thejh

A few terminals, despite having Bracketed Paste Mode, are vulnerable to escape injection. That's when the end-paste escape sequence is included in the paste content, and the terminal lets it pass through, causing the shell to think the paste ended. Urxvt is one such terminal with that vulnerability, but it can be fixed with a small perl extension, like the one I provided here: https://security.stackexchange.com/questions/39118/how-can-i-protect-m… That answer also includes a table checking other terminals for that vulnerability. The second example on the following page can be used to test a terminal for that variation of the attack: https://thejh.net/misc/website-terminal-copy-paste

https://github.com/thejh https://thejh.net/ https://twitter.com/tehjh

This sort of attack has been discussed in great detail previously: https://news.ycombinator.com/item?id=10554679 https://news.ycombinator.com/item?id=5508225 http://thejh.net/misc/website-terminal-copy-paste

One thing not addressed is that copy-pasting from the browser is insecure too: http://thejh.net/misc/website-terminal-copy-paste But this should be mitigated by TLS/finding a "trusted" source. A bigger issue might be that curl|bash effectively elevates trust in the developer, the CA, the hosting provider to the same level as trust in your distribution's security team. And while using SSL, wrapping the script in a function, practising safe posix shell, working acrosss many platforms is good - is it better than using something like https://0install.net ? I can understand not wanting to work with dozens of distributions; but if you don' tautomate tests across all of those - does your fantastic script really work? [Ed: it's also much easier to secure an off-line signing key than a TLS key that must be always on-line]

I'm curious if we ever will see the most popular JS/CSS frameworks/libraries integrated into the browser itself, and a simple attribute in the tag would allow loading the internal version, but still allow failover to the hosted one. This could even prevent man-in-the-middle attacks on scripts that otherwise would never expire anyway like described here: http://thejh.net/written-stuff/want-to-use-my-wifi

It is not really security theater if you consider all the other systems they have in place: the clearance process, auditing, etc. What I see is a use of RBAC that is not all that stupid, and that I happen to use on my own systems. RBAC is being used not to guard against abuse but to guard against mistakes. I use the SELinux sandbox to run my web browser, because it is easy to make a mistake like this: http://thejh.net/misc/website-terminal-copy-paste Ah, not so fast, the sandbox keeps that mistake from spreading all over my home directory. Now, the NSA has people who deal with important national security matters (or whatever), but they might make mistakes too. So the NSA uses RBAC to ensure that an analyst cannot accidentally copy and paste some intelligence secrets into a document that will be sent to people without clearance. Remember that the NSA does not just hire random people off the street; there is some amount of filtering meant to reduce the number of insider threats, but that process alone does not necessarily protect against honest mistakes (hence RBAC). It may also be the case that the NSA is not trying to guard against abuses by sysadmins, but by the tens of thousands of non-sysadmins they employ. In theory this is silly because it just means that your enemies will try to get their agents to work as sysadmins, but in practice it is likely to be a cost-effective solution that greatly reduces the number of people you need to worry about. Finally there…

I'm just used to aliasing cat to strings after working around a lot of red-team penetration testers. They would prank each other and me all the time. Had to also watch out for this one [1]. [1] - https://thejh.net/misc/website-terminal-copy-paste

Adding to the demo here is one using CSS [1] [1] - https://thejh.net/misc/website-terminal-copy-paste

The truncated part exists in the markup, it's simply being hidden with the help of some CSS. This same method is also used to trick people into executing nefarious shell commands of which an example can be seen here https://thejh.net/misc/website-terminal-copy-paste

It's also possible for you to copy things you can't see from web pages. So the command(s) you end up with may not be what you thought. So there's a trust issue with the site you get instructions from ass well. See http://thejh.net/misc/website-terminal-copy-paste

This can be done even without the clipboard API - See https://thejh.net/misc/website-terminal-copy-paste and further https://security.stackexchange.com/a/113630/96942

Just in case you weren't aware - be careful copy / pasting into terminal. https://thejh.net/misc/website-terminal-copy-paste

Some terminal emulators strip control codes (like \\n) from pastes for this reason. Alacrity and konsole do this, at least. Also, javascript isn't heeded for this vulnerability. https://thejh.net/misc/website-terminal-copy-paste is a link that demonstrates this with plain html, and has been discussed on HN before.

You don't need an API to do this. You can just use CSS. Try this example- https://thejh.net/misc/website-terminal-copy-paste

Disabling JS doesn't help in this case. This post shows that it is possible to put unwanted text in your c&p buffer without using JS: http://thejh.net/misc/website-terminal-copy-paste

Just a friendly reminder to everyone, don't copy and paste commands into the terminal. There could be invisible characters that can execute unwanted operations. Explanation/example: https://thejh.net/misc/website-terminal-copy-paste Previous HN discussions: https://news.ycombinator.com/item?id=10554679 and https://news.ycombinator.com/item?id=5508225

Q: "How do I recursively set ownership of folders in Linux?" A: http://thejh.net/misc/website-terminal-copy-paste

This is bizarre. Why not just give users link to the source? https://sorting.cr.yp.to/djbsort-20180710.tar.gz And it's certainly not about good security practices: * The page teaches users to paste stuff copied from web into a terminal, whereas many terminals are still vulnerable to this: https://thejh.net/misc/website-terminal-copy-paste * The page teaches users to use su to lower privileges, whereas many (most?) su implementations are vulnerable to tty hijacking.

Remember not to copy commands from web-pages into your terminal: http://thejh.net/misc/website-terminal-copy-paste

Why not to copy and paste: 1) what you paste might not be exactly what you copied. i.e: http://thejh.net/misc/website-terminal-copy-paste 2) possible licensing issues 3) it enables cargo cult programming

I feel like they should state this first before giving the command. I had to scroll down the page to see this warning. Anyway, if you decide to live on the edge.. don't copy-paste: http://thejh.net/misc/website-terminal-copy-paste

Found another one here: http://thejh.net/misc/website-terminal-copy-paste

Bracketed paste mode can still be broken by a malicious web-site: https://thejh.net/misc/website-terminal-copy-paste . Does this solution have the same vulnerability?

Yeah, let's download and blindly run stuff directly from the internet (that may have changed since we last saw it) without saving and trying to read what it does first. If you can copy/paste the curl | bash, is it really more difficult to copy/paste the original snippet into a text editor[0], and from there, into bash? [0] https://thejh.net/misc/website-terminal-copy-paste

C&P is not really more secure than curl as with some javascript you can easily mislead users as to what they're copying. Check https://thejh.net/misc/website-terminal-copy-paste and similar PoCs.

There's also the fact that it's easy to display something in the browser other than what is pasted into the terminal[1]. That said, if you say "just run apt-get install foo" people will just copy that instead of the curl command. 1: http://thejh.net/misc/website-terminal-copy-paste

Just copy/paste it from the internet. Nothing bad could possibly happen. [1] [1]: http://thejh.net/misc/website-terminal-copy-paste

That's not the only thing you have to trust. http://ariya.ofilabs.com/2016/05/nix-as-os-x-package-manager.html is served over HTTP. Saying "Copy and paste this `curl | sh` command" allows this attack: http://thejh.net/misc/website-terminal-copy-paste

Even if browsers didn't allow changing the clipboard, there's still this older problem: http://thejh.net/misc/website-terminal-copy-paste The solution is definitely to avoid pasting commands with newlines in them into your terminal. With Vim, you can use the + register to paste (e.g. "+p). Using iTerm on OS X, I've added a custom keymap for Cmd+V, bound to Run coprocess: pbpaste | tr -d "\n" which filters out the newlines.

Reminds me of why I also don't copy paste text from websites directly into my terminal. https://thejh.net/misc/website-terminal-copy-paste