I feel like installing a security tool by curling a random script off the internet and piping it into `/bin/bash` is a bit contradictory. Surely there's a better way to install this?
Kubescape – tool for testing if Kubernetes is deployed securely
71–80 of 104 posts
Re: Kubescape – tool for testing if Kubernetes is deployed securely
#72[deleted]
Re: Kubescape – tool for testing if Kubernetes is deployed securely
#73I feel like installing a security tool by curling a random script off the internet and piping it into `/bin/bash` is a bit contradictory. Surely there's a better way to install this?
If you're smart enough to realize that there might be something to worry about, you should be smart enough to be able to figure out how to divide the command into three parts instead of one (download the script, inspect the contents and then run the same inspected [local] script).
Every time a project with curl | sh is featured on HN this comes up. At this point we might as well write a bot that scrapes submitted pages for "curl * | * (sh|bash)" and leave this comment for all of them.
Re: Kubescape – tool for testing if Kubernetes is deployed securely
#74Earlier quoted context omitted.
What's the advantage of binary packages through GitHub releases? How do you audit them? I'm aware of the fact that you can detect curl | bash server-side, and it's a neat trick, but I don't understand the security risk of it. The server is supplying you with arbitrary content that you're not auditing - what does it matter if it supplies you different arbitrary content? What's the advantage of the GPG approach? Last I…
I think you may be conflating the application owner and the delivery system. If we're installing the application I think we're implicitly trusting the author. If you copy/paste http instead of https then you've given execution control to every single middlebox along the way. If the code is hosted on an evil sourceforge, then you've given them execution control. deb packages will do signature checks, any many authors…
deb packages will not do signature checks. The signature checks for anything based on deb is rooted in the repository- the repositories package list contains the checksums for the packages and the signature of the repository maintainer. If you fetch a single package from a website and install it, no signature is present. Any check would need to happen out of band by explicitly checking a signature presented elsewhere. RPM packages, however can embed a signature.
Re: Kubescape – tool for testing if Kubernetes is deployed securely
#75And hacking it on the occasion
Re: Kubescape – tool for testing if Kubernetes is deployed securely
#76There's CIS KubeBench and OpenSCAP as other comments mentioned. I don't trust an organization that keeps Zero days to themselves for offensive capabilities.
The NSA is much like the FBI, it has multiple divisions with different purposes. The NSA has one group that is specifically focused on the security of US public and private entities. They help to find standards that the rest of the US bureaucracy follows to keep their systems secure. On the other hand, the NSA does have hacking hand that is supposed to go after foreign adversaries, and this is the group that will use…
> specifically focused on the security of US public and private entities
> this is the group that will use zero day hack
So, the initial comment was right. NSA does keep zero days to themselves so obviously other things are more important than the security of US public/private entities. Otherwise they'd want those patches, but other missions are more important.
Re: Kubescape – tool for testing if Kubernetes is deployed securely
#77Does the NSA/CISA advice differ significantly from CIS? KubeBench does a great job of CIS assessment.
CIS is very prescriptive. It gives you a list of very specific checks with very little context. NSA, on the other hand, explains the problems and potential attack vectors allowing you to adjust and extend the checks to your specific needs.
Re: Kubescape – tool for testing if Kubernetes is deployed securely
#78Earlier quoted context omitted.
The linked repo isn't from the NSA, it's from armosec. Who, afaict, don't have zero days in their possession.
Sorry misread ... You are right. Still, I will not execute a shell script from a github repository to find security issues ...
Well, this is exactly why it's the open source. You can build everything yourself, check the scripts etc. At the end of the day all these tools are intended to help people find issues as early as possible.
Re: Kubescape – tool for testing if Kubernetes is deployed securely
#79[deleted]
Re: Kubescape – tool for testing if Kubernetes is deployed securely
#80Earlier quoted context omitted.
I understand. That only moves the problem to where you get the signature from, it doesn't solve it (unless you are using a central repo you already trust for example). Therefore binary packages shipped on a GitHub releases page alongside a signature file still face the same issue. An attacker simply has to replace both the package and the signature with one they control. It is nothing to do with the packaging format…
No, you don’t get it. Once you have the root of trust you can download new signed packages in perpetuity and know they came from the developer. They can be delivered over http/smpt/telnet/BitTorrent/ftp/whatever. You can literally pull it from a compromised machine with an active attacker and it doesn’t matter. It either has integrity and it’s safe or it fails to install. That’s a huge difference from encouraging peo…
This only solves the problem of trusting updates, not the initial installation. For new software, "curl | sh" is no different from installing a random deb package from GitHub.