News for hackers. Stuff that matters.

A comment on Curl to shell isn't so bad. Parent comment

Re:Curl to shell isn't so bad by vbezhenar on Saturday November 09, 2019 @02:04PM (#21493538)
Is it undetectable? `curl | tee file | bash` should detect IMO.
[ Parent | on HN ]
Re:Curl to shell isn't so bad by tln on Saturday November 09, 2019 @03:42PM (#21494220)
True, you can detect it without a way to stop the damage! Or easier and more thorough,

    curl | bash -x
[ Parent | on HN ]
Re:Curl to shell isn't so bad by y4mi on Sunday November 10, 2019 @12:10PM (#21498885)
Piping through tee doesn't trigger the sever side detection (it doesn't stop to read every few ms) and using the x flag isn't inherited, so it's gone as soon as subshells are invoked, which is pretty normal for an installation script.

This has all been mentioned in the linked comment thread

[ Parent | on HN ]
Re:Curl to shell isn't so bad by tln on Sunday November 10, 2019 @04:08PM (#21500219)
Actually the server side detection in [0] isn't really affected by putting tee in the middle... and neither does -x, of course.

Good point about -x being fallible to an adversarial script, even a simple set +x would be enough!

Where's the link where this has been mentioned? I missed it.

0: https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-b...

[ Parent | on HN ]
Re:Curl to shell isn't so bad by tulunsutao on Saturday November 09, 2019 @04:23PM (#21494459)
Use disposable virtual machine to isolate the damage, while dumping the script, this way we can detect attack without compromising ourself.
[ Parent | on HN ]