0

So upon working on an old Linux system that hadn't been touched in a while, I ran into an issue related to having 32-bit Google Chrome installed. I found this question that the original poster answered in the form of a one-line bash script. While I don't have any suspicion that the original answer would have been malicious, I did notice that the answer had been edited since then, and if nobody was paying close attention, a malicious edit could have made its way into the terminals of potentially hundreds of people.

What kind of protections are in place, and what should be added, to mitigate the risk of an existing popular and accepted answer (i.e. top of Google results) that consists of a single long piece of code from being edited into something malicious? Some bash commands can look innocent, only to redirect output into something that would end up overwriting something important, for example.

3
  • 1
    The same things that exist for someone posting malicious stuff?
    – Seth
    Apr 21, 2016 at 21:34
  • @Seth it's a lot easier for someone to edit an answer that has already been accepted, gotten 100 votes, than to post a malicious answer without a long string of comments and negative votes saying that the answer is bad.
    – SimonT
    Apr 22, 2016 at 2:46
  • 1
    One thing that stops this is, not just anyone can edit a post, a user with <2k rep, must get there edit approved by 2 higher rep users. Also we have community moderation, you see something you don't like? flag it or leave a comment to let others know.
    – Mark Kirby
    Apr 22, 2016 at 6:24

1 Answer 1

2

This is where IT Security being 'vague' with how things get analyzed is an issue, but there's nothing we can really do about it. There's many different things that could be malicious, but it's up to the users to determine whether they are comfortable running commands posted in answers.

There's no in-built systems to protect against bad scripts. The community at large is very good about catching them though. Many of the more experienced individuals will occasionally check answers to make sure evil things don't get posted. And if people aren't sure, it usually results in flags being raised, and then people address it.

For example, I'll show you how I'd analyze the answer.


In the case you explicitly specified here, though, lets analyze that 'long one liner' (splitting it up was my doing):

URL=http://dl.google.com/linux/chrome/deb/

if (sudo apt-get update 2>&1 >/dev/null | grep --quiet "$URL"); then
    for file in $(sudo grep -Rl "deb $URL" /etc/apt/)
    do
        sudo sed -i 's/^deb/deb [arch=amd64]/' "$file"
    done
fi

This is a fairly 'okay' set of commands to run. It's doing the following:

  1. Running apt-get update, and piping the output through to no-man's land. It's then checking to see if the URL is in the output.

  2. If it's found, then the script checks all the /etc/apt/ files for instances of the specified URL (the Google Chrome repositories).

  3. Where files are found containing the URL, it replaces deb ... with the correct prefix to do amd64 only.


Nothing malicious here!

3
  • To play devil's advocate, suppose some malicious user were to edit the /dev/null section into /dev/sda (or something that works, which I'm not going to test on my machine). Many users would have just copy and pasted the line without too much thought.
    – SimonT
    Apr 22, 2016 at 2:48
  • @SimonT So you didn't read my first section about the community moderation. Most "malicious" edits like that are already caught by the reviewers - I don't see anyone usually with unmoderated edit privileges walking around making those types of edits. Not without the mods bringing down a hammer on them fast, or the community doing the same.
    – Thomas Ward Mod
    Apr 22, 2016 at 11:53
  • You also didn't read my first section where I say: "but it's up to the users to determine whether they are comfortable running commands posted in answers." That's the other part of it.
    – Thomas Ward Mod
    Apr 22, 2016 at 11:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .