I forgot but do browsers download binaries as executable?
One of the big issues with windows is the fact that it uses file extensions for determining file type, so EXEs can just be instantly run after downloading, which led to MSFT making the “Mark Of Th Web” attribute, which moved hackers into finding every type of bypass for MOTW.
I think straight bin downloads require you to chmod +x first, but you could also probably bypass it with any archive format like .tar.gz or opting for a .deb or .rpm.
The upside is that you really shouldn’t be downloading raw bins outside of the package manager, but there are a bunch of tools that only ship as appimages, so you’re kinda screwed if you download and execute from an untrusted source.
You are not the only thing capable of running binaries on your system. There’s always the possibility of something else being compromised that now has the capability to run this binary.
Security comes in many layers on top of each other and with software having to work together to plug all possible holes, not just the direct exploitation paths you are currently actively conscious about and using.
I forgot but do browsers download binaries as executable?
One of the big issues with windows is the fact that it uses file extensions for determining file type, so EXEs can just be instantly run after downloading, which led to MSFT making the “Mark Of Th Web” attribute, which moved hackers into finding every type of bypass for MOTW.
I think straight bin downloads require you to chmod +x first, but you could also probably bypass it with any archive format like .tar.gz or opting for a .deb or .rpm.
The upside is that you really shouldn’t be downloading raw bins outside of the package manager, but there are a bunch of tools that only ship as appimages, so you’re kinda screwed if you download and execute from an untrusted source.
Sometimes! I’ve definitely had some executable files that have downloaded with the x bit flagged.
The weak link on Linux is the number of tools that trained the users to
curl ... | bashYou can kindly fuck off with this level of hand holding lol. Forcing me to +x by default is a massive pain in the ass.
Forcing you to +x is the opposite of handholding. Do you want sudo to wipe your ass as well?
You are not the only thing capable of running binaries on your system. There’s always the possibility of something else being compromised that now has the capability to run this binary.
Security comes in many layers on top of each other and with software having to work together to plug all possible holes, not just the direct exploitation paths you are currently actively conscious about and using.