foreign
[Music]
now for this session we have David
leadbeta and
yes LED Peter thank you uh now his
presentation is called the Houdini of
the terminal and the need for escaping
now David is an open source software
engineer for G research which is a
leading UK based quantitative research
and Technology firm David is going to
discuss a family of security
vulnerabilities and Terminals and how to
protect against them please welcome
David
[Applause]
thank you I begin today by acknowledging
the world warrant people of the culin
nation traditional custodians of the
land on which We Gather today
and pay my respects to their Elders past
and present and I extend that respect to
all Aboriginal and Torres Straits
Islander peoples here today
so as the introduction said I'm David
lebita from Geo research and I'm here to
talk about terminals
um I must have done things up there by
the way if you want if you want details
um I'll post some details about this
later on there
um so I've been a Linux user since about
1998.
um I started program with pearl For
Better or Worse
um I actually have some code in the core
of pearl itself so I kind of took that
to its extremes you could say
um I'm a bit of an IRC fan a long time
ago I wrote something called cgirc which
you may have heard of it's a web-based
IRC client that was quite popular at one
point
these days I mostly write go and work on
kind of cloud-based things with a sort
of side helping of security which is
part of the reason I'm here and one of
the things I'm here to talk about
um so I'm here to talk about terminals
this is a terminal
um I suspect some of you might have been
through one of these recently or even on
the way here this is a particular
Airport terminal it's TWA flight center
at John F Kennedy Airport in New York
City
um now this this is an interesting one
uh as you can see it's got quite an art
deco design
um possibly not Art Deco a bit later
than that I mean anyway it was built in
the 1960s
and
it's actually a hotel now if you look
closely I don't know how visible this is
on the screen but there's someone
holding him I've got a phone just over
there
um so anyway it's an airport hotel now
and it's actually quite a nice place to
go if you happen to be able to travel
these days and find yourself in New York
City
um anyway
so
this is another terminal
this is a teletype ASR 33 and I you're
laughed when I showed airport terminals
so this is a computer terminal right
so anyway this this particular one was
introduced around the same time that
that airport terminal was built about
1962 and it supported a new just
released standard called ASCII or
American Standard code for information
interchange which is a bit of a mouthful
everyone says ASCII
um so here's two famous users of an ASR
33 this is on a PDP 11 and so the
machines behind are a digital PDP 11
running Unix there's not an exact data
on this photo but it's Circa 1970 and
this is I think Ken Thompson sitting and
he's typing into a TTY or tele
typewriter which is why we call TT wise
on Linux these days still TT wise
because they're tele typewriters
um
so
it's possibly tempting fate when you
publish a magazine article advert I mean
like this uh this says just how much
longer will The Model 33 be around and
so as I mentioned about 1970 we saw
someone using them
um 1976
um is an interesting year this was in
1974 so they're sort of saying this is
going to carry on for many more years we
think we've got a successful product
here please buy our product so in 1976
Leah Siegler released the adm3a which
wasn't the first video terminal but it
was actually one of the first affordable
video terminals it was about a thousand
US dollars or just under in kit form
and the University of California
Berkeley standardized on this as their
terminal of choice
and Bill Joy who was later the
co-founder of sun Microsystems use one
of these terminals he actually had one
in his dorm room connected by a 300
board modem
so that necessitated the invention of
something called VI
so he actually wrote an editor called X
which had a motor called visual but
inside that was a command called VI
which later was split out to its own
command called VI and as we know the
rest is history so if you just look
closely at the keys you see Escape here
is very nice and easily accessible
compared to Modern computers and on the
HJ k l Keys we have the vi cursor
movement case and also interestingly
just here we have a bunch of dip
switches that is how you configure the
terminal
um one of the interesting things is
there's not a caps lock key on this so
actually you one of the things you could
configure was whether you had the
additional RAM installed that let you
use lowercase
um so it so it was to optimize things it
was five bits rather than eight or seven
bits at the time
um so yeah the the one of the biggest
expenses that made video terminals an
expensive thing was actually the ram
that was needed to store what was it on
screen at the time
um so one nice thing is that the
operator's manual for this has been
preserved um there's a website called
bit Savers that has a bunch of PDFs of
things
um so if we dig into the manual we can
find details about the Escape key and I
won't read it all but it can be used to
produce a load cursor operation and then
it says down here this operation may
also be initiated by the host computer
using the same Escape sequences
so essentially that's what makes a VI
possible you can address the cursor on
the screen and move it around and in
particular
it's possible to sort of send lots of up
and down commands but if you can address
a particular point on the screen then
you can do it efficiently and as I
mentioned Bill Joy had a 300board modem
so that was part of the reason why
um you know this this ended up being how
it was
um
so moving on a bit this is um 1978 or
1979. um there's some debate about
exactly when but this this standard was
published in 1979. so
this standard specifies
a lot of things about how a terminal
should work so the Leah Siegler one that
I showed had a very particular way of
setting the cursor position but that was
accustomed to it so you've probably come
across term cap and the need for that
was that different terminals implemented
different things
um ANSI in theory was an attempt to
standardize that but actually the
important thing it did was Define how a
particular Escape sheet sequence should
be
interpreted so that if a system didn't
Implement a particular escape sequence
it could ignore that thing in the same
way these days HTML ignores unknown tags
Escape sequences have a similar concept
um
and also these days we talk about antsy
color but actually that was defined a
bit later and I'll get to that
um
digital here we saw earlier with the PDP
11 also had their own terminal there was
a vt52 which was one of the first cursor
addressable terminals similar to the
latest Eagle one we saw but they were
much more expensive um it's a bit hard
to find prices these days and things uh
yeah I spent a bit too long researching
this so you know anyway this this is
deck deck is interesting because they
introduced a terminal called the vt100
which was one of the first terminals to
implement the ANSI standard and these
days has almost become a de facto
standard itself in that if you're using
a software terminal which sometimes we
call terminal emulators then it's
probably implementing something along
the lines of the vt100 although exactly
how good that emulation is there is
so how do these Escape sequences work so
this is quite a cool command that makes
you look like a bit of a hacker if I
press enter we get the Matrix so this is
this is C Matrix
um it yeah it does what you expect it to
oh that's what it says on the tin so
we can run this through cat minus V and
so if you've not come across the minus V
option to cat
this basically says if there's any
Escape sequences show me the escape
sequence as it was and it actually
applies to all control characters
um interestingly Bill Joy actually added
the minus V option to cat at least
according to the sources I can find and
this was much to the annoyance of the
original Unix developers from Bell Labs
who thought that really cat should be
limited to concatenating things together
per its name and so there's a paper
written in 1980 called cat V considered
harmful but anyway I think we've moved
on from 1980 and we'll use cat V for
this example so that doesn't look
anything like the previous thing but
if we look closely we'll see things like
escape
a bracket 32m and as I mentioned the
ANSI standard it itself doesn't Define
colors but in the appendix to it here we
find 32 is a green display so this was
actually in the appendix to the standard
and it was part of the later
International standard that was based on
the ANSI standard
um
we can also
do red so if we do something like that
we get red text which doesn't look very
visible on this so we'll make that be
easier
um okay so Escape is ASCII character 27
um as you saw with that cat output it's
sometimes written as carrot and then
left brackets sometimes in a c style
string it's written as backslash e
in some cases the C style strings don't
support that format so you find it
written in HEX like that or for example
in JavaScript you'd have to do slash
u001v but anyway I'm going to mostly
refer to things in these slides using
this form but when I'm talking about
that I'm talking about a particular
ASCII character that is by definition
not printable so I can't actually just
put it on the slides as it looks so
hence why I'm trying to explain this so
another place you might have seen this
is in PS1 which is in a bond compatible
shell like bash is how you set your
prompt
um so you might do something like this
and if you look there that slash e is
the E I mentioned I've already mentioned
31m so this is red text
um and then if we just look at what that
happens to look like yeah you know you
want to make your root prompt red or
whatever that's essentially how you do
it
um often there's a few more things in
PS1 but for the sake of the slides I've
just made that simple
um so I kind of mentioned that the
answer is standard defines a sort of
sequence and a way of a way of defining
the patterns that that is extensible so
one of the things that it defines is a
control sequence introducer which means
that you have escape this left square
bracket and then you have usually a
number or a set of numbers and then a
letter roughly it's actually a bit more
complicated than that but
um I won't I won't I can't fit that the
whole thing into this talk
um but that's that's essentially all you
need to know to understand this talk
um
so in 2003 HD Moore published this
terminal security and sorry thermal
emulator security issues and this was
sent to the bug track mailing list which
sadly is no longer around but OSS
Security if you've come across it is
kind of its uh successor in sort of de
facto form
um this is one of the first write-ups of
terminal security issues
um
yeah so we're going to get to the
security part of the talk
um everything that I'm talking about I
did on either my own systems or systems
I had permission to perform this on so
basically don't try this at home work
don't try this at work but you can do it
at home uh probably assuming you own
your systems at home Etc standard
disclaimer
so anyway back to back to this post one
of the things here is window title
reporting so what's that
so I mentioned how the prompt works and
one of the things that a prompt can also
do and it's common is it will set the
title of your window so you know when
you open your terminal and you change
directory the title of the window often
updates to show what directory you're in
um and so this is the escape sequence
you use for this I mentioned uh CSI and
so this is an operating system command
so the square brackets the other way
around and then we can have a string of
text terminated by this special
character at the end
um so it's basically a way of sending
strings and the standard didn't Define
any of these but later on people defined
what the bit inside this means
um and so one thing we can do is this we
can say okay we're running a particular
terminal program or whatever we're
inside our terminal so we're running
xcal okay fine
that's not really a security problem we
can say what we're running
um so there's a control sequence to
report what the window title is
so some some of these Escape sequences
can be used to ask things of the
terminal the common example being where
is my cursor so I mentioned the eye a
while ago
um you can ask where's my cursor on
screen and it will return something like
you know 10 comma sorry 10 semicolon 5
and that's like your you know column 10
row five or whichever way around it is
um anyway this this particular one is
asking What's the title of the window
please and so it Returns the title of
the window for you
um
so if we adjust this slightly and we set
the title of the window to be
carriage return
calc exe and then another character
return and then ask for the title what
happens well so if we just you demo this
this is printf so this is this is
actually on Windows and we're using
Commander which provides a compatibility
layer for Windows of Unix tools so that
sequence there calc then hit enter
okay that's interesting so a printf
command resulted in essentially typing
calculator
and now now we're running calculator and
if you're not familiar calculator is the
traditional thing to open when you're
exploiting systems so there may be a few
more of these so
did I patch that back in no it turns out
this was a new vulnerability in a
windows program hence why we randomly
changed the windows there
um this was patched late last year
um and basically yeah it report it
didn't
um filter the title at all
um
it also supported that most terminals
were just so they're not going to
support the report title sequence
um
some terminals to have an option to turn
it back on so there's an option that
basically says yeah I want to be
vulnerable to a security hole please
um but you know
so I use printf in that example
um
it's certainly interesting printing
something to your screen can have a prob
create a problem like that but to
actually make this into a vulnerability
we need to do something more
so what we're looking for is instances
of this so this is the common weaknesses
enumeration which is a miter project of
sort of common security problems and if
you scroll down on this page you'll find
that some of the bugs that hdmr found in
2003 are listed as exemplars almost of
this particular kind of problem
um but what else can we do so well if
you just give someone a file and ask
them to cut it to your screen they
probably won't do that but like it could
be as simple as that to social engineer
someone into attacking themselves
um something else that works is just
curl so like literally put it on a web
URL and be like I'm having problems
curling this URL can you just try it for
me administrator please and you know
there's a bunch of things you can do
um so if you've got a terminal exploit
you can do evil things even without a
terminal exploit we can hide things so
um I don't know how visible that is
hopefully that's so here's here's a
script so I've got a script called
evil.sh it says Echo I am good okay fine
I'll just run that
hi
um so what actually happened here
so if we run cat minus V again to see
what's going on uh oh okay I am evil
comment backspace backspace backspace
good and I mean you've probably seen
this used in memes right so literally
you can actually use a meme as a as a
security attack which is kind of funny
but
um yeah I mean it's kind of ridiculous
that it's that easy probably you
wouldn't actually get any success with
that hopefully these days but uh you
know that's the thing so back to 2001
um this is one of the examples for cwe
150
um the log files the the Apache web
server used uh contain information
directly supplied by clients and does
not filter required I won't read it all
but essentially yeah you could basically
attack an administrator an hdmores paper
in 2003 which is worth a read actually
has a fun scenario where an
administrator gets attacked
um
anyway so we're back to the modern world
um and I'm gonna have to speed up a bit
so I'm running a little bit behind time
so anyway
um python Python's a thing
um so if I run a python web server
um at the top here I'm running python
minus am HTTP server and down here I've
I'm the attacker so victim on the top
attacker below so the victim has run a
python web server random directory
down here
the attack is trying to attack them so
they found out that if they just use
Curl on its own they can't do that
because curl on the client side doesn't
let them put a slash e but it turns out
if they just use printf and pipe back to
netcat yeah okay that
that works so you'll see up here you'll
see that characters disappeared so
um basically yeah they the something is
interpreting that okay so you see now
they've managed to make this go red up
here so what what else can they do they
can they can make things go red
um we've discussed 31m
um so another thing they can do is the
title I mentioned setting the title uh
what happens if they don't actually
finish setting the title
well the logs up here is finished
they're still doing requests down here
where's the log okay so you can hide you
can hide something in a lock but that's
that's kind of basic
um what else can we do well if we've
actually got a terminal exploit maybe we
can actually just run code in the top
one
via the python command that they've just
run
so
um what we're doing down here is where
this is p so this is a what's called a
device control string I'll cover more in
a second exactly what that is qm means
query the color and it's a bit hard to
see up here but that the terminal
replies with something that says my
current color is 31m so my current color
is red I'll just change the color back
to uh
yeah okay so if we change the color back
to the default color it says the color
zero
um
so anyway
this gets interesting is this will
actually in the same way that the title
thing did this will let us Echo text
back
so here the terminal typed LS for us
um it turns out we can actually do more
than just typing LS so
um if we just put the hex code free
which if you're not conflicted not
familiar that's Ctrl c
um
so
what's going to happen we're going to do
Ctrl C and then we're going to do LS and
then we'll just finish typing that okay
so this is an interesting python
actually said it's a bad request but
it's fine because it logs it logged it
anyway so
um keyboard interrupt received exiting
so at this point we've basically got a
way of an HTTP request over here if
someone's running something in a
terminal and it's not escaping output we
can run code
um
so just to complete this we need to put
a
terminating new line here sorry that's
the carriage return
um
there we go
okay so that actually ran LS but there's
nothing in this directory so I'll just
I'll just touch a file to prove to you
that this really does work
um there we go so we've just run that
and then obviously to top things up off
we have to open calculator because
that's just the traditional thing to do
so
um and that's there we just replaced
that with calculator
um rerun the command up here
there we go yeah so there we go there we
go so we've basically used Python and in
this case item two on Mac so this is an
open source uh terminal that various
people on Max use
um
so
just to go go into a bit more detail on
exactly what happened there so device
control string is is this first bit we
asked for the color that's fine
um create a color okay that worked
um so actually this was a 2008 X term
CVA why are we looking at it now
well it turns out that the control
sequence docks for X term weren't
updated and I don't know for sure but it
seems like that the offer of item to
happen to read those docs recreated the
bug about two years ago so the what was
patched as a cve is now basically re
recreated
um so this was what I just demonstrated
was was item to cve 2022 four five eight
seven two
um so you could use this to achieve
remote code execution
um and as I mentioned that was also a
python bug so the python bug didn't
receive a cve but python has had several
security fixed releases now that
Escape output when you use that
particular command so that's kind of
Defense in depth
um so I mentioned there's a CV and X
term in 2008 well there's actually been
a few um X terms still maintained and it
actually has one of the more complete
deck terminal emulations so it's
actually quite a good terminal to use in
various ways Believe It or Not these
slides are actually running your next
term so how that works is
the terminals in front here these are
deck terminals they support graphics
so I'm using the debt Graphics support
to embed Graphics in the in the slides
here so this this is believe it or not
actually next term it can even do Emoji
um so the image format that it's using
is called six cell so like pixel but 6L
it's supported by the hardware terminals
these are in that advert there's also
recent code that implements things for
it so libsixel has a command called
image to six all and if you want to play
around with that you can do something
like this to run a next term that is
terminal compatible with
vt340 which is one of the terminals that
supports color and then image to 6L on
some file and that will probably just
appear in your terminal assuming it's
under a thousand by a thousand because
that's the maximum
some of the terminals like item 2
actually support six all uh Kitty is
another one and several others
um
so this is interesting here's an X term
cve from 2022 found by Nick black who's
actually the author of not curses which
is a if you're familiar with n curses
not curses is another library that will
do image formats so it will do six or
stuff in your terminal we can do fun
things like overlay
a graphic on top of text and various
other things
so anyway the cve I won't I won't go
into too much detail
um but essentially this is repeat
so repeat a lot of times a thing and it
turns out to be a fairly trivial buffer
overflow and if you printed that into X
term and it had six cell support enabled
it would crash
but anyway it's actually much easier if
you just do the some of the exploits
that I've shown where you just make the
terminal type text for you you don't
have to actually deal with like buffer
overflows and complicated memory things
so here's one I found in X term
um it has a way of setting fonts so you
can ask X term to set your font
um
so yeah so it looks something like this
so you set Escape operating system come
on 50 and then you say what font you
want so yeah I'll set my font to Mono
please but it also had a way of querying
your font so in this particular case the
question mark is
respond to me with what your font is
currently set to
it turned out if it didn't actually know
that font and you just set your font to
some random string it would Echo back
the same thing so in the same way that
the title sequence could be used to
potentially run code this can be used to
potentially run code
so something like that well no it wasn't
quite that simple so
um for various reasons a new line or
control or any control character isn't
allowed there it just terminates the the
sequence
um
but
this is kind of interesting so in in the
ANSI standard operating system command
which is the thing I've shown is
Terminator with st now actually if you
look back I changed something here I
terminated this with a Control G which
is the ASCII Bell character
um so St is
that but if you terminate it with a
control g
x term responds with the same thing so
you you can use a different character
and then it presses that character for
you
so it turns out in zsh there's some
interesting features it will change its
key bindings depending what editor
you've got it set to so if you've got
your editor environment variable or some
others set to Vim then one of the
default bindings is Ctrl G becomes list
expand
so it's kind of easier just to show you
this one so if I just type LS here and I
am now pressing Ctrl G
um I haven't pressed enter but I run a
command right so I haven't actually
pressed enter at all I'm just you have
to believe me but I haven't
um so
this is essentially how this then ended
up working so you ask it just to uh
remember we were in film mode so we have
to put an eye here to turn on insert
mode we Type X calc and then we just
terminate this but because we've put
this
in command expansion brackets there that
that a which is the ASCII Bell
essentially asks it to press Ctrl G for
us
um and yeah sure enough it runs what
you'd expect it to do and so this was
actually what I posted to OSS Security
and I put in there you could cut the
file or another way to deliver this to
the victim
so
we've done old things let's do something
modern my day job is about kubernetes
there was this cve in Cooper in Cube
cattle which is the command line
interface for kubernetes and it didn't
Escape Escape characters so what can you
do with that well you kind of know the
answer to that now you've seen the first
bit of the talk
um just out of inch Cube cuddle is you
say Cube cattle because it's a
cuttlefish and kubernetes is a pun of
C's or C of puns all the way down
um anyway so
here I've got
something that hopefully is running a
kubernetes cluster okay yeah there's a
pod here that's crashed
um that's fine we'll ignore that one so
if I just run some convenient Docker
image I've got around here
um so
okay we'll run that what's what's going
on so and you know a normal normal thing
to kubernet is is to run some pods or
whatever
okay both of these are in Crash loop
back off so
um as an administrator looking at this
you know the scenarios may be a user's
run this pod on on the cluster and is
asking why it's not working or something
else so you know the administrator with
all your administrative admissions
starts going describe pod proof of
concept oh dear um so
so well it turns out I'd run it twice
even so yeah it turned out if we scroll
up a bit
um unfortunately because the
vulnerability is in setting font it just
resized the font as well so you can't
see it
um but you have to believe me there's a
bunch of different exploits up there so
you just run describe on this particular
thing and it will probably do something
um so
that's cool
so
in total I found six cves across
different terminals I've demoed the item
to the X term one
um the Connie mu one
um if we have any time at the end which
we probably won't I might show one more
um
but one thing I'd like to talk about is
open SSH so
these these these vulnerabilities are
essentially echoing something back to
the terminal so I'm running local
commands on wherever the terminal is
currently connected to it's as if I'm
typing something
so a common thing to do is you know
leave a connection open over SSH and
there's various security issues with
that depending how it's done so a common
issue is something like this where you
have a jump box in the middle
if someone hijacks that that jump box
and you've rather than
um doing anything like port forwarding
if you've used agent forwarding or
anything then potentially if they've
compromised this box they can actually
sh to another box over here that or
something or they can sniff the traffic
to your production host so one way to
deal with that is there's something
called SSH minus capital J which rather
than using forwarding through sh itself
it configures TCP port forwarding so
you've actually got encrypted sh on top
of encrypted SSH so the box in the
middle can't attack you
but anyway
um
if we get access to this production host
here
um what can we do so you know the normal
scenario is someone's left a terminal
open now imagine that terminal's got
vulnerability so if I get root on that
host that the worst that can happen is
basically I can run commands on that
host but
if we go if we are able to somehow
exploit the terminal bug can we go back
and back and run commands on that client
well
um I'm just going to show this so we've
got a victim up here this is this is
just running as the same user on the
same machine for the for the sake of the
demo but imagine that this someone has
compromised this host down here so
somehow they're able to write something
into that terminal so this is normal
Unix permissions so either their route
or they somehow can write to that
um so we run something called a
disconnect attack and as you see here
that that disconnected them
and then you run a command so how it
works is actually quite simple it stops
the shell up here and then it prints a
command that will result in running some
things and then it just kills the shell
um so
yes it's possible there's there's
actually a bunch of attacks that are
possible if you essentially stop the
terminal
um
because then
it's writing something but it's because
of buffering it's not necessarily
written straight back
um
it just so happens that this one works
really simply to exploit some of these
it's a bit more complicated like you'll
need to send like a buffer like eight
kilobytes worth of text or something but
generally various various things are
possible
um
so yeah that that means that when when
we say these these can lead to remote
code execution they really can lead to
remote code execution not just typing
stuff on your on your local system
so hopefully I've convinced you that
escaping is needed
um
basically yeah writing untrusted uh
output to a terminal is bad
um
this has been known about for a long
time in C you can ask for a particular
character is it printable or for a wide
character is it wide printable
um
lots of bits of code don't bother with
this so it's kind of trivial to find
security issues here so
um
go is actually a bit better
um there's a quite nice thing in the
format package and go where you can use
percent cues so it will output a quoted
string in go form
um
and that yeah that uses the same rules
the literal string would so that's
that's quite nice and quite simple you
can also use the Unicode is graphic
thing
um
but yeah so
an important thing here is awareness
um I kind of mean awareness for users
and developers so as we saw with cat
it's very simple to potentially attack
someone without them really realizing if
someone's got a terminal exploit even
without a terminal exploit as I showed
you can potentially output something
that is different to what will run I'll
cover one more thing about those in a
moment
but like anything with security part of
it is awareness and then part of it is
actually implementing defenses against
these things so
escaping is important
but another interesting thing is we can
actually mitigate some of this ourselves
so
these Escape sequences when we get the
reply to them actually have
some characters around them so they have
like I showed the font extern responds
with the same thing it responds with the
control sequence you would use to set
the font when you query what the font is
um so zsh is quite nice because it's
it's line editor which is the equivalent
to read line is programmable
so
um this is a very simple
um zle function that says skip osc
sequence
um so basically it says reading all the
input and just don't do anything with it
and then you bind that to the key that
is used for operating system commands so
if I then hopefully
that should all be already be running
okay so I've now implemented that in zsh
so now if I do that
you see it did resize the terminal and
it wrote some garbage down there but as
many times I run that
that actually can't be exploited now so
we actually can potentially do things to
make this better
obviously we should fix the terminals as
well but defense in depth is possible
um and the other interesting thing is
the ANSI standard is a bit vague and it
doesn't really have any definitions of
what to do in error handling it just
says this is outside of the scope of the
standard
so what people have started to do is
actually implement the same error
handling and cases as the original deck
terminals did and like I said the vt100
is a de facto standard and people have
sort of decided yeah okay we might not
agree with every single thing it did but
um it's good to basically copy it and
HTML has learned this too so somewhere
deep in the HTML spec on parsing it says
basically you have to implement the
exact error handling we implemented here
because if you implement something
different that can lead to a cross-site
scripting attack and it's kind of the
same with terminals it's not really as
quite as critical because like I've
shown you actually need a clear bug in
the terminal for this to be a problem
but we can do better with defense in
depth as well
and I haven't got a link to it here but
on vt100 now there's a lot of resources
about deck Terminals and one of them is
a reverse engineered State diagram for
what the deck parser does so various
terminals do Implement that and I found
a vulnerability in a particular terminal
that wasn't as bad as one of any of the
ones I've shown because it correctly
implemented that state machine so there
was no way to get extra characters into
the input
um it's also worth mentioning that there
are other attacks related to this so
Trojan Source was something that came
out about this time last year I think
um and that basically is you can use
Unicode characters such as right to left
override to hide things in source code
um and similar things are possible with
these terminal tricks
um so that they're all kind of related
um so in summary history repeats itself
because nobody listens so that the X
term CV repeated itself the title bug
from 2003 was already existing in
another terminal so some of these
almost too trivial to find and I think
that's actually one of the reason that
people hadn't looked at these as
security researchers because actually
like that wouldn't exist right that's
too too trivial but but it turns out
they did
um
they're actually kind of rare as well
like you get web browser updates like
every week about some new new thing that
somehow can be exploited there are fewer
of these in terminals
um but as I've shown they can be very
dangerous
um and yeah everyone needs to consider
whether they should do escaping or what
what they should do when they're
printing anything so you know anytime
you write printf in a program or
whatever your language uses you might
actually have to think about that a bit
more did it come from untrusted input
and you know as a security person I
often say where's you know untrusted
input and things like that so yeah
um everyone has to be careful
um so that's that's all I've got
um thank you
um if you follow me on Macedon over
there I will I'll later post a link to
the docker image I showed with those
exploits and how to recreate those and
potentially test if your terminal is
vulnerable
um so thank you
[Applause]
does anyone have any questions for David
thanks for putting me in absolute fear
of my terminal
um you say at the end that uh they're
thankfully rare
um is there anything actually reason to
believe that that's true because we
thought that side Channel attacks in
CPUs were rare until someone found one
and then everyone started looking for
them and we found out that they're not
rare is this just a case of not looking
or yes I think it's partly a case of not
looking but also terminals are actually
quite a small piece of source code right
so I I'm fairly confident of some of the
ones that I've looked at that there
aren't any other bugs so in particular
things like replying
most most terminals only have about 10
different replies they can give and it's
very it's very easy to read every single
one of them does that have a problem
um potentially more interesting as some
of the other ones that you know involve
buffer overflows and things those are
those are harder to be sure about but
um especially when you know it involves
fonts and it might actually be a bug in
Cairo or one of the underlying libraries
so
I still think they're rarer there's a
much smaller surface area in a terminal
than there is a web browser but yes you
I don't have data to prove that other
than you know going back and looking at
number of cves in web browsers versus
terminals or such
so kind of following on from that
there's a project I think called
carbonyl but I'm probably pronouncing it
wrong which implements a version of
Chrome that runs in a web browser have
you heard of that one do you have any
thoughts on that as a test in a terminal
so it renders HTML and CSS into into a
terminal yeah I have come across that I
can't remember where it's but yeah it's
probably using sex cell or something
like that
so yeah it's it's possible
I was wondering
um
so what the the smallest code base so
there's if you're familiar question
there was was there any particular
terminals that you would recommend
um so yeah the smaller the code base the
better
um
I think if you're familiar there's a
project called suck less and they they
release a terminal called St or um it's
like the shortest code base ever it just
has no features so it's the usual
trade-off right
anybody else
all right thank you David and we have a
little gift here for you thank you very
much
and you're looking after us
thank you