Security against malicious script edits

Question

So upon working on an old Linux system that hadn't been touched in a while, I ran into an issue related to having 32-bit Google Chrome installed. I found this question that the original poster answered in the form of a one-line bash script. While I don't have any suspicion that the original answer would have been malicious, I did notice that the answer had been edited since then, and if nobody was paying close attention, a malicious edit could have made its way into the terminals of potentially hundreds of people.

What kind of protections are in place, and what should be added, to mitigate the risk of an existing popular and accepted answer (i.e. top of Google results) that consists of a single long piece of code from being edited into something malicious? Some bash commands can look innocent, only to redirect output into something that would end up overwriting something important, for example.

Answer 1

This is where IT Security being 'vague' with how things get analyzed is an issue, but there's nothing we can really do about it. There's many different things that could be malicious, but it's up to the users to determine whether they are comfortable running commands posted in answers.

There's no in-built systems to protect against bad scripts. The community at large is very good about catching them though. Many of the more experienced individuals will occasionally check answers to make sure evil things don't get posted. And if people aren't sure, it usually results in flags being raised, and then people address it.

For example, I'll show you how I'd analyze the answer.

---

In the case you explicitly specified here, though, lets analyze that 'long one liner' (splitting it up was my doing):

URL=http://dl.google.com/linux/chrome/deb/

if (sudo apt-get update 2>&1 >/dev/null | grep --quiet "$URL"); then
    for file in $(sudo grep -Rl "deb $URL" /etc/apt/)
    do
        sudo sed -i 's/^deb/deb [arch=amd64]/' "$file"
    done
fi

This is a fairly 'okay' set of commands to run. It's doing the following:

1. Running apt-get update, and piping the output through to no-man's land. It's then checking to see if the URL is in the output.

2. If it's found, then the script checks all the /etc/apt/ files for instances of the specified URL (the Google Chrome repositories).

3. Where files are found containing the URL, it replaces deb ... with the correct prefix to do amd64 only.

---

Nothing malicious here!