Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Social engineering takeovers of open source projects

openssf.org

Post reply on HN
Print view View original

221–230 of 379 posts

Re: Social engineering takeovers of open source projects

#221

Post by porcoda »

wiseowise wrote: post #206

Can we, PLEASE, return back to batteries-included first? While it doesn’t eliminate the threat completely, but I can sleep soundly knowing that I need to vet one party instead of 1000.

+1. My team still favors batteries-included style systems, even if it means missing out on the latest thing all the cool kids on the internet are talking about. For languages, this usually means sticking with the standard library that ships with it along with one or two libraries that augment it (e.g., BOOST for C++). It's not like "batteries included" eliminates the problem - a bad actor can wander in there and cause trouble. It's just a much more controlled environment that often has a process for contributing. I'm not a fan of the move of languages away from rich standard libraries to the "Random Interconnected Pile Of Internet Stuff".

Unfortunately people like me are in the minority it seems, and the "move fast and break stuff" mentality seems to still dominate the open source world even if that phrase has fallen out of favor - the attitude still seems to exist.

Re: Social engineering takeovers of open source projects

#222

Post by VoidWhisperer »

throwaway2037 wrote: post #195
transpute wrote: post #174

Earlier quoted context omitted.

US gov has encouraged finance/tech industry to invest in the security of OSS supply chains. OpenSSF members: https://openssf.org/about/members 2021, $10MM, https://openssf.org/press-release/2021/10/13/open-source-sec... > Financial commitments from Premier members include Amazon, Cisco, Dell Technologies, Ericsson, Facebook, Fidelity, GitHub, Google, IBM, Intel, JPMorgan Chase, Microsoft, Morgan Stanley, Oracle, Red…

Why did Eclipse org get so much and Apache org none/less? In my experience, the footprint of Apache exceeds anything else in enterprise programming.

This also struck me as a bit odd.. even more so when you consider that over recent years, eclipse's general usage over time has decreased

Re: Social engineering takeovers of open source projects

#223

Post by Teknomancer »

soks86 wrote: post #190
chipdart wrote: post #188

Earlier quoted context omitted.

I did not referred to the funding remark. It is besides the point and immaterial to the discussion. My point was on the remark that this attack vector is somehow only applicable when projects are starting out. This is false, and insinuating this does a disservice to the community. The attack consists of asking someone for the keys. The projects that are the most vulnerable are those who are already established and ha…

The comment was not sincere and is meant to amuse. If you believe amusement is a disservice to the community then I believe many others disagree. edit: For clarity, the "since inception" part is an absurd setup for the, equally absurd, "well funded open source" part.

Taking over Open Source, just for the LULz.

There is an extreme lack of sense of humor around these parts.

I lol'd, and thank you for that.

Re: Social engineering takeovers of open source projects

#224

Post by logrot »

throwaway2037 wrote: post #192

> This approach bears strong resemblance to the manner in which “Jia Tan” positioned themselves in the XZ/liblzma backdoor. No, it doesn't. I stopped after read this. Jia's "attack" was near state level actor stuff. A bunch of emails asking/begging for commit access sounds like a 16 year old sending emails from the basement of his parent's house.

> A bunch of emails asking/begging for commit access

This is not what it says. If you're going to argue, argue with the text from the article not a made up reinterpretation.

Re: Social engineering takeovers of open source projects

#225

Post by guappa »

em-bee wrote: post #52
kazinator wrote: post #44

> Enable two-factor authentication (2FA) or Multifactor Authentication (MFA). Not on any third party system, where you're locked out forever if you lose your second factor. Fuck that! Only self-hosted, where you can recover via physical access. (That should actually be the first advice: host the stuff yourself. People lose control of projects due to hosting them on third party services. Be the guy who can pull the po…

yes and no. i hate 2FA as well, but in the end, even if i loose my access to github i only loose access to my github identity but i don't loose access to my code, so i can live with that. of course in the light of this discussion losing access to my github identity would be part of the problem, so it's a tradeoff. is it more likely that someone will break into my account and abuse my identity if i don't have 2FA or i…

> if i loose my access to github i only loose access to my github identity but i don't loose access to my code, so i can live with that.

That means that you need to fork your own project, and there is no way to communicate it to the users, since the new account could just be someone pretending to be you.

If there is a security vulnerability, it would remain unfixed forever.

> is it more likely that someone will break into my account and abuse my identity if i don't have 2FA or is it more likely that i loose my second factor and have to rebuild my identity

Since phones are very easy to break, and until very recently there was no way to backup google authenticator, I'd say that losing your 2nd factor was the most likely of the two.

Now if you say that you backup your 2nd factor seed in your password manager, where your password is… congratulations you're doing over-complicated 1 factor authentication!

Re: Social engineering takeovers of open source projects

#226

Post by guappa »

samatman wrote: post #64
kazinator wrote: post #44

> Enable two-factor authentication (2FA) or Multifactor Authentication (MFA). Not on any third party system, where you're locked out forever if you lose your second factor. Fuck that! Only self-hosted, where you can recover via physical access. (That should actually be the first advice: host the stuff yourself. People lose control of projects due to hosting them on third party services. Be the guy who can pull the po…

> Not on any third party system, where you're locked out forever if you lose your second factor. Every two-factor system I've ever seen is actually two-of-three, with an account recovery code that you save elsewhere. I lost all my two-factor auths when my phone got wrecked, it was annoying to reestablish access to those accounts (and I now use a TOTP client which backs the tokesn up), but it was tedious rather than d…

It was not difficult because you actually had the recovery codes. How many people have them?

Also you're supposed to print them. Where? How many people own a printer? If you print them in a shop they can be considered compromised.

Re: Social engineering takeovers of open source projects

#227

Post by lynx23 »

pants2 wrote: post #175
willvarfar wrote: post #168

So next the attackers playing the long game will just set out to develop the next great everybody-uses-it open-source library, so they control it from inception? Great that we'll finally get state-sponsored open-source development :D

The ideal state is having the world's superpowers all devoting effort to improving open source libraries, but all catching each others' backdoors and at the end of the day improving security for everyone.

Sounds like asking for World Peace.

Re: Social engineering takeovers of open source projects

#229

Post by jmakov »

andix wrote: post #13

Maybe we need a reporting system for maintainer changes of bigger projects. Some list where they get published and people can keep an eye on it. Those changes of maintainers need to be synced to package distribution sites like npm.js or Debian packages and put in context with versions/releases. In Europe this was introduced for banks after the banking crisis. If a bank does any organizational change, a report is sent…

Is it really though? Cum-ex and cumcum appear to still work great.

Re: Social engineering takeovers of open source projects

#230

Post by shiroiushi »

NonDairyMatt wrote: post #133
zer00eyz wrote: post #11

Earlier quoted context omitted.

Your average American could quit working for 5 million dollars. They could live comfortably for the rest of their lives off that money, if well invested (read EFT for sp500) 5 million bucks is change for you average government. "Amazon made billions on my project and if I turn a blind eye to this I can retire, fuck them..." Sponsorship, for good or bad makes a lot of decisions simple.

Probably wouldn't even need 5 Million. According the the PBS article about the 2 US Navy sailors arrested for spying around august of last year one of them was apparently only bribed $10k-15K for the year [1]. I was pretty shocked at first but it made sense that with the financial stress many face in today's market a 10K bribe would go along way and have a high return on investment especially if the potential payoff…

>2 US Navy sailors arrested for spying around august of last year one of them was apparently only bribed $10k-15K for the year

This is exactly why investigations for security clearances focus mostly on a person's financial situation: someone who has a lot of debt and shows a pattern of poor financial management, i.e. someone who'd jump at a chance to make an extra measly $10k, is the kind of person they want to avoid giving a high security clearance to, because of incidents exactly like this.

It's a common misconception that clearance holders who sell secrets make a lot of money doing so, and this just isn't the case: it's comparatively small amounts like this. For someone who's deep in debt and desperate, it doesn't take much to buy them.

Post reply on HN