Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

No one expects command execution

0x90909090.blogspot.com

Post reply on HN
Print view View original

81–88 of 88 posts

Re: No one expects command execution

#81

Post by jjoonathan »

d23 wrote: post #73
jjoonathan wrote: post #72

Earlier quoted context omitted.

Not the point. Of course it's not surprising that these utilities will execute scripts if you tell them to. The unexpected fact is that you can tell them to -- and that this is documented behavior which probably isn't going away. If your argument was that no programmer should be surprised that you can tell an archive utility to execute an arbitrary script, then you and the author of the post are in complete agreement…

> you merely hurl an implicit insult at anyone who hasn't seen this type of privilege escalation yet You and I have vastly different opinions on what constitutes privilege escalation.

I'm not a security researcher. Care to recommend a more appropriate term for the data -> execution stage as opposed to the user -> root stage which is more commonly associated with the term "privilege escalation"?

Re: No one expects command execution

#82

Post by ajkjk »

jcape wrote: post #79
ajkjk wrote: post #52

Earlier quoted context omitted.

Did this article make you angry? Why do you call it a trainwreck?

Because it is treating all of these intended side-effects of using a shell as though they are security vulnerabilities. The problem is that there is a way for untrusted user input to ever touch a shell in the first place. Seriously, I challenge you to find a language reference that doesn't decry the use of their version of system(3)---because all that does is run the given command under the user's shell.

Sure, fine, but why the anger? Why the 'trainwreck'? that's not constructive at all. The article definitely didn't claim these were security vulnerabilities - only that they were surprising. Some of these were surprising to me too. Am I an idiot for not knowing these? (no, I'm not, I'm just a novice).

It's really aggravating to learn something from an article that is making someone more knowledgeable this angry without explanation.

Re: No one expects command execution

#83

Post by qnaal »

WalterBright wrote: post #18

What I find interesting is the thread title being a pun from a 40 year old movie. Back in the 70s, there wasn't any interest in movies, music, etc. from the 30s. And there still isn't interest in 30s culture, but plenty in the 70s. I wonder why.

> 40 year old movie

spanish inquisition was flying circus, not holy grail

but my theory is that the vcr, and now the internet, has a lot to do with it, just like you'd expect references to books to increase with the printing press and general increase of literacy

Re: No one expects command execution

#84

Post by digi_owl »

im3w1l wrote: post #57
digi_owl wrote: post #40

Earlier quoted context omitted.

Welcome to life.

What you are, rudely, implying is that what I am saying is already well known. I'd argue that isn't so. Until recently shell-scripts was the way you inited a system. I still have almost 2000 shell scripts on my machine that I didn't write myself. People got owned during shellshock, which means they did run helper programs, in web-facing applications even.

No, life is stuffed full of hidden complexities.

Complexities that are ready to bite the hand of the unwary at the slightest of chances.

Honesty i think the biggest lie in modern times is the MS/Apple lie that computing can be made so simple that even the proverbial aunt Tillie can do it without reading any sort of manual.

Re: No one expects command execution

#85

Post by Gibbon1 »

jacquesm wrote: post #68
Gibbon1 wrote: post #63

Earlier quoted context omitted.

What I wish, I wish there was a flag in unicode to declare characters as 'unsafe user input' so that system utilizes and databases can recognize unsafe user input and barf on it.

It would be a very rare case where a vulnerability related to in-band signalling can be fixed with more in-band signalling.

You can if your encoding is explicit about what's in band and out of band. I get the feeling you've never written a protocol ever.

Re: No one expects command execution

#86

Post by jacquesm »

Gibbon1 wrote: post #85
jacquesm wrote: post #68

Earlier quoted context omitted.

It would be a very rare case where a vulnerability related to in-band signalling can be fixed with more in-band signalling.

You can if your encoding is explicit about what's in band and out of band. I get the feeling you've never written a protocol ever.

I don't think you even understand the concept of in-band and out-of-band, that's not a function of the encoding. And I've written protocols aplenty in the days when not everything ran on top of HTTP, high speed serial links, with and without virtual circuits (so mux-demux) and a whole slew of others.

Just to make sure you are on the same page as the rest of us here: in-band and out-of-band is a way to distinguish sending meta information about the data stream through the same channel as the original data. You need an escape mechanism for that, so control characters and such.

Out-of-band signalling indicates that all meta information about the data stream travels through a different (virtual) circuit, in which case there can never be confusion about whether a given chunk is data or meta info.

Re: No one expects command execution

#88

Post by Gibbon1 »

jacquesm wrote: post #86
Gibbon1 wrote: post #85

Earlier quoted context omitted.

You can if your encoding is explicit about what's in band and out of band. I get the feeling you've never written a protocol ever.

I don't think you even understand the concept of in-band and out-of-band, that's not a function of the encoding. And I've written protocols aplenty in the days when not everything ran on top of HTTP, high speed serial links, with and without virtual circuits (so mux-demux) and a whole slew of others. Just to make sure you are on the same page as the rest of us here: in-band and out-of-band is a way to distinguish sen…

I now understand that your point here is to be insulting.
Post reply on HN