Уровень 0 · материалов: 4
В кластер входят документы, описывающие технические уязвимости и риски безопасности при работе с командной оболочкой, и не входят документы о разработке ПО в целом.
Общие признаки: безопасность Unix-подобных оболочек, исполнение вредоносного кода, ошибки в работе терминала
Группа выше: Халатность и провалы в безопасности
Смысл: The main idea is that absolute paths in *nix shells do not guarantee security because shell functions can override them, allowing attackers to intercept sensitive commands and steal passwords.
Absolute paths in *nix systems can be bypassed using shell functions in .bashrc to intercept commands like sudo and steal user passwords.
Смысл: The main idea is that providing passwords as command-line arguments is a dangerous security flaw because it exposes credentials to any user or process monitoring tool on the system. The text advocates for moving away from 'quick' insecure scripts toward standardized secret management and key-based authentication.
Passing passwords in command-line arguments (e.g., using sshpass -p) exposes them to any user via process lists and logs; use SSH keys or secret managers instead.
Смысл: The main idea is that modifying a Bash script file while it is being executed is dangerous because the shell reads the file incrementally by byte offset, and changing the file size can cause it to execute commented-out code.
Editing a running Bash script can lead to catastrophic errors because byte-offset shifts may cause the interpreter to execute commented-out commands.
Смысл: The text warns against the danger of blindly copying and pasting commands from websites into a terminal, as attackers can manipulate the clipboard to execute hidden malicious code while hiding the evidence from the user.
Attackers can use clipboard manipulation to trick Linux users into executing hidden malicious commands when pasting seemingly harmless installation code into a terminal.