Re:Detecting the use of “curl | bash” server side
by ziml77 on Tuesday December 27, 2022 @09:46AM
(#34149091)
If they sign the script with their own signature then it’s no longer a script that you trust. I can’t remember if PowerShell automatically trusts a script that’s been signed by a cert issued by someone like VeriSign, but if the system were to be adopted for Bash scripts there’s no reason it couldn’t use a store that only trusts the distro maintainers by default.
[ Parent
| on HN ]
Re:Detecting the use of “curl | bash” server side
by maccard on Tuesday December 27, 2022 @04:21PM
(#34153997)
If it only trusts the certs from distro maintainers then surely it will be distributed as part of the normal package sources. If you need to add a cert, then the problem is exactly the same as adding a repository to the package manager; if the delivery mechanism of the instructions is compromised you're hosed.
Powershell will accept codesigning certs that are signed by verisign, so the workaround for an attacker who has already compromised a web site is to modify and re-sign the script with a certificate that can be obtained for $60.