Hot answers tagged

110

This hack has to be understood in context. It was published at a time and in a culture where Unix running on all kinds of different hardware was the dominant system. What made the attack so scary was that the C compiler was the central piece of software for these systems. Almost everything in the system went through the compiler when it was first installed (...


110

As far as I understand, pipe is a system call which shares a piece of memory between two processes where one process writes and other reads from. Actually, there is no shared memory involved. The reader and writer are NOT sharing any part of their address space, and they are not using any explicit synchronization. The reading and writing processes are ...


72

The purpose of that speech wasn't to highlight a vulnerability that needs to be addressed, or even to propose a theoretical vulnerability that we need to be aware of. The purpose was that, when it comes to security, we'd like to not have to trust anyone, but unfortunately that's impossible. You always have to trust someone (hence the title: "Reflections On ...


58

It's not particularly bad, but there are some caveats. how portable will your solution be? Will your chosen binary operate the same everywhere, output the results in the same format etc.? Will it output differently on settings of LANG etc.? how much extra load does this add on your process? Forking a binary results in a lot more load and requires more ...


53

No The attack, as originally described, was never a threat. While a compiler could theoretically do this, actually pulling off the attack would require programming the compiler to Recognize when the source code being compiled is of a compiler, and Figure out how to modify arbitrary source code to insert the hack into it. This entails figuring out how the ...


37

It takes extreme care to guard against injection vulnerabilities once you've introduced a potential vector. It's in the forefront of your mind now, but later you may need the ability to select ttyUSB0-3, then that list will be used in other places so it will get factored out to follow the single responsibility principle, then a customer will have a ...


29

A "Unix like" system may be fully compliant with the Single UNIX Specification, the collective name of standards for what qualifies as a Unix system, but at the same time Unix is a registered trademark of The Open Group and vendors of Unix like systems need to get their systems registered to officially qualify as Unix. Currently the registered UNIX 03 ...


26

This is Unix. kill is able not to kill a process. mv is able to rename and not only move files from one place to another. touch is able to create a file and not only change its last modification time. od means Octal Dump, but is able to perform many more kinds of dumps. yes is able to output no. More exotic: grep is named after the ed command that ...


25

First, my favorite writeup of this hack is called Strange Loops. This particular hack could certainly (*) be done today in any of the major open source OS projects, particularly Linux, *BSD, and the like. I would expect it would work almost identically. For example, you download a copy of FreeBSD that has an exploited compiler to modify openssh. From then ...


22

Originally, the kill command could only kill a process, only later was kill enhanced to allow you to send any signal. Since version 7 of Unix (1979) the default has been to signal the process in a way which can be caught and either handled gracefully or ignored (by sending a SIGTERM signal), but it can also be used to pull the rug out from under a process (...


21

Unix sockets are a bidirectional socket - just like an IP based socket, which you are probably familiar with, and kind of similar to a pipe, which you are probably familiar with. They have a small set of interesting properties: They are in the domain of "the local host" only - you can't access them over the network, only on the local machine. You can ...


16

In your specific case, where you want to invoke udevadm, I'd suspect you could pull in udev as a library and make the appropriate function calls as an alternative? e.g., you could take a look at what udevadm itself is doing when invoke in "info" mode: https://github.com/gentoo/eudev/blob/master/src/udev/udevadm-info.c and make equiv calls as to those ...


15

Let me give you an example: Say you want to communicate/chat with your friend, who lives not at your address. For that to happen, you have to establish a "communication channel". Say, you want to do this communication using telephones. You know that there is a network of telephone lines in the city that is extended to every house. Now, there is a telephone ...


15

Does this affect all languages? This attack primarily affects languages that are self-hosting. That is languages where the compiler is written in the language itself. C, Squeak Smalltalk, and the PyPy Python interpreter would be affected by this. Perl, JavaScript, and the CPython Python interpreter would not. How does this relate to just-in-time ...


15

The short answer is that ungetc allows you to peek at the next character without consuming it. Let's say you're reading a packetized data format. It contains, among other things, a frame sync pattern. Frame sync patterns allow you to align data by marking the beginning of a data frame in an otherwise unsynchronized data stream. To facilitate the ...


14

In my opinion, the genius of the idea of "pipes" is the simplicity of use. You don't have to make any system calls, allocate memory, nothing complicated at all. In the shell, you use a single character: |. This gives extraordinary power in the combination of simple (or complex) tools to a given task. Take some common everyday tasks like sorting text ...


13

From my personal experience developer working on an *nix system needs to know: shell variables (how to set/get + knowledge about special ones like PATH) shell redirection (capturing output of an program) pipes (extracting some information from log file is an excelent example) process control (ps, nice/renice, kill) file access rights (ls/chmod/chown/chattr) ...


12

There's a theoretical chance for this to happen. There is, however, a way of checking if a specific compiler (with available source code) has been compromised, through David A. Wheeler's Diverse double-compiling. Basically, use both the suspected compiler and another independently developed compiler to compile the source of the suspect compiler. This gives ...


11

From my experience with my numerous colleagues since I started to work, nobody wants to fake Unix knowledge: either they "know their way around the command line" or they simply say "no way!". Just ask if the candidate is willing to work on a Unix workstation and let him tell you how far he can go through bash. He will eventually name some commands; the most ...


11

According to http://slashdot.org/story/01/02/06/2030205/David-Korn-Tells-All (question 11), UWIN was not originally open source (though that appears to have changed in the 11 years since that interview was published). Not being open source would have been a significant barrier to widespread adoption, especially considering a functionally equivalent open ...


11

Linux in VM is the easiest option to learn UNIX. If you're running Ubuntu, you can open up terminal and type: sudo apt-get install gcc And you'll have your compiler. Debian-based distros in general will make development very easy because if you're missing library X, chances are it's already in the repositories and you can apt-get it with minimum fuss. For ...


10

Why do this? The *nix shells (and other OS shells, fwiw) are very deep and broad working environments. It's possible for somebody to spend years working there and use only a very small % of the shells' capacity. If you don't expect the person to a) shell program, or b) administer the system from the shell, then why does it matter? Anything that gets done ...


10

One of the fundamental differences between UNIX and Windows, is that Windows tends to have complex monolithic applications, whereas UNIX achieves complexity by combining small, self-contained applications each of which is good at performing one specific task. In Windows, a particular application, no matter how rich and complex it can be, is all you have. In ...


10

He doesn't mean little IDE utilities that create boilerplate for you, which you must modify. He's referring to more comprehensive code generation that you shouldn't have to touch. You make changes to the higher level and regenerate. The canonical Unix example would be Yacc, which uses a high-level grammar to generate complex parsing code. Other examples: ...


9

"Consumer-oriented" (whatever that may mean) usages tend to use Title Case, even in the Unix world. This is more often the case when the organization in question has people whose whole job is to think about user experience. For example, my Ubuntu desktop has folders in the home directory called Downloads, Pictures, Documents, etc. Same goes for my OSX ...


8

Besides the basics like how to use the command line and so on I think that the fundamental is to understand how the system is structured. I think the biggest difference when one comes from Windows to Unix is understanding how the system fits together. Windows fits together by the means of it's API and underlying OS components like COM. Although this is ...


7

Your question seemed to call for a forest answer, and the answers here seem like tree answers, so I thought I'd give you a forest answer. This is very rarely how C programs are written. It is always how shell scripts are written, and sometimes how Python, perl or Ruby programs are written. People typically write in C for easy use of system libraries and ...


7

Because terminal emulators are provided to accommodate a simple style of human-computer communication, the command line, which remains extremely useful in some contexts. Back when the command line and hardware terminals was all we had, it was clear that they were awfully limited for some contexts. Folks began to push their capabilities, giving us ANSI, ...


6

It is based upon very old unix and VMS. In the early 80s when unix (i.e. Sun Solaris) machines were first coming on line, there were no standards as to how or where to mount your drives other than the root one. So you needed something that was easy to type (i.e. short), identified which physical drive it was (for when it died). With oracle, each mounted ...


Only top voted, non community-wiki answers of a minimum length are eligible