Typosquatting programming language package managers

#1

Post by xrstf » Wed, Jun 08, 2016, 1:45 PM UTC

Typosquatting programming language package managers
incolumitas.com

Re: Typosquatting programming language package managers

#2

Post by pmontra » Wed, Jun 08, 2016, 2:47 PM UTC

Probably the maintainers of the package managers know which typos their users do, because of the 404s in the logs or equivalent errors. A preventive action could be starting to blacklist any name resolving to 404. If somebody eventually tries to upload a package in the blacklist, a maintainer should check the code and whitelist the name. Obviously people can be very crative with typos and with squattinq and there is no real protection against mistakes.

Re: Typosquatting programming language package managers

#3

Post by ryanmarsh » Wed, Jun 08, 2016, 2:56 PM UTC

So last week my client discovered there's a gem named bunlder... sigh

Re: Typosquatting programming language package managers

#4

Post by epalmer » Wed, Jun 08, 2016, 2:58 PM UTC

pmontra wrote: post #2

Probably the maintainers of the package managers know which typos their users do, because of the 404s in the logs or equivalent errors. A preventive action could be starting to blacklist any name resolving to 404. If somebody eventually tries to upload a package in the blacklist, a maintainer should check the code and whitelist the name. Obviously people can be very crative with typos and with squattinq and there is…

> Obviously people can be very crative with typos and with squattinq and there is no real protection against mistakes.

I see what you did.

Re: Typosquatting programming language package managers

#5

Post by eudox » Wed, Jun 08, 2016, 3:00 PM UTC

I'm a fan of the approach of personally submitting projects to the repository maintainer (e.g. through GitHub issues), and having the maintainer personally approve them.

It does raise the barrier to entry, but it would prevent typosquatting and regular namesquatting.

EDIT: Does any major package manager provide a "did you mean" functionality, offering a list of actual package names similar to what you typed?

Re: Typosquatting programming language package managers

#6

Post by pmontra » Wed, Jun 08, 2016, 3:00 PM UTC

ryanmarsh wrote: post #3

So last week my client discovered there's a gem named bunlder... sigh

There is a gem called bundle which doesn't do anything but preventing a typosquat

https://rubygems.org/gems/bundle Total downloads 1,800,600

Source (empty) at https://github.com/will/bundle and interesting README.

https://rubygems.org/gems/bundler Total downloads 92,116,090

It's almost the 2%.

Re: Typosquatting programming language package managers

#7

Post by zeveb » Wed, Jun 08, 2016, 3:01 PM UTC

Reminds me of the quote, 'there are only two hard things in computer science: naming things, cache invalidation and off-by-one errors.'

I think that this clearly falls under the heading 'naming issue.' People know what they want, but do not enter it properly.

I can't think of a 100% off-hand, which isn't surprising, because it's a hard problem.

pmontra's suggestion to use typo blacklisting ain't a bad idea. Maybe some sort of reputation-per-name could help?

Re: Typosquatting programming language package managers

#8

Post by nichochar » Wed, Jun 08, 2016, 3:02 PM UTC

Wow, this a very good study and explanation of what typo squatting is, and I really liked how he proved it's effectiveness.

I wonder what kind of steps we can take to prevent this risk.

Re: Typosquatting programming language package managers

#9

Post by utexaspunk » Wed, Jun 08, 2016, 3:05 PM UTC

pmontra wrote: post #2

Probably the maintainers of the package managers know which typos their users do, because of the 404s in the logs or equivalent errors. A preventive action could be starting to blacklist any name resolving to 404. If somebody eventually tries to upload a package in the blacklist, a maintainer should check the code and whitelist the name. Obviously people can be very crative with typos and with squattinq and there is…

Might it work to mandate that the name of an uploaded package have a minimum levenshtein distance (or similar calculation) from the names of all the existing packages? Then you wouldn't have to worry about maintaining a blacklist.

Re: Typosquatting programming language package managers

#10

Post by hughes » Wed, Jun 08, 2016, 3:06 PM UTC

pmontra wrote: post #2

Probably the maintainers of the package managers know which typos their users do, because of the 404s in the logs or equivalent errors. A preventive action could be starting to blacklist any name resolving to 404. If somebody eventually tries to upload a package in the blacklist, a maintainer should check the code and whitelist the name. Obviously people can be very crative with typos and with squattinq and there is…

Surely some troll would deploy a fleet of machines that flood package indexes with requests to available names, effectively blacklisting entire dictionaries and eventually all short names.