Which is a fairly high hurdle for an attacker in most instances.
With software projects training people that curl <link to their install script> | bash is totally fine and the insane amount of supply chain attacks lately it's a critical bug that's just begging to be exploited on single user systems.
So yes, patch your systems and definitely do not downplay this.
With software projects training people that curl | bash is totally fine and the insane amount of supply chain attacks lately it’s a critical bug that’s just begging to be exploited on single user systems.
I wish the worst case of gout on people who do this. I can't believe it's become such an accepted way of installing software.
I have a vague memory of some project that did this ages ago where you could see the script on their web page but when you ran the command it executed a different script (there was a single-character difference in the URL) and the result was it told you not to be so dumb as to run scripts like that.
It was idontplaydarts.com (search it up on Internet Archive). It could detect if you were downloading it directly, or piping it to bash, abd change the script it was delivering accordingly.
I found the website you linked to be easy to digest. Impressed with their work, from the perspective of someone who uses Linux but doesn’t know too much about this stuff (other than patch good). I like how they gave credit to both the human and AI.
The patch rolled out to LMDE yesterday (kernel v6.12.85), so I assume the number of affected systems has to be well on the wane by now.
(In that Debian is often well behind the cutting edge and Mint/LMDE is often a step or two behind that. Things are quicker than usual when there's a showstopper kernel bug, but the lag factor is still there.)
12 Comments
atzanteol@sh.itjust.works · 26 pts · 136d
Which is a fairly high hurdle for an attacker in most instances. Unless you're running something like a shared university server.
Definitely patch your systems though.
Aganim@lemmy.world · 15 pts · 136d
With software projects training people that
curl <link to their install script> | bashis totally fine and the insane amount of supply chain attacks lately it's a critical bug that's just begging to be exploited on single user systems.So yes, patch your systems and definitely do not downplay this.
atzanteol@sh.itjust.works · 6 pts · 136d
I wish the worst case of gout on people who do this. I can't believe it's become such an accepted way of installing software.
moopet@sh.itjust.works · 8 pts · 135d
I have a vague memory of some project that did this ages ago where you could see the script on their web page but when you ran the command it executed a different script (there was a single-character difference in the URL) and the result was it told you not to be so dumb as to run scripts like that.
ironeagl@sh.itjust.works · 2 pts · 135d
It was idontplaydarts.com (search it up on Internet Archive). It could detect if you were downloading it directly, or piping it to bash, abd change the script it was delivering accordingly.
HaraldvonBlauzahn@feddit.org · 1 pts · 91d
It is still the recommended way to install Rust.... M)
But what is bonkers is that pip install can run arbitrary code. The python packaging system is likely to be the next target of such attackers.
gressen@lemmy.zip · 6 pts · 136d
Think of the millions of systems running containers.
atzanteol@sh.itjust.works · 1 pts · 134d
What about them?
corsicanguppy@lemmy.ca · 1 pts · 136d
It also needs the sandboxing. So disable that and get back to work.
wabasso@lemmy.ca · 5 pts · 136d
I found the website you linked to be easy to digest. Impressed with their work, from the perspective of someone who uses Linux but doesn’t know too much about this stuff (other than patch good). I like how they gave credit to both the human and AI.
lengau@midwest.social · 4 pts · 135d
I wish they'd bothered with a coordinated vulnerability disclosure...
https://infosec.exchange/@wdormann/116489443704631952
palordrolap@fedia.io · 1 pts · 135d
The patch rolled out to LMDE yesterday (kernel v6.12.85), so I assume the number of affected systems has to be well on the wane by now.
(In that Debian is often well behind the cutting edge and Mint/LMDE is often a step or two behind that. Things are quicker than usual when there's a showstopper kernel bug, but the lag factor is still there.)