Are you sure? MacRelix, I'm sad to say, is vulnerable to this, and I don't have the first clue how to go about fixing it. Even MPW (Macintosh Programmer's Workshop) is exploitable! Fortunately, though, ToolServer is immune. So far.
mine is like 10ms feels just about instant. terminal, window manager, and shell working together to work well. I did briefly see lag on the shell prompt appearing and turns out it was because work forced me to install node.js and it modified my .bashrc to preload itself which i just deleted and found joy again.
This isn’t actually true. On macOS, by default, the terminal runs with reduced privileges. You have to explicitly grant it the ability to access specific folders.
Practically speaking, anyone who routinely uses a terminal does this because otherwise it doesn’t work.
Myself I keep my terminal.app plain, with bare zsh, and Full Disc Access, and only use it for OS privileged ops. Everything else I do via another terminal without FDA or other grants.
I didn’t find this funny at first… then I tried my compromised terminal, run some commands and the output was actually hilarious! Even the FAQ deserve a read!
Sort-of related: I suggested a joking name for the broader "(thing)2shell" category of vulnerability branding in a group chat, and someone went and made the site.
Bad news; I used some AI clanker to craft a version of Doom that has Microsoft Paint embedded inside of it and then implanted a terminal shell inside of that MS Paint...so now, even MS Paint - at least under this circumstance - is also vulnerable. Hello and very sorry world! /s
jana | a day ago
WOW 11.0 cvss, scary!!
[OP] whjms | 23 hours ago
I believe even Linus Torvalds's machine has been compromised.
mxuribe | 20 hours ago
And, its worse, because like those "Scream" horror movies, the insecure call came from inside the terminal! Eeek! /s
prussian | 15 hours ago
It's actually 12 in light of
sudo -ibeing usable.misty | 21 hours ago
Perfect.
bityard | 19 hours ago
I don't get out of bed for CVEs that don't have their own theme song.
gnafuthegreat | 17 hours ago
To the tune of MC Hammer's "2 Legit 2 Quit":
🎶️ Term-in-al, term-in-al 2 shell!
Term-in-al, term-in-al 2 shell!
Term-in-al, term-in-al 2 shell!
Term-in-al, term-in-al 2 shell!
Sweat runnin' all over my hands
I don't quit, no, I just press
"Enter" on my ergo keyboard 🎶️
Et cetera.
wgx | 13 hours ago
What was the one a few (many) years back that did have a song? I remember the vocals were text-to-speech. It’s driving me crazy trying to recall it!
classichasclass | 21 hours ago
Whew. Mac OS 9 is OK.
wrs | 19 hours ago
On the other hand, my Apple //e enters this state right away when powered up. Zero-click vulnerability!
jjuran | 10 hours ago
Are you sure? MacRelix, I'm sad to say, is vulnerable to this, and I don't have the first clue how to go about fixing it. Even MPW (Macintosh Programmer's Workshop) is exploitable! Fortunately, though, ToolServer is immune. So far.
classichasclass | 10 hours ago
Well, if we're counting that, then MachTen is also busted. ;)
SoapDog | 2 hours ago
MPW... I was there, 3000 years ago.
kel | 21 hours ago
I wish my terminal opened in 0ms
adam_d_ruppe | 14 hours ago
mine is like 10ms feels just about instant. terminal, window manager, and shell working together to work well. I did briefly see lag on the shell prompt appearing and turns out it was because work forced me to install node.js and it modified my .bashrc to preload itself which i just deleted and found joy again.
kel | 2 hours ago
That is infinity times slower than 0ms, however
andyc | 23 hours ago
I AM PANICKING, this has been used against me every day for decades !!
ianloic | 16 hours ago
I keep my computers powered down to mitigate this.
david_chisnall | 6 hours ago
This isn’t actually true. On macOS, by default, the terminal runs with reduced privileges. You have to explicitly grant it the ability to access specific folders.
Practically speaking, anyone who routinely uses a terminal does this because otherwise it doesn’t work.
kwas | an hour ago
Myself I keep my terminal.app plain, with bare zsh, and Full Disc Access, and only use it for OS privileged ops. Everything else I do via another terminal without FDA or other grants.
deejayy | 23 hours ago
Chefs kiss this is.
ryan-duve | 20 hours ago
Typing
lsin the proof of concept block got me.mxuribe | 20 hours ago
Honestly, this is brilliantly hilarious! Kudos to whomever built this!
loige | 18 hours ago
I didn’t find this funny at first… then I tried my compromised terminal, run some commands and the output was actually hilarious! Even the FAQ deserve a read!
ubernostrum | 17 hours ago
Sort-of related: I suggested a joking name for the broader "(thing)2shell" category of vulnerability branding in a group chat, and someone went and made the site.
gnafuthegreat | 17 hours ago
I'm bracing myself for Shellgate.
marginalia | 17 hours ago
Shitpost social commenary is only as good as the amount of effort that has been put into it. This one was pretty good.
mxuribe | 20 hours ago
Bad news; I used some AI clanker to craft a version of Doom that has Microsoft Paint embedded inside of it and then implanted a terminal shell inside of that MS Paint...so now, even MS Paint - at least under this circumstance - is also vulnerable. Hello and very sorry world! /s
dlowe | 17 hours ago
Classic MacOS wins again.
jjuran | 10 hours ago
Not so fast — terminals do exist for Mac OS 9, and therefore it too is affected.
LenFalken | 2 hours ago
cooked
rainbow_bird | an hour ago
Luckily MS Paint is safe. That's a load-bearing component.
sjamaan | 8 hours ago
Looks like multiple people had the same idea. I saw ssh2rce pop up as well today.