Re:The MGR Window System
by kragen on Friday August 05, 2022 @10:36PM
(#32364298)
I don't think there are several more ways to exploit terminals, although there are certainly several more ways to exploit terminal emulators. Maybe your definition of "exploit" is broader than mine, though.
> I discovered wall and write at some point and was amazed how stupid that was.
write(1) strips escape characters out, and wall(1) represents them as ^[; they protect your terminal against this particular vulnerability since last millennium. wall also escapes bytes above 126, which would be a pain if you weren't speaking English, and write seems to strip at least byte 0x9b, although I don't know if I have a terminal handy that responds to 0x9b.
> The most common concerning use case I think is SSHing into something. There's no way to tell if you got out.
The easiest way to be sure you got out is to close the terminal emulator, but an alternative is just closing ssh, using ^M~. It's possible to flub that by, say, accidentally typing ^M`. or ^M~,. I agree that better UI would help.
A different problem with ssh is that it leaks your keystroke timing to passive listeners who don't have the session key. This isn't a concern for using ssh with password authentication but it is a concern if you're running sudo or gpg on the server you sshed into.
I agree that unrestricted sudo isn't an effective defense against malware, just against accidentally hosing your system.
> I discovered wall and write at some point and was amazed how stupid that was.
write(1) strips escape characters out, and wall(1) represents them as ^[; they protect your terminal against this particular vulnerability since last millennium. wall also escapes bytes above 126, which would be a pain if you weren't speaking English, and write seems to strip at least byte 0x9b, although I don't know if I have a terminal handy that responds to 0x9b.
> The most common concerning use case I think is SSHing into something. There's no way to tell if you got out.
The easiest way to be sure you got out is to close the terminal emulator, but an alternative is just closing ssh, using ^M~. It's possible to flub that by, say, accidentally typing ^M`. or ^M~,. I agree that better UI would help.
A different problem with ssh is that it leaks your keystroke timing to passive listeners who don't have the session key. This isn't a concern for using ssh with password authentication but it is a concern if you're running sudo or gpg on the server you sshed into.
I agree that unrestricted sudo isn't an effective defense against malware, just against accidentally hosing your system.