Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

socket.dev

Post reply on HN
Print view View original

131–140 of 458 posts

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#131

Post by harshreality »

trinsic2 wrote: post #17
1024kb wrote: post #7

I had a really bad experience with the bitwarden cli. I believe it was `bw list` that I ran, assuming it would list the names of all my passwords, but too my surprise, it listed everything, including passwords and current totp codes. That's not the worst of it though. For some reason, when I ssh'ed into one of my servers and opened tmux, where I keep a weechat irc client running, I noticed that the entire content of…

Wow. Thats crazy. Is there an extension for bwcli in weechat? BTW I didnt even know BW had a cli until now. I use keepass locally.

It's crazy because it's not default bw behavior, or even any bw behavior... I don't use the cli, but I don't see any built-in capacity to copy bw output to the clipboard. (In the UNIX way, you'd normally pipe it to a clipboard utility if you wanted it copied, and then the security consequences are on you.)

They probably caused it themselves, somehow, and then blamed bitwarden. Note in the original comment they aren't even entirely sure what the command was, and they weren't familiar with it or they wouldn't have been surprised by its output... so how can they be sure what else they did between that command and the weechat thing?

If the terminal or tmux fed terminal history into weechat, that's also not bw's problem.

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#132

Post by Perz1val »

mobeigi wrote: post #20

KeePass users continue to live the stress free live. I've managed to avoid several security breaches in last 5 years alone by using KeePass locally on my own infra.

Ok, single file, blah, blah. Realistically how do you sync that and how do you resolve conflicts? What happens if two devices add a password while offline, then go online?

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#133

Post by xienze »

1024kb wrote: post #26
mobeigi wrote: post #20

KeePass users continue to live the stress free live. I've managed to avoid several security breaches in last 5 years alone by using KeePass locally on my own infra.

I need my passwords to be accessible from my infrastructure and my phone. How do you achieve this with KeePass? I assumed it was not possible, but in fairness, I haven't really gone down that rabbit hole to investigate.

I use self-hosted Bitwarden (Vaultwarden) for this. It runs on my local network, and I have it installed on my phone etc. When I’m on my local network, everything works fine. When I’m not on my local network, the phone still has the credentials from the last time it was synced (i.e., last time it was used while the phone was on the home network). It’s a pretty painless way to keep things in sync without ever allowing Bitwarden to be accessible outside my home network.

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#134

Post by aborsy »

worble wrote: post #38
1024kb wrote: post #26

Earlier quoted context omitted.

I need my passwords to be accessible from my infrastructure and my phone. How do you achieve this with KeePass? I assumed it was not possible, but in fairness, I haven't really gone down that rabbit hole to investigate.

Keepass is just a single file, you can share it between devices however you want (google drive, onedrive, dropbox, nextcloud, syncthing, rsync, ftp, etc); as long as you can read and write to it, it just works. There are keepass clients for just about everything (keepassxc for desktops, keepass2android or keepassdx for android, keepassium for iphone).

How is the quality of browser extensions compared to Bitwarden?

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#135

Post by srigi »

uyzstvqs wrote: post #94
flossly wrote: post #15

Never used the CLI, but I do use their browser plugin. Would be quite a mess if that got compromised. What can I do to prevent it? Run old --tried and tested-- versions? Quite bizarre to think much much of my well-being depends on those secrets staying secret.

We need cooldowns everywhere , by default. Development package managers, OS package managers, browser extensions. Even auto-updates in standalone apps should implement it. Give companies like Socket time to detect malicious updates. They're good at it, but it's pointless if everyone keeps downloading packages just minutes after they're published.

That is why we have discussions like these: https://x.com/i/status/2039099810943304073

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#136

Post by wing-_-nuts »

ffsm8 wrote: post #65
flossly wrote: post #15

Never used the CLI, but I do use their browser plugin. Would be quite a mess if that got compromised. What can I do to prevent it? Run old --tried and tested-- versions? Quite bizarre to think much much of my well-being depends on those secrets staying secret.

You should use hunter2 as your password on all services. That password cannot be cracked because it will always display as ** for anyone else. My password is *****. See? It shows as asterisks so it's totally safe to share. Try it! ... Scnr •́ ‿ , •̀

ah, the old bash.org.

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#137

Post by lern_too_spel »

brightball wrote: post #48
zerkten wrote: post #43

Earlier quoted context omitted.

Integration points increase the risk of compromise. For that reason, I never use the desktop browser extensions for my password manager. When password managers were starting to become popular there was one that had security issues with the browser integration so I decided to just avoid those entirely. On iOS, I'm more comfortable with the integration so I use it, but I'm wary of it.

The problem is that the UX with a browser extension is so much better.

Also, you want to avoid exposing your passwords through the clipboard as much as possible.

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#138

Post by Sohcahtoa82 »

reactordev wrote: post #113
cobolcomesback wrote: post #107

Earlier quoted context omitted.

Not to mention utter nonsense. There’s no possible way that BW CLI somehow injected command history into a remote server. That was 100% something the GP did, a bug in their terminal, or a config they have with ssh/tmux, not Bitwarden.

that's our future... with AI. Engineers that don't know the difference between client-side convenience and server-side injection, how to configure `php.ini`, or that no synchronized password manager is safe. While the OAuth scope is `*`, and CORS is what you drink on the weekend.

Can someone explain why people struggle with CORS?

The full strength of the SOP applies by default. CORS is an insecurity feature that relaxes the SOP. Unless you need to relax the SOP, you shouldn't be enabling CORS, meaning you shouldn't be sending an Access-Control-Allow-Origin header at all.

If your front-end at www.example.com makes calls to api.example.com, then it's simple enough to just add www.example.com to CORS.

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#139

Post by xvedejas »

mayama wrote: post #112
pregnenolone wrote: post #91

Earlier quoted context omitted.

Well.. https://github.com/doy/rbw/blob/main/Cargo.toml#L16 You're still pulling a lot of dependencies. At least they're pinned though.

That's just direct dependencies. Including all the dependency tree is 785k LOC according to lib.rs. Most rust libraries include tons of others. https://lib.rs/crates/rbw

Does this take into account feature flags when summing LOC? It's common practice in Rust to really only use a subset of a dependency, controlled by compile-time flags.

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#140

Post by jaxefayo »

pregnenolone wrote: post #45
mobeigi wrote: post #20

KeePass users continue to live the stress free live. I've managed to avoid several security breaches in last 5 years alone by using KeePass locally on my own infra.

> KeePass users continue to live the stress free live. https://cyberpress.org/hackers-exploit-keepass-password-mana...

I think most people use keepassxc, not original keepass.
Post reply on HN