curl bash pipe - Security Discussion

From Kicksecure
< Dev
Revision as of 00:29, 22 August 2023 by Nurmagoz (talk | contribs) (Created page with "{{Header}} {{title|title= curl bash pipe - Security Discussion }} {{#seo: |description=Are curl bash pipes insecure? Security Comparison of execution of curl bash pipes versus execution of downloaded scripts. }} {{intro| Are curl bash pipes insecure? Security Comparison of execution of curl bash pipes versus execution of downloaded scripts. }} = Introduction = There are some questions as well as arguments related to curl bash pipes on the internet. A concern has been rai...")
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
Jump to navigation Jump to search

Are curl bash pipes insecure? Security Comparison of execution of curl bash pipes versus execution of downloaded scripts.

Introduction[edit]

There are some questions as well as arguments related to curl bash pipes on the internet. A concern has been raised on the subject of a curl bash pipe being inherently less secure than downloading a shell script and executing it.

Script Security Audit[edit]

There are at least two user groups.

User Group 1) Users with the ability to security audit shell scripts:

Users with the ability to review shell scripts (such as an installer shell script), can and might review shell scripts. These types of users do not need to be told:

  1. It's a curl bash pipe, for better security, you might want to, not run the curl bash pipe, but instead:
  2. download the script,
  3. check if there is any Malicious UnicodeOnion Logo in the script,
  4. review the source code in a text editor,
  5. make it executable if it looks sane
  6. execute it.

These groups of users already know that because knowing that is a very much more trivial skill than knowing how to audit shell scripts. Even a curl bash pipe curl somedomain.com/script.bsh | bash is a type of shell script (though usually a rather short one) that people with review skills know how to review or rewrite.

If someone with Linux scripting skills is seeing a curl bash pipe such as for example curl somedomain.com/script.bsh | bash then it is trivial to modify that curl bash pipe or in other words to extract the the direct link to the script somedomain.com/script.bsh and then to manually download that script using a web browser, curl or similar.

And hopefully not falling victim too Hidden Text AttacksOnion Logo while using copy and paste.

User Group 2) Users without the ability to security audit shell scripts:

If a user does not have the ability to review a shell script, then there is no difference security-wise for the user anyhow. If either,

  • A) The user 1) downloads the script, 2) makes the script executable and 3) then executes the script, or
  • B) runs a curl bash pipe,

has the same effect. In both cases, the user was running a script without performing a security audit first.

Security Comparison[edit]

Let's compare method A) with Method B).

Option A) curl bash pipe

1. Run the following command.

Click = Copy Copied to clipboard! curl --tlsv1.3 https://www.example.com/installer | bash

2. Done.

Option B) Manual Download

1. Download the installer.

Click = Copy Copied to clipboard! curl --tlsv1.3 --remote-name https://www.example.com/installer

2. Make the installer executable.

Click = Copy Copied to clipboard! chmod +x installer

3. Run the installer.

Click = Copy Copied to clipboard! ./installer

4. Done.

Method B) is not more secure than method A) because in both cases the user has run a script without performing a security audit of the script before executing it.

Partial Content[edit]

Quote Piping curl to s(hell)archive.org iconarchive.today icon:

Partial content returned by the server

When using curl to pipe the script directly into your shell it is teoretically possible for the connection to be interrupted in an unpredictable way. In this case curl or other program can only output a part of the script before failing. In this case we can imagine a scenario in which a script does something that it shouldn't do. For example the following command:

$ rm -r /usr/share/program
Could become:

$ rm -r /usr
This is of course a syntetic example but it is not hard to imagine a different scenario in which a command may fail in an equally devastating way.

This issue can be mitigated by wrapping all script code into functions.

Transparency[edit]

When running a curl bash pipe, the user does not really know which commands will be executed.

Quote Piping curl to s(hell)archive.org iconarchive.today icon:

When executing an unknown script we don't know what is going to happen - we will not be able to easily find out what files were installed.

This is a fair criticism which could be mitigated by installers in two ways.

  1. The installer could store a backup of itself in the installer download folder. In doubt, the user can go later investigate and have a look at the script which was executed at the time.
  2. The installer could by default log in the installer download folder create a log which contains a complete recording of all commands which have been executed on the user's computer.

References[edit]

Related[edit]

Your support makes
all the difference!

We believe security software like Kicksecure needs to remain Open Source and independent. Would you help sustain and grow the project? Learn more about our 12 year success story and maybe DONATE!

Retrieved from "https://www.kicksecure.com/w/index.php?title=Dev/curl_bash_pipe&oldid=76031"