2

I downloaded this shell script from this site.

It's suspiciously large for a bash script. So I opened it with text editor and noticed that behind the code there is a lot of non-sense characters.

I'm afraid of giving the script execution right with chmod +x jd.sh. Can you advise me how to recognize if it's safe or how to set it's limited rights in the system?

thank you

xralf
  • 3,312
  • 45
  • 129
  • 200

3 Answers3

2

Don't run it! That site is blocked where I work, because it's known to serve malware.

Now, as to verifying code, it's not really possible without isolating it completely (technically difficult, but a VM might serve if it has no known vulnerabilities) and running it to observe what it actually does. A healthy dose of mistrust is always useful when using third-party software, but of course nobody has time to verify all the software they run, or even a tiny fraction of it. It would take thousands (more likely millions) of work years, and would find enough bugs to keep developers busy for another thousand years. The best you can usually do is run only software which has been created or at least recommended by someone you trust at least somewhat. Trust has to be determined according to your own criteria, but here are some which would count in the software's favor for me:

  • Part of a major operating system/distribution. That means some larger organization has decided to trust it.
  • Source code is publicly available. At least any malware caused by company policy (see Sony CD debacle) would have a bigger chance of being discovered.
  • Source code is distributed on an appropriate platform. Sites like GitHub enable you to gauge the popularity of software and keep track of what's happening to it, while a random web site without any commenting features, version control, or bug database is an awful place to keep useful code.
l0b0
  • 55,365
  • 30
  • 138
  • 223
  • Could well be; just trying to be safe rather than sorry. The web filter says "**Domain reported and verified as serving malware**" (my emphasis). Of course, if you trust the web site which linked to the script, then by extension you *might* trust the referenced site enough to run the script... – l0b0 Nov 25 '11 at 13:38
  • @I0b0 Which web filter do you use? Is this more trustworthy? – xralf Nov 25 '11 at 14:12
  • I don't think I'm allowed to tell you. – l0b0 Nov 25 '11 at 14:39
2

The "non-sense characters" indicate binary files that are included directly into the SH file. The script will use the file itself as a file archive and copy/extract files as needed. That's nothing unusual for an SH installer. (edit: for example, makeself)

As with other software, it's virtually impossible to decide wether or not running the script is "safe".

user123444555621
  • 148,182
  • 27
  • 114
  • 126
1

While the source of the script does not seem trustworthy (IP address?), this might still be legit. With shell scripts it is possible to append binary content at the end and thus build a type of installer. Years ago, Sun would ship the JDK for Solaris in exactly that form. I don't know if that's still the case, though.

If you wanna test it without risk, I'd install a Linux in a VirtualBox (free virtual-machine software), run the script there and see what it does.

Addendum on see what it does: There's a variety of tools on UNIX that you can use to analyze a binary program, like strace, ptrace, ltrace. What might also be interesting is running the script using chroot. That way you can easily find all files that are installed.

But at the end of the day this will probably yield more binary files which are not easy to examine (as probably any developer of anti-virus software will tell you). Therefore, if you don't trust the source at all, don't run it. Or if you must run it, do it in a VM where at least it won't be able to do too much damage or access any of your data.

Robert Petermeier
  • 4,122
  • 4
  • 29
  • 37
  • What does `see what it does` mean? Do you use some app that can watch what the program does? Functions that are called? Files that are created and edited? – xralf Nov 25 '11 at 14:11