Terminally Owned: 60 Years of Escaping
David Leadbeater revisits 60 years of terminal escape sequence vulnerabilities, detailing multiple remote code execution flaws across major terminal emulators.
Summary
The Attack Surface of Terminal Emulators
Since the publication of ASCII 60 years ago, terminal emulators have processed control characters and escape sequences to handle text formatting and window manipulation.
Revisiting Historical Terminal Injection Flaws
Building upon classic research by HD Moore, David Leadbeater audits half a dozen modern terminal emulators across Linux, macOS, and Windows to uncover parsing vulnerabilities.
Chaining Control Sequences to Remote Code Execution
Demonstrating malicious terminal sequences shows how viewing untrusted log files or running command-line tools can trigger arbitrary code execution in the context of the user.
Hardening Terminal Emulation Standards
Remediating terminal vulnerabilities requires disabling hazardous legacy escape sequences, enforcing strict parser boundaries, and validating user input in CLI tooling.
Related talks
Main Stage·38 min
Thomas Chauchefoin · Paul Gerste
Uncovers critical RCE vulnerabilities in Visual Studio Code, demonstrating how malicious repository configurations bypass Workspace Trust protections.
Main Stage·35 min
Jonathan Birch
Jonathan Birch demonstrates novel .NET deserialization RCE attacks that bypass standard assumptions, exploiting database drivers and immutable data streams.
Main Stage·37 min
good pseudonym
Dissects enterprise Private Branch Exchange (PBX) and Unified Communications platforms, chaining Java execution and PHP decryption bugs to gain root shells.