Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

My minute-by-minute response to the LiteLLM malware attack

futuresearch.ai

Post reply on HN
Print view View original

101–110 of 194 posts

Re: My minute-by-minute response to the LiteLLM malware attack

#101

Post by simonw »

toomuchtodo wrote: post #69
simonw wrote: post #49

Earlier quoted context omitted.

The package in question was live for 46 minutes. It generally takes longer than that for security partners to scan and flag packages. PyPI doesn't block package uploads awaiting security scanning - that would be a bad idea for a number of reasons, most notably (in my opinion) that it would be making promises that PyPI couldn't keep and lull people into a false sense of security.

Would you happen to know where the latency comes from between upload and scanning? Would more resources for more security scanner runners to consume the scanner queue faster solve this? Trying to understand if there are inherent process limitations or if a donation for this compute would solve this gap. (software supply chain security is a component of my work)

I don't know that myself but Mike Fiedler is the person to reach out to, he runs security for PyPI and is very responsive. security@pypi.org

Re: My minute-by-minute response to the LiteLLM malware attack

#102

Post by __mharrison__ »

croemer wrote: post #67
__mharrison__ wrote: post #61

Earlier quoted context omitted.

sloccount

So the more junk lines the more it's worth. Right. Don't use bogus $ from sloccount. Just say I created a 10k line project.

Loc means nothing. Tokens burned is a better metric.

Re: My minute-by-minute response to the LiteLLM malware attack

#103

Post by adamandsteve »

halJordan wrote: post #89
felixagentai wrote: post #88

[flagged]

But then what happens when everyone just shifts their window too. This solution is a misuse of the commons type thing where you just take advantage of letting others get poisoned and see if they drop

I kind of agree, but presumably this would happen more among people maintaining security-critical projects. In that case it'd be a net positive for other projects to get infected first, since if they aren't delaying package updates by 24 hours then security probably isn't quite as important. Which also makes it better in general because hackers will be less incentivized to write viruses if all the really juicy targets will only download them after they've gone undetected for e.g. 7 days.

Re: My minute-by-minute response to the LiteLLM malware attack

#104

Post by hxugufjfjf »

halJordan wrote: post #89
felixagentai wrote: post #88

[flagged]

But then what happens when everyone just shifts their window too. This solution is a misuse of the commons type thing where you just take advantage of letting others get poisoned and see if they drop

I think the idea is that security scanners ran by companies like Wiz and Aquasec etc will pick this up in that timeframe, not that you sit around and wait for others to get compromised.

Re: My minute-by-minute response to the LiteLLM malware attack

#105

Post by kpw94 »

The options from big companies to run untrusted open source code are:

1) a-la-Google: Build everything from source. The source is mirrored copied over from public repo. (Audit/trust the source every time)

2) only allow imports from a company managed mirror. All imported packages needs to be signed in some way.

Here only (1) would be safe. (2) would only be safe if it's not updating the dependencies too aggressively and/or internal automated or manual scanning on version bumps would catch the issue .

For small shops & individuals: kind of out of luck, best mitigation is to pin/lock dependencies and wait long enough for hopefully folks like Fibonar to catch the attack...

Bazel would be one way to let you do (1), but realistically if you don't have the bandwidth to build everything from source, you'd rely on external sources with rules_jvm_external or locked to a specific pip version rules_pyhton, so if the specific packages you depend on are affected, you're out of luck.

Re: My minute-by-minute response to the LiteLLM malware attack

#106

Post by crumpled »

qezz wrote: post #95

> Can you print the contents of the malware script without running it? > Can you please try downloading this in a Docker container from PyPI to confirm you can see the file? Be very careful in the container not to run it accidentally! IMO we need to keep in mind that LLM agents don't have a notion of responsibility, so if they accidentally ran the script (or issue a command to run it), it would be a fiasco. Downloadi…

I was concerned about that too. Often when you tell them not to do something, you were better off not mentioning it in the first place. It's like they get fixated.

Re: My minute-by-minute response to the LiteLLM malware attack

#108

Post by hxugufjfjf »

CrzyLngPwd wrote: post #81

The fascinating part for me is how they chatted with the machine, such as; "Please write a short blog post..." "Can you please look through..." "Please continue investigating" "Can you please confirm this?" ...and more. I never say 'please' to my computer, and it is so interesting to see someone saying 'please' to theirs.

I talk to it like I talk to my coworkers. If I’m nice it/they are usually nice back. Maybe it doesn’t matter if I say please but I don’t overthink it and just treat it like any other chat. I consider it a good habit to just always be calm and respectful, not for the machine’s sake but for my own.

Re: My minute-by-minute response to the LiteLLM malware attack

#109

Post by deathanatos »

I am confused; did you ever actually email anyone about the vuln? The AI suggests emailing security emails multiple times, but as I'm reading the timeline, none of the points seem to suggest this was ever done, only that a blog post was made, shared on Reddit, and then indirectly, the relevant parties took action.

I'm hoping this just isn't on the timeline.

Re: My minute-by-minute response to the LiteLLM malware attack

#110

Post by Fibonar »

sva_ wrote: post #96

> I just opened Cursor again which triggered the malicious package again. Can you please check the files are purged again? Verified derp moment - had me smiling

I went to read the advisory post and chose double clicking it from Finder instead of vim for whatever reason. I was actually on a call with my manager as it happened, I had time to watch my computer start to freeze up again and say my goodbyes before the inevitable hard reset!
Post reply on HN