Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

socket.dev

Post reply on HN
Print view View original

231–240 of 458 posts

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#231

Post by seanw444 »

elAhmo wrote: post #219
embedding-shape wrote: post #129

Earlier quoted context omitted.

326 packages right now when doing a build. Seems large in general, but for a Rust project, not abnormal. Takes what, maybe 15 seconds to compile on a high-core machine from scratch? Isn't the end of the world. Worse is the scope to have to review all those things, if you'd like to use it for your main passwords, that'd be my biggest worry. Luckily most are well established already as far as I can tell.

"326 seems large, but not abnormal" was the state of JS in the past as well. Chance of someone auditing all of them is virtually zero, and in practice no one audits anything, so you are still effectively blindly trusting that none of those 326 got compromised.

It is baffling to me that a language that is as focused on safety/security as Rust decided to take the JavaScript approach to their ecosystem. I find it rather contradictory.

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#232

Post by 12_throw_away »

Sohcahtoa82 wrote: post #138
reactordev wrote: post #113

Earlier quoted context omitted.

that's our future... with AI. Engineers that don't know the difference between client-side convenience and server-side injection, how to configure `php.ini`, or that no synchronized password manager is safe. While the OAuth scope is `*`, and CORS is what you drink on the weekend.

Can someone explain why people struggle with CORS? The full strength of the SOP applies by default. CORS is an in security feature that relaxes the SOP. Unless you need to relax the SOP, you shouldn't be enabling CORS, meaning you shouldn't be sending an Access-Control-Allow-Origin header at all. If your front-end at www.example.com makes calls to api.example.com, then it's simple enough to just add www.example.com t…

IME, CORS is pretty straightforward in prod but can be a huge pain in dev environments, so you end up with lots of little hacks to get your dev environments working (and then one of those hacks leaks back into prod and now you have CORS problems in prod).

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#234

Post by bonzini »

doctorpangloss wrote: post #201
edf13 wrote: post #195

Earlier quoted context omitted.

Manually review the package and override the setting

The flaw of the cooldown solution speaks for itself.

Still it's something like a second factor (or even, literally, overriding might require 2FA).

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#235

Post by gnfurlong »

SV_BubbleTime wrote: post #187
prima-facie wrote: post #57

This is precisely why I don't use BW CLI. Use pass or gopass for all your CLI tokens and sync them via a private git repo. Keep the password manager as a separate desktop app and turn off auto update.

A supply chain issue that hadn’t happened to BW CLI before is exactly why you use other CLIs that seem to be identically vulnerable to the same issues?

That's just not true.

The original pass is just a single shell script. It's short, pretty easy to read and likely in part because it's so simple, it's also very stable. The only real dependencies are bash, gnupg and optionally git (history/replication). These are most likely already on your machine and whatever channel you're getting them from (ex: distribution package manager) should be much more resilient to supply chain vulnerabilities.

It can also be used with a pgp smartcard (in my case a Yubikey) so all encryption/decryption happens on the smartcard. Every attempt to decrypt a credential requires a physical button press of the yubikey, making it pretty obvious if some malware is trying to dump the contents of the password store.

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#236

Post by pixel_popping »

post-it wrote: post #225
pixel_popping wrote: post #86

Earlier quoted context omitted.

Why not stick to simple/heavily vetted password managers (like keepassx)? is there some advanced feature you use?

I hope you're not using KeePassX, it's been unmaintained for years. KeePassXC is only available for Linux, which means I'd need to use a third-party app for Mac and iOS, so I'd be trusting three vendors instead of one. Aside from passwords, I store passkeys, secure notes, and MFA tokens.

KeePassXC is cross-platform, unsure about iOS.

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#237

Post by aftbit »

eranation wrote: post #152
flossly wrote: post #15

Never used the CLI, but I do use their browser plugin. Would be quite a mess if that got compromised. What can I do to prevent it? Run old --tried and tested-- versions? Quite bizarre to think much much of my well-being depends on those secrets staying secret.

How to prevent it? tl;dr - https://cooldowns.dev - https://depsguard.com (disclaimer: I maintain the 2nd one, if I knew of the first, I wouldn't have released it, just didn't find something at that time, they do pretty much the same thing, mine in a bit of an overkill by using rust...)

Do either of those work on browser extensions that I install as a user? I don't see anything relating to extensions in there.

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#238

Post by dnnddidiej »

hootz wrote: post #122
nothinkjustai wrote: post #49

Remember how the White House published that document on memory safe languages? I think it’s time they go one step further and ban new development in JavaScript. Horrible language horrible ecosystem and horrible vulns.

Supply chain attacks aren't exclusive to JS just like malware isn't exclusive to Windows, it's just that JS/Windows is more popular and widespread. Kill JS and you will get supply chain attacks on the next most popular language with package managers. Kill Windows and you will get a flood of Linux/MacOS malware.

JS apps need more direct dependencies and transitives to do basic things vs. other languages.
Post reply on HN