News for hackers. Stuff that matters.
Re:Desktop Linux Hardening by TacticalCoder on Monday June 12, 2023 @10:19AM (#36293866)
> "read scripts before you run them" is a good bit of advice.

I always read the script and do also verify they're only using ASCII chars (and if they're not, I check which Unicode shenanigan is ongoing).

For example:

    ... $ file /usr/local/bin/somescript.sh 
    /usr/local/bin/somescript.sh: Bourne-Again shell script, ASCII text executable
FWIW most of the scripts out there are only ever using ASCII chars.
Re:Desktop Linux Hardening by chaxor on Monday June 12, 2023 @12:38PM (#36296338)
How do you check it without running something that may execute it? Many scripts will execute if opened with vi or even cat or printf from what I understand.
Re:Desktop Linux Hardening by JohnFen on Monday June 12, 2023 @01:43PM (#36297753)
> Many scripts will execute if opened with vi

I haven't encountered this. You can execute scripts intentionally in vi, and I assume you could configure it to happen automatically, but can this happen without you making some sort of effort to enable it?

What scripts present such a risk? What vi configuration is required to stop this?

Same question wrt cat.

Re:Desktop Linux Hardening by deadbunny on Monday June 12, 2023 @02:20PM (#36298415)
(n)vi(m), cat, less/more do not execute scripts on read. That would be utterly insane.
Re:Desktop Linux Hardening by cyberbanjo on Monday June 12, 2023 @12:46PM (#36296501)
Source for executing files with cat? That certainly defies my understand of how cat works.
Re:Desktop Linux Hardening by RadiozRadioz on Monday June 12, 2023 @02:34PM (#36298684)
Maybe they mean that it can include control characters that mess up your terminal and make it look like something malicious is happening, which of course is not the same as executing it (and has a warning anyway).