Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

"cat readme.txt" is not safe if you use iTerm2

blog.calif.io

Post reply on HN
Print view View original

41–50 of 197 posts

Re: "cat readme.txt" is not safe if you use iTerm2

#41

Post by bawolff »

KerrickStaley wrote: post #5

> At the time of writing, the fix has not yet reached stable releases. Why was this disclosed before the hole was patched in the stable release? It's only been 18 days since the bug was reported to upstream, which is much shorter than typical vulnerability disclosure deadlines. The upstream commit ( https://github.com/gnachman/iTerm2/commit/a9e745993c2e2cbb30... ) has way less information than this blog post, so I th…

Once the commit is public, the cat is out of the bag. Being coy about it only helps attackers and reduces everyone's security.

Re: "cat readme.txt" is not safe if you use iTerm2

#42

Post by em-bee »

ButlerianJihad wrote: post #38
em-bee wrote: post #37

Earlier quoted context omitted.

i think part of the problem is the archaic interface that is needed to enable feature rich terminal apps. what we really want is a modern terminal API that does not rely on in-band command sequences. that is we want terminals that can be programmed like a GUI, but still run in a simple (remote) terminal like before.

plan9 and 9term solved this decades ago, right? https://utcc.utoronto.ca/~cks/space/blog/sysadmin/OnTerminal...

seems they removed the dangers, but didn't provide an alternative to write safe terminal apps.

Re: "cat readme.txt" is not safe if you use iTerm2

#43

Post by DonHopkins »

I used to leave a file called README in my public ftp directory that just said:

README: no such file or directory

One glorious day somebody finally sent me email complaining that they could not read the README file. I advised them to use "emacs README" instead of using cat. I was sorely disappointed they never sent me back a thank you note for correctly suggesting that emacs was the solution to their problem. It was my finest moment in passive aggressive emacs evangelism.

Re: "cat readme.txt" is not safe if you use iTerm2

#44

Post by ammar2 »

harrall wrote: post #32
chromacity wrote: post #17

This is cool work, but it's also somewhat unsurprising: this is a recurring problem with fancy, richly-featured terminal apps. I think we had at least ten publicly reported vulns of this type in the past 15 years. We also had vulnerabilities in tools such as less, in text editors such as vim, etc. And notably, many of these are logic bugs - i.e., they are not alleviated by a rewrite to Rust. I don't know what to do w…

Well all these bugs (iTerm2’s, prompt injection, SQL injection, XSS) are one class of mistake — you sent out-of-band data in the same stream as the in-band data. If we can get that to raise a red flag with people (and agents), people won’t be trying to put control instructions alongside user content (without considering safeguards) as much.

> (and agents)

Ironically, agents have the exact same class of problem.

Re: "cat readme.txt" is not safe if you use iTerm2

#45

Post by rkagerer »

Maybe I'm being unfair here, but it sounds like your complicated system (involving bootstrap scripts, a remote conductor agent, and "hijacking" the terminal connection with special escape sequences for command communication) has a subtle bug. Can't say I'm surprised, complexity breeds this sort of thing, especially when using primitives in ways they weren't really intended to be used.

> iTerm2 accepts the SSH conductor protocol from terminal output that is not actually coming from a trusted, real conductor session. In other words, untrusted terminal output can impersonate the remote conductor.

If I understand correctly, if a textfile (or any other source of content being emitted to the screen, such as server response banners) contains the special codes iTerm2 and the remote conductor use to communicate, they'll be processed and acted upon without verifying they actually came from a trusted remove conductor. Please correct me if I'm mistaken.

Re: "cat readme.txt" is not safe if you use iTerm2

#46

Post by integralid »

lxgr wrote: post #21
saddist0 wrote: post #13

Earlier quoted context omitted.

It’s a wrong way to look at things. Just because CIA can know your location (if they want to), would you share live location to everyone on the internet? LLM is a tool, but people still need to know — what where how.

Not sure if that's a great example. If there's a catastrophic vulnerability in a widely used tool, I'd sure like to know about it even if the patch is taking some time! The problem with this is that the credible information "there's a bug in widely used tool x" will soon (if not already) be enough to trigger massive token expenditure of various others that will then also discover the bug, so this will often effective…

>there's a bug in widely used tool x"

There's a security bug in Openssh. I don't know what it is, but I can tell you with statistical certainty that it exists.

Go on and do with this information whatever you want.

Re: "cat readme.txt" is not safe if you use iTerm2

#47

Post by layoric »

ammar2 wrote: post #44
harrall wrote: post #32

Earlier quoted context omitted.

Well all these bugs (iTerm2’s, prompt injection, SQL injection, XSS) are one class of mistake — you sent out-of-band data in the same stream as the in-band data. If we can get that to raise a red flag with people (and agents), people won’t be trying to put control instructions alongside user content (without considering safeguards) as much.

> (and agents) Ironically, agents have the exact same class of problem.

+100 this. As devs we need to internalise this issue to avoid repeating the same class of exploits over and over again.

Re: "cat readme.txt" is not safe if you use iTerm2

#48

Post by rsync »

I’ve said this for as long as I’ve been here on hacker news…

I want the terminal to be as dumb as possible.

I don’t want it to have any understanding of what it is displaying or anscribe any meaning or significance to the character characters it is outputting.

The first time apples terminal.app displayed that little lock icon at the ssh password prompt?

The hairs on the back of your neck should have stood up.

Re: "cat readme.txt" is not safe if you use iTerm2

#49

Post by ori_b »

em-bee wrote: post #42
ButlerianJihad wrote: post #38

Earlier quoted context omitted.

plan9 and 9term solved this decades ago, right? https://utcc.utoronto.ca/~cks/space/blog/sysadmin/OnTerminal...

seems they removed the dangers, but didn't provide an alternative to write safe terminal apps.

Graphics. They're network transparent, and take over the terminal.

Terminal apps were obsolete once we had invented the pixel. Unix just provides no good way to write one that can be used remotely.

Re: "cat readme.txt" is not safe if you use iTerm2

#50

Post by jml7c5 »

WalterBright wrote: post #36

Back in the PDP-10 days, one communicated with it using a terminal attached to it. One of my fellow students discovered that if you hit backspace enough times, the terminal handler would keep erasing characters before the buffer. Go far enough, and then there was an escape character (Ctrl-u?) that would delete the whole line. Poof went the operating system!

That reminds me of "Real Life Tron on an Apple IIgs". There's something so charming about system memory being misinterpreted.

https://blog.danielwellman.com/2008/10/real-life-tron-on-an-...

Post reply on HN