Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Abusing Go's Infrastructure

reverse.put.as

Post reply on HN
Print view View original

11–20 of 80 posts

Re: Abusing Go's Infrastructure

#11

Post by miki123211 »

Any online service that lets users upload material that is then publicly visible will eventually be used for command-and-control, copyright infringement and hosting CSAM. This is especially true for services that have other important uses besides file hosting and hence are hard to block.

This already happened to Twitter[1], Telegram[2], and even the PGP key infrastructure[3], not to mention obvious suspects like GitHub.

[1] https://pentestlab.blog/2017/09/26/command-and-control-twitt... [2] https://www.blazeinfosec.com/post/leveraging-telegram-as-a-c... [3] https://torrentfreak.com/openpgp-keyservers-now-store-irremo...

Re: Abusing Go's Infrastructure

#12

Post by arccy »

ithkuil wrote: post #10

I toyed with the idea of piggybacking on (i.e. abusing) the golang proxy and sumdb to have a free transparent log of checksums of arbitrary URLs https://getsum.pub/

sounds convoluted. If you just want a public transparency log, the public rekor instance under the sigstore project is much more appropriate for that.

https://www.sigstore.dev/

https://docs.sigstore.dev/logging/overview/

Re: Abusing Go's Infrastructure

#14

Post by oooyay »

arccy wrote: post #2

it's a known issue https://github.com/golang/go/issues/31866

Color me unsurprised Marwan is on this issue. He and Aaron wrote Athens, Marwan wrote (to my knowledge) the first Go download protocol implementation that Athens is based on.

This issue is kind of curious because Athens already uses the go mod download -json command mentioned as a preflight check for module verification. More or less, if the repo passes the go module commands understanding of a module then Athens will serve it. In more verboten terms:

- a module version, pseudo version, or +incompatible must be able to be formulated

- that module (and it's dependencies) must produce a valid checksum

The checksum of modules just has to do with the current .mod and all files + recursively for each dependency. So, as the author pointed out you can have lots of space for arbitrary files by design so long as you have a basic go program.

Re: Abusing Go's Infrastructure

#15

Post by lpapez »

arccy wrote: post #12
ithkuil wrote: post #10

I toyed with the idea of piggybacking on (i.e. abusing) the golang proxy and sumdb to have a free transparent log of checksums of arbitrary URLs https://getsum.pub/

sounds convoluted. If you just want a public transparency log, the public rekor instance under the sigstore project is much more appropriate for that. https://www.sigstore.dev/ https://docs.sigstore.dev/logging/overview/

Sure, but the gosum database is a critical piece of worldwide software infrastructure, so you can count on it being accesible behind many firewalls and always up. And it's completely free and anonymus.

Perfect for the purpose.

Re: Abusing Go's Infrastructure

#16

Post by ithkuil »

arccy wrote: post #12
ithkuil wrote: post #10

I toyed with the idea of piggybacking on (i.e. abusing) the golang proxy and sumdb to have a free transparent log of checksums of arbitrary URLs https://getsum.pub/

sounds convoluted. If you just want a public transparency log, the public rekor instance under the sigstore project is much more appropriate for that. https://www.sigstore.dev/ https://docs.sigstore.dev/logging/overview/

Yeah when I did that there was no public rekor instance ran by the sigstore project so I choose the only available public transparency log I could bend to my needs (x509 transparency logs were an alternative but it'd quickly hit rate limits by acme providers)

Re: Abusing Go's Infrastructure

#17

Post by Maxatar »

bee_rider wrote: post #6
8organicbits wrote: post #4

I know pypi has some non-python projects as well. Python needs the ability to distribute wheels, which are compiled binaries, as the user may not be able to compile library code. Lots of that code is written in C, but Golang[1] is also possible. I can't find an example, but I believe I've seen this used for distributing applications (not libraries) as well. It's kinda cool to write some app in C, upload to pypi, and…

Hypothetically if they did try to add some requirement to use Python, people could just comply maliciously by providing the most minimal stub of Python code, right? Linux, but ls is written in Python. So it is probably better just to not play games.

You could embed the binary data in a Python string and then have the installer dump that string to a file.

Re: Abusing Go's Infrastructure

#19

Post by IshKebab »

rfoo wrote: post #7
8organicbits wrote: post #4

I know pypi has some non-python projects as well. Python needs the ability to distribute wheels, which are compiled binaries, as the user may not be able to compile library code. Lots of that code is written in C, but Golang[1] is also possible. I can't find an example, but I believe I've seen this used for distributing applications (not libraries) as well. It's kinda cool to write some app in C, upload to pypi, and…

pip install cmake or even proprietary binaries, pip install nvidia-cudnn-cu12

Yeah I copied CMake's idea of using PyPI and I also use it to distribute some pure Rust CLI tools using Maturin. It works really well. Pip is... well it's about on par with most other package managers, i.e. not great, not terrible, but it has some pretty huge advantages over any other software distribution method on Linux:

* Very likely to be installed already on Linux and probably Mac too.

* Doesn't require root to install. You can even have isolated installs via pyenv.

* I don't have to ask anyone's permission to publish a package.

* I only have to make one package.

If any can think of a better option I'm all ears but until then I'm fairly happy with this hack.

Re: Abusing Go's Infrastructure

#20

Post by IshKebab »

Maybe I'm being stupid but what exactly is the issue here? It's probably a bit wasteful of the proxy to cache non-Go repos, but even if it didn't you could make it store arbitrary data just by having it cache a Go repo surely? Sounds like a complete non-issue unless I've missed something.
Post reply on HN