139

At some point, your network assigned StaceysiPhone6s an IP address. Then, your laptop got that IP address. Your Mac then looked up the DHCP logs to find out who 'owned' that IP and found "StaceysiPhone6s". So, it used that info to set the local hostname value. Example: https://apple.stackexchange.com/questions/30552/os-x-computer-name-not-matching-what-...


74

Yes, it's a potential risk, see CVE-2003-0063, or CVE-2008-2383 or CVE-2010-2713, or CVE-2012-3515 or OSVDB 3881, or CVE-2003-0020 or any of the similar ones listed here... Some more in comments below also. Update it's not just a potential risk, it's a real risk. rxvt-unicode (versions 2.7—9.19, patched in 9.20) allows read/write access to X window ...


59

"Secure Keyboard Entry" maps to the EnableSecureEventInput function whose concept is described here. Basically, applications don't access the hardware themselves; they obtain events (e.g. about key strokes) from the operating system. Some elements in the OS decides what application gets what events, depending on its access rights and GUI state (...


49

Definitively yes. New add 2020-01-25: From time I've switched from LATIN-1 encoding to UTF-8 as default encoding in most of my systems, I've found some interresting features around this (there are now two lenght for one string)... For sample, as I like to play with bash, I've asked why bash localization won't work with multilines strings. This bash feature ...


7

"Real" glass terminals had an escape sequence to print the screen to a printer. They did this by running a command and pipeing the current screen contents to the stdin of the print command. The command could be configured by another escape sequence. The classic way of exploiting this was to create files with names that embedded the escape sequence to set ...


7

The | is anonymous. The pipe will usually not be accessible to anyone who isn't root or the owner of one of the processes. As soon as you read the standard input and close it, the cat process will exit, and the pipe will no longer exist to even be exploitable by root or the owner of the remaining process. That said, it's usually less hassle to code your ...


6

Typically there is no vulnerability, but obviously if you use it wrong, then you could create one. Printing the contents of a binary file produces beeps because character 7 is the old terminal command to make the machine beep, and some terminal programs still honor that command. But by design, there's nothing there that can hurt you. In the worst case, ...


6

Yes. You can use echo maliciously. You can use > operator to redirect the output to a file where the output can be a malicious code. echo 'Malicious_code_here' > shell.php Lets consider a case where the webserver supports PHP and the www directory is writable. you can try something like: echo '<?php system($_GET["cmd"]);?>' > shell.php And ...


5

Disable pseudo-terminal allocation This means that the command verify is run directly on the other side and the standard input/output/error are connected directly to your local terminal. For commands, there is usually no difference, but it is difference if you want to run interactive scripts (shell). In that point, your output would not be handled by ...


5

First, create the directories to hold the CA certificate and related files: sudo mkdir /etc/ssl/CA sudo mkdir /etc/ssl/newcerts The CA needs a few additional files to operate, one to keep track of the last serial number used by the CA, each certificate must have a unique serial number, and another file to record which certificates have been issued: sudo sh -...


4

I'm gonna add this info here without actual intention to answer my own question. The characters that can get injected on the command line while printing some other characters, better know as escape sequences, are defined really good on this site(Thanks F. Hauri, for mentioning it): http://vt100.net/docs/vt100-ug/chapter3.html Under chapter: Reports ...


4

What you are seeing is xterm control sequences. Control sequences are activated when they are seen in output in the terminal; e.g., when you cat a file with bytes that are non-printable ASCII. In your example, the control sequence is ESC Z (bytes 1B 5A) which returns the terminal ID -- as a command in the terminal. You can try it yourself: echo -e '\...


4

Terminals pre-date copy and paste. So within the terminal protocol, there is no distinction between pasting versus typing. The idea of pasting content into a terminal emulator window was retrofit into the system by simulating the rapid typing of characters when the terminal when the "paste" function is activated. This just dumps the content in exactly as it ...


4

The first cat command feeds the input from in.txt to stdin of the program. The second cat command just reads from the current stdin and feeds it to the program, thus providing the one executing this command line with a way to feed its own data from the terminal to the program and this way probably to some /bin/sh or similar executed from this program. ...


4

Dangers of printing untrusted text The encrypted message could contain any sort of untrusted/malformed data that could try to exploit my bash environment, my terminal emulator, etc. When outputting arbitrary text to a terminal, as GnuPG does by default, you are risking the exploitation of your terminal emulator. New vulnerabilities regarding handling of ...


4

The idea is fundamentally flawed, and cannot be salvaged. To start with the first problem: plugging in an USB "stick" (mass storage device) in a computer will cause that computer to configure its USB and file systems drivers in order to access any files stored on that USB stick. If the system is infected, this process may already modify those files - either ...


4

Or maybe it is, only I haven't heard of it? Many languages provide a way to give command and arguments as separate parameters and thus avoid any interpretation done by the shell. This addresses the same problem as separating SQL commands and parameters with parameter binding. For example in Perl: system("pg_dump", "--format custom", &...


3

To encrypt the hard-drive, e.g. via BIOS (if it's known to be strong), via LUKS (default Redhat software disk encryption). It protects against stealing of harddrives. For the terminal you could use Fedora instead of Centos as there's much newer GTK3 so if you are using GTK3 applications they will benefit a lot. There are also plenty of tools built-in which ...


3

Terminals allow arbitrary input because they are exactly that: terminals. They emulate old physical devices which work over a serial line. Copy-paste was just forcefully pushed into that model, with no actual thought about security. In fact, in the old-timer Unix+X11 model, security was ensured by preventing outsiders from sending synthetic events. That the ...


3

I believe this is a good question, since it has a lot of systems involved. In which court is it the ball? Is this really a problem? I have never thought about this, but let me spit some thoughts. I believe that copy&paste is a tool, and since it is a tool I believe it may be useful to copy&paste control chars from a place to another. Maybe, in ...


3

There's somethig else worth keeping in mind—and, it appears to me, not widely appreciated: On POSIX systems, any terminal has its own 'teletype' device. And every process you run can read from that device, regardless of whether you enable "Secure Keyboard Entry." (Linus Åkesson gives a summary of how Unix systems handle terminal devices.) The names of and ...


3

You assume (as do a lot of people whom should know better) that when you input a password there is some some magic mojo protecting its cleartext in the program. If you can assure the integrity of the program reading the password and it does not deliberately persist or export the cleartext, then it will not be accessible to other programs. A script is ...


3

Realistically? They can (possibly) DoS the OOB management link, and possibly the whole OOB management system, and that's probably about it. However, you have the exact same issue for any console connection to a compromised system. This assumes you're just using the serial link as a serial console (so no SLIP, PPP, or X.25 over it, all of which would ...


2

ssh -T git@github.com verify This logs into the account git@github.com and executes the command verify there. So it definitely goes to the network. The command verify is specific to github and creates a token which you can use to prove to the support that you are the owner of a specific key used to log into this account.


2

Likely answer: your wireless AP is assigning your IP and hostname and getting confused. Lots of confirmation with a little Googling: https://apple.stackexchange.com/questions/30552/os-x-computer-name-not-matching-what-shows-on-terminal https://superuser.com/questions/663765/unknown-system-name-showing-up-in-terminal


2

When the physical security of the computer is not ensured then there are probably dozens of different attack vectors. You can also remove the Administrator password to allow logon without password, you can steal the NTLM hash from the registry hive and try to crack it with John the Ripper and there are probably others I don't know about. These 2 things work ...


2

Use a logging server. Have all your servers immediately send all events to a common logging server. Then the hacker can delete all your files, but its to late the logged events are already out the hackers immediate reach. Then, your next concern is making sure the logging server doesn't get compromised. The logging server should ONLY be a logging server ...


2

Yes, this is possible. In most shells, there are plenty of ways to do this. Any way you can encode and decode something in a subshell into ASCII will work. A few examples for bash: cd $(printf '\x2fetc') cd $(base64 -d <<< 'L2V0Ywo=') cd $(awk 'BEGIN{printf("%cetc",47);}') cd $(cut -b1 <<< $HOME)etc eval $(base64 -d <<< '...


2

If you only need this for testing and debugging, why do you need it to be secure? You should not be debugging live systems while they are in a potentially hostile environment where a secure protocol would be needed. Considering the fact that even the very lightest secure protocol would eat up a significant portion of system memory, it would be silly to ...


Only top voted, non community-wiki answers of a minimum length are eligible