git-landmine – create local malicious Git repo

Re:git-landmine – create local malicious Git repo by naruhodo on Sunday July 02, 2023 @12:25AM (#36558214)

To elaborate on your comment, on UNIX systems, you don't put "." in $PATH because someone might put a malicious executable named `ls` or `cd`, in a directory. It doesn't have root privileges, but it runs as your user account and can get some kind of persistence by hooking `~/.bashrc`. And perhaps by wrapping `sudo` it can eventually get root privileges.

[ Parent | on HN ]

Re:git-landmine – create local malicious Git repo by jabbany on Sunday July 02, 2023 @04:50AM (#36559618)

That doesn't work if . is at the end of $PATH though? Since the real ones would take precedence due to how executable searching works...?

[ Parent | on HN ]

Re:git-landmine – create local malicious Git repo by locustous on Sunday July 02, 2023 @09:44AM (#36561436)

You never type sl on accident?

[ Parent | on HN ]

Re:git-landmine – create local malicious Git repo by jwilk on Sunday July 02, 2023 @10:06AM (#36561604)

You should install https://github.com/mtoyoda/sl as a hardening measure.

[ Parent | on HN ]

Re:git-landmine – create local malicious Git repo by jabbany on Tuesday July 04, 2023 @03:51AM (#36583565)

Surprisingly, no... I thought I would, but somehow I've avoided this particular transpositional mistake (probably also due to my habit of setting up a ll or la macro for ls -l and ls -a).

That said, I also don't actually put "." in my path, though this is mainly so I can avoid heisenbugs rather than a security concern...

[ Parent | on HN ]

Re:git-landmine – create local malicious Git repo by fhars on Sunday July 02, 2023 @10:57AM (#36562021)

If that defence works reliably or not depends on whether you have sl installed or not.

    SL(6)                     Games Manual                    SL(6)

    NAME
           sl - display animations aimed to correct users who acci-
           dentally enter sl instead of ls.

[ Parent | on HN ]