I Don't Play Darts

> This is no worse than if you were to have totally-not-evil.example.com give you the bash script on a floppy disk or something. In practice, perhaps. But detecting whether the file is being piped to bash (and not cat/less/grep/etc) is pretty straightforward. https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server… https://code.moparisthebest.com/moparisthebest/curl_bash

Note that even checking the URL first doesn't help as there is a way to detect whether the output is being piped into Bash: https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server… The proper way to tell is to save the output to a file, analyze it, and then run that file with Bash. However, I would recommend against running these for other reasons and instead prefer using the distribution's packages or the manual installation instructions which you can understand and tweak to better fit your system.

No, I'm sorry, I seriously don't understand how that applies in this case. How is "trusting the content you get from `apt-get`/`dpkg`/`pacman`" safer than curling-to-bash? In both cases, you are downloading and installing content from a trusted source (assuming you are curling via https to avoid MITMs). In the curl-to-bash case, you have the _ability_ to at least inspect the code first before you install it (though, realistically, how many folks would really have the dedication and the ability to do so?), whereas with package managers you're installing "blind". Doesn't that make curling-to-bash the _safer_ option? I clearly must be missing something, here, because everyone decries "curling-to-bash" as a bad security practice, but I haven't seen an explanation of _why_. I tried doing some research for myself - this page[1] suggests that package managers have built-in checksumming and signature verification, but then goes on to propose an attack vector where the load balancer is compromised, so (presumably?) those same checksums/signatures could also be intercepted and faked. This gist[2] has a lot of people speaking against it, but from following those links, the only downside I could see was here[3], pointing out that the shell will keep executing if a connection closes mid-stream - which, yes, is certainly a bad thing and a good argument to use package managers, but not what I would call a security concern (unless you don't trust the entity on the other end of the stream -…

There definitely is a difference. See [1] (or [2] since the original site has misconfigured TLS). Long story short, using some fairly trivial heuristics, a malicious server could change its response when it detects its output being piped to a shell rather than saved to a file. Thus, a security-minded person downloading the file (who could inspect it) would be given a clean copy, but someone less security-minded piping it straight to bash would be given the malicious copy. The security-minded person wouldn't be able to warn people not to pipe the script to a shell, since it appears safe. [1] https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server… [2] https://web.archive.org/web/20240228190305/https://www.idontplaydarts.…

It's been demonstrated that the server can tell if the client is piping or not https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server… I'm on mobile and this refuses to load due to SSL/HSTS problems. It's an interesting approach if you can get it to load. Point being... someone clever could make a bad day for the minority of users who do check first (but don't save/run what they explicitly checked) Running curl, saying "yup that looks good", then adding a pipe achieves little with actual malice. The payload can be completely hidden until it's too late The phrasing you use is important for any hope at safety - review/run the same downloaded thing.

Basically, bash executes the script line by line as it is downloading - pausing the download while that line executes. By sending a sleep() command early in the script you can detect the delay in the next line beind downloaded. Its a lot more complicated due to TCP buffers and trying to hide output from the user. Original article below. It is giving me a certificate error though but its available through archives or a cache. https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server…

That's really sketchy. https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server…

You're trusting somebody to run random stuff on your machine and you're trusting them to not do something like this: https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server…

Actually no, one can detect curl-piping server-side and serve hostile blobs only to those foolish enough to do so: https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server…

I post this every time this topic comes up. Piping from the internet into your shell is a bad idea. https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server…

There are known attacks that can detect if your curling into bash vs. just curling/downloading which can change the script being delivered[1]. So yeah read it all you want, just don't curl it and pipe it to bash. 1. https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server…

You can even get more devious and use timing differences to serve one thing to `curl` and a different thing to `curl | bash`: https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server…

someone demonstrated a while back how based on user agent you could serve innocuous code for a browser checking the code first, and then a different malicious payload for curl. thanks to dementiapatien below for the link https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server…

Techniques like this could make curl|bash more prone to malicious activity: https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server…

And then we get to what I was trying to state in my original post. I don't have a strong opinion that it's good or bad practice, I just thought it was a clever thing to do about it. Edit: I think I was thinking of https://news.ycombinator.com/item?id=17636032 / https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server… Wow, it's been a while.

It’s worse than that. You can verify `curl <url>` and still get pwned, because it’s possible to detect if you pipe it into anything[1]. [1] https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server…

https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server… Discussed on HN: 2020: https://news.ycombinator.com/item?id=25356757 (133 comments) 2018: https://news.ycombinator.com/item?id=17636032 (146 comments) 2016: https://news.ycombinator.com/item?id=11532599 (122 comments)

You didn't even take a look at https://get.docker.io It's still downloading and executing a script, just two steps instead of piping the output straight into bash. You can't even inspect the code you run when you do curl|bash and the server is able to detect this distinction and hide code when you do a curl and then run bash. https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server… Your argument is: "we do it and we use GitHub, you can trust us and can trust GitHub, you don't need to verify the code you run." And devs learn: "Trust me, you don't need to verify the code you run."

If you are slightly more paranoid, keep in mind that the file you downloaded for manual inspection may not be the file you download automatically for bash-piping. This article from 2016 was making the rounds on HN about three years ago: https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server… Of course for a properly, professionally paranoid person, you would download every component manually and store the received artifacts locally (for caching, reproducibility, TOFU principle and general BCP needs). Then build from those only. In fact, in high-trust environments it's common for CI systems to not be able to hit internet at all.

binary packages, maybe through github releases. debian packages, potentially upstreamed into the package repos (though that's some effort). It's quite presumptive to presume to know how a target system is to be configured. no matter which alternative, curl|bash is security risk enough to never use: https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server… gpg can help (below from zerotier): curl -s 'https://raw.githubusercontent.com/zerotier/ZeroTierOne/master/doc/cont… | gpg --import && \ if z=$(curl -s 'https://install.zerotier.com/' | gpg); then echo "$z" | sudo bash; fi

Perhaps… [1]. [1]: https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server…

pyenv could get taken over and you won't know. It's also possible to detect when someone is piping to bash (on the server) and serve a different payload [0]. You're better off piping curl to a file, reviewing the file and then running it manually. [0]: https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server…

It's not just that, i.e. you may be fooled if you read the script "in the wrong way". https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server…

But how can you be sure that the content you get in a browser is the same content that you get with curl? Serving different content based on the user agent header or similar is not exactly difficult. And there are even [sneakier ways](https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server… to identify if you're curling into bash.

Related: Detecting the use of "curl | bash" server side https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server… You can make it so that the server returns benevolent looking code when auditing it with just "curl URL", but return malware when curl is directly piped to bash.

Fair point on the future direction. SE says it better than me: https://security.stackexchange.com/questions/213401/is-curl-something-… Particularly the first link, which outlines how to return different things depending on whether it's being piped into bash or not: https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server…

To expand on this, it is possible to tell apart the redirection to file and pipe to shell. https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server…

No, it has been demonstrated that servers can detect whether a request is being downloaded or piped to a shell, so they can vary the response accordingly, sending safe-looking content to a user who's inspecting it, and sending malicious content to a shell. https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server… `curl | sh` is a terrible anti-pattern. It should never be encouraged.

You can only be sure of what you're running if you download it first, examine it, then run what you downloaded. https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server…