1

The other day Dave was hurrying for his project at night. He wanted to install homebrew on his Mac. He typed "homebrew" in Safari search bar, pressed return, and clicked into the first link. He copied the command on the webpage, pasted it into the terminal, then entered his sudo password.

After that, Alice walked past and asked him whether he checked the command before entering sudo password. Dave immediately checked it: scrolled up and /usr/bin/ruby -e "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install)" was still there. Safari was showing brew.sh and the certificate was valid. Clipboard contained the same command.

However, Alice said that it is too late because Dave has already typed his sudo password, giving escalated privilege to unknown command. Did Dave did something insecure this time?

1 Answer 1

1

Did Dave did something insecure this time?

Yes.


Story time:

I had a friend Ramin in college who used to check if his orange juice was properly closed by shaking the bottle upside down. We coined a term after him:

Def: Ramin Test: a test where you are only prepared for one of the possible outcomes.


Your Dave pulled a classic Ramin Test; install some arbitrary software, run it with sudo, then ask if it was malicious. What would he have done if the answer was "Yes"? Destroy the laptop and buy a new one? Change all his passwords and call the bank to cancel his credit cards? I don't think he was prepared for that outcome.

Metaphor: say I open a package of white powder in a crowded public place, then afterwards ask if it was anthrax. What am I going to do? All these people are already infected; the damage has already been done. Similarly, asking if something is malware after it has been allowed to take over your computer is almost pointless.

The proper thing to do is check that the software is trustworthy before you give it control of your computer (aka run it). This is the point of checking a file's checksum before you open it. This is why proper unix package managers or the Windows code signing system check the digital signature at install time, and possibly also again every time it is run to make sure it hasn't been modified.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .