Weaponizing Plain Text: ANSI Escape Sequences as a Forensic Nightmare
summary
Demonstrates that unescaped ANSI/OSC sequences written into logs can alter and corrupt forensic evidence: injecting colored output and titles in Docker logs, invoking clipboard exfiltration via OSC 52, embedding clickable links and sixel images, clearing scrollback, repeating glyphs to crash terminals, and triggering command execution on specific emulators (notably older iTerm2/kitty behaviors). Proofs show some paths require user interaction, some cause immediate crashes or DoS, and several serious vectors are already patched while others remain exploitable.
AI-written summary · about
chapters (28)
- 0:00Intro
- 1:06Are Log Files Important
- 1:39Logs Dont Lie
- 2:03The Incident Response Lead
- 2:53Log Shipping
- 3:51ANSI Escape Sequences
- 4:47Terminals
- 5:53How can we do this
- 6:22The ye strand boys
- 7:05Control sequences
- 7:44Csip PMM
- 8:34Control Sequence Introducer
- 10:14Vim
- 11:38Is this an issue
- 11:59Consequences
- 15:23Research
- 17:22Epic Fail
- 17:53My Dad
- 18:56Proprietary Escape Codes
- 19:54Using oc8
- 22:19Inline image support
- 26:25Hide tracks
- 27:27Denial of service
- 28:25Mouse tracking
- 30:43David Leadbeater
- 36:05EvilTerminal
- 36:54Debugging
- 39:03Recap
related talks
59mBrowsers Gone Wild
40mStealing With Style: Using CSS to Exploit ProtonMail & Friends
42mModern web application bugs
01h 02mPrompt-Jacking: The Rise of a New Supply Chain Risk
45mThe Container Escape Room: An Exploration of Container Escapes
21mTwo-Faces of WASM Security
40mLive hacking: Breaking into your web app
56mModern Web Vulnerabilities 2020