Programmer Humor

44080 readers

29 users here now

Post funny things about programming here! (Or just rant about your favourite programming language.)

Rules:

Posts must be relevant to programming, programmers, or computer science.
No NSFW content.
Jokes must be in good taste. No hate speech, bigotry, etc.

founded 7 years ago

MODERATORS

cat_programmer@lemmy.ml

AgreeableLandscape@lemmy.ml

169

terminal2Shell is a critical flaw present in every operating system since 1971 allows anyone who opens a terminal to obtain a fully interactive shell. Instantly. With no authentication beyond the one (terminal2shell.com)

submitted 3 days ago by Infrapink@thebrainbin.org to c/programmerhumor@lemmy.ml

30 comments fedilink hide all child comments

Terminal2Shell is a design-level vulnerability in terminal emulators. When a terminal is launched, it immediately spawns a shell process and connects it directly to the user's keyboard. From there, the attacker can issue arbitrary commands with the full privileges of the logged-in user.

Researchers have confirmed that the shell will execute any command typed into it, including commands that delete files, install software, and modify system configuration. In some cases, the shell has been observed executing commands the user typed themselves.

Product	Vector	Status
macOS	Terminal.app, iTerm2, Ghostty, Warp	VULNERABLE
Linux	gnome-terminal, Konsole, xterm, Ctrl+Alt+F2	VULNERABLE
Windows	cmd.exe, PowerShell, Windows Terminal, WSL	VULNERABLE
FreeBSD / OpenBSD	Literally the default experience	VULNERABLE
DEC VT100 (1978)	Physical serial cable	VULNERABLE
Your router	SSH, telnet, the little console port on the back	VULNERABLE
VS Code	Ctrl+` (one keystroke!)	VULNERABLE
Microsoft Paint	None known	Not affected

you are viewing a single comment's thread
view the rest of the comments

[–] Carl@hexbear.net 5 points 3 days ago* (last edited 3 days ago)

Several case studies exist of AI agents autonomously executing the Terminal2Shell exploit in order to alter files and run programs on accessed systems. The only solution is a trillion more dollars in investment.