Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Incident Report: CVE-2024-YIKES

nesbitt.io

Post reply on HN
Print view View original

161–170 of 187 posts

Re: Incident Report: CVE-2024-YIKES

#161

Post by isityettime »

b40d-48b2-979e wrote: post #117
duped wrote: post #97

Earlier quoted context omitted.

sys crates are also mostly generated and lack a lot of eyeballs. Sneaking something into the build.rs of a sys crate would not be difficult and would land in the builds of everything downstream of it.

would not be difficult Surely that's why we see evidence of all these build script attacks, since it's so easy?

We do in fact see them a lot. Typically they target Python or Node because those ecosystems are much more popular than Rust. But build.rs provides exactly the same opportunities to attackers for Rust.

Re: Incident Report: CVE-2024-YIKES

#162

Post by bpavuk »

inventor7777 wrote: post #154
bpavuk wrote: post #53

the Karen one gave me a good laugh :D ;) reminds me of a `make`-based build script I once got when reviewing a classmate's project - it attempted to `rm -rf` my home folder if the hostname contains `bpavuk`. that was in seventh grade!!

That seems _awfully_ extreme LOL

I have kinda been the most hated guy in that city. constant movement across Ukraine, mentality mismatch, all the usual things. my family was treated as foreigners everywhere except Kyiv.

and you know what? I'm grateful to them all for leveling up my opsec, among other things :)

Re: Incident Report: CVE-2024-YIKES

#163

Post by duped »

zbentley wrote: post #24
fleventynine wrote: post #8

Earlier quoted context omitted.

Many small crates published by large, trustworthy projects are fine and preferable to one large crate that "does everything".

Why? Honest question. Commons, Guava, Spring, and more seem to take this approach successfully (as in, the drawbacks are outweighed by the benefits in convenience, quality, and security) in Java. Are benefits in binary size really worth that complexity? And before someone says “just have a better standard library”, think about why that is considered a solution here. Languages with a large and capable standard library…

Rust's compilation unit is a crate. Counting crates is like counting source files in C++.

> Are benefits in binary size really worth that complexity?

What complexity?

Re: Incident Report: CVE-2024-YIKES

#164

Post by smsm42 »

b473a wrote: post #98
smsm42 wrote: post #93

Earlier quoted context omitted.

Searching for CVE-2024-YIKES also provides a gallery of AI slop blogs that AI-rewrite the content of this post while being absolutely stone cold serious about it.

Currently a Google search for vulpine-lz4 gives a very serious AI overview.

Somebody did it: https://github.com/seqizz/vulpine-lz4

Re: Incident Report: CVE-2024-YIKES

#165

Post by menno-sh »

shakna wrote: post #106
walrus01 wrote: post #85

Earlier quoted context omitted.

I actually wonder if somebody used a fake identity to set up an account with a warehousing/shipment fulfillment company that stocks things and ships them, then set up the appropriate EDI pipeline to send shipping orders to it... What would be the results if a decently budgeted adversary made something attractive looking that shipped malicious USB flash drives to anyone that requested one. I know we're not in the era…

A USB that was both storage and a keyboard, that executed the keystrokes to download malware, was demo'd at a DefCon a few years back.

Even worse than a rubber ducky: the O.MG cable does the same thing, but looks like a regular USB cable. Their Apple Lightning-dupe [0] is my favorite. The creator was on Darknet Diaries a while ago, too. [1]

[0] https://shop.hak5.org/products/omg-cable [1] https://darknetdiaries.com/episode/161/

Re: Incident Report: CVE-2024-YIKES

#166

Post by crumpled »

shakna wrote: post #106
walrus01 wrote: post #85

Earlier quoted context omitted.

I actually wonder if somebody used a fake identity to set up an account with a warehousing/shipment fulfillment company that stocks things and ships them, then set up the appropriate EDI pipeline to send shipping orders to it... What would be the results if a decently budgeted adversary made something attractive looking that shipped malicious USB flash drives to anyone that requested one. I know we're not in the era…

A USB that was both storage and a keyboard, that executed the keystrokes to download malware, was demo'd at a DefCon a few years back.

BadUSB, Blackhat 2014.

That's almost 12 years now. A novice can now get ATmega32 USB devices Prime delivered. Not a cutting edge theoretical attack anymore but a basic tool in a every pen tester's toolbox now.

Re: Incident Report: CVE-2024-YIKES

#167

Post by b40d-48b2-979e »

isityettime wrote: post #161
b40d-48b2-979e wrote: post #117

Earlier quoted context omitted.

would not be difficult Surely that's why we see evidence of all these build script attacks, since it's so easy?

We do in fact see them a lot. Typically they target Python or Node because those ecosystems are much more popular than Rust. But build.rs provides exactly the same opportunities to attackers for Rust.

No, we don't. We see build system attacks, such as injecting malicious scripts into their CI and getting malicious code into the artifact for use at runtime. You don't see someone doing a drive-by PR to a `setup.py`.

Re: Incident Report: CVE-2024-YIKES

#168

Post by isityettime »

b40d-48b2-979e wrote: post #167
isityettime wrote: post #161

Earlier quoted context omitted.

We do in fact see them a lot. Typically they target Python or Node because those ecosystems are much more popular than Rust. But build.rs provides exactly the same opportunities to attackers for Rust.

No, we don't. We see build system attacks, such as injecting malicious scripts into their CI and getting malicious code into the artifact for use at runtime. You don't see someone doing a drive-by PR to a `setup.py`.

Not a drive-by PR, but once a package is compromised it often does spread to its reverse-dependencies via mechanisms like setup.py at build time. There was case like this with setup.py less than two months ago: https://www.stepsecurity.io/blog/forcememo-hundreds-of-githu...

Lots of npm supply chain attacks propagate at build time via post-install hooks, too.

Re: Incident Report: CVE-2024-YIKES

#169

Post by fc417fc802 »

pocksuppet wrote: post #144
cassianoleal wrote: post #32

Earlier quoted context omitted.

In any case, not really a hacker's creed. This has always been withinin the realm of corporations, especially Silicon Valley or adjacent.

Hackers were moving fast and breaking things first. Faster than any corporation in fact. We didn't notice because their computers weren't powering anything useful. How do you think projects like GNU happened?

Ah yes, GNU. Well known for prioritizing speed and pragmatism over perfection. That's why Hurd ended up winning out over Linux. /s

Re: Incident Report: CVE-2024-YIKES

#170

Post by User-MBAB »

jmusall wrote: post #130
fvv wrote: post #126

Earlier quoted context omitted.

Just because it's not important to pay attention to CVEs, why not waste the readers' time by creating "fictional" CVEs without a disclaimer in the first line? Just because it's not already difficult to scrape through the information and noise on this internet... especially if it appears on the front page of hackernews

Could one mistake this > Status: Resolved (accidentally) > Severity: Critical → Catastrophic → Somehow Fine for a real CVE report?

Have you not read CVEs as of late? As a precondition for getting their funding back, all the doge boys get to write the CVEs for their own orgs. Insane parentheticals about trans people is the norm now.
Post reply on HN