhs wrote: post #5

The points raised in the article are correct, and I'm much more concerned with the willingness of people to run arbitrary software on their primary computers in general, than the specific case of piping to sh. I think piping to sh just emphasises how insecure the entire practice is, and arguing against that is analogous to close your eyes to protect yourself from the attacking tiger. The only system I've worked with…

This article started life as a more general article about security and trust, but decided to post this particular part in its own article. There is a lot to be said about trust in software, but in general I agree that mitigations against untrusted software could be improved. The problem with this is that it's often hard to do this without affecting usability and, more importantly, in practical terms for a lot of peop…

Minor correction: it's "status quo" and I think it should be italicized.

Re: Curl to shell isn't so bad

#27

Post by glic3rinu »

mkup wrote: post #16

If curl loses connection to the source website while downloading the script, then partially downloaded script will be executed, no matter what. This is a main drawback of curl-to-shell piping approach, and the original article is missing it entirely.

A common solution is to wrap all code within a function. This way nothing gets executed until the last line, the one that calls the function, is executed.

  function main () {
     # all code goes here
  }
  main

Re: Curl to shell isn't so bad

#28

Post by avaloneon »

I'm surprised that no one has yet mentioned that piping curl to bash can be detected by the server (previous discussion at https://news.ycombinator.com/item?id=17636032). This allows an attacker to send different code if it's being piped to bash instead of saved to disk.

IMHO, "curl to shell" is uniquely dangerous, since all the other installation vectors mentioned don't support the bait-and-switch.

Re: Curl to shell isn't so bad

#29

Post by CoryG89 »

Carpetsmoker wrote: post #20
Un1corn wrote: post #13

Earlier quoted context omitted.

Pastejacking is not the only possible attack by a compromised server, you can also change the content of the script when the user download it through curl or wget. Oh My Zsh use GitHub for their script so I trust it more than if they hosted it themselves for example

If people have access to change the content of the script then they can also change foo-1.2.3-src.tar.gz or foo-1.2.3-linux-amd64.gz. These are all general problems with downloading anything from the internet.

The set of people who have access to the GitHub project (push privileges) might not be the same as the set of people who have access to said project's website.

Re: Curl to shell isn't so bad

#30

Post by sjy »

Has running a curl-to-bash command found during normal user-initiated web browsing ever resulted in a malware infection? Even anecdotal evidence would be valuable at this point.
Post reply on HN