Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I found 10k GitHub repositories distributing Trojan malware

orchidfiles.com

Post reply on HN
Print view View original

21–30 of 268 posts

Re: I found 10k GitHub repositories distributing Trojan malware

#21

Post by fsflover »

tuwtuwtuwtuw wrote: post #16
embedding-shape wrote: post #9

Earlier quoted context omitted.

> the principle that open-source software can't do anything nefarious because the source is open just hasn't held up for a lot of reasons You've been living on such a principle? That sounds insane, why would something not be nefarious just because you can read the code? The way I was "raised" by FOSS greybeards screaming at me through web forums, was that any software available on 3rd party websites anyone can upload…

> You've been living on such a principle? I have not, but in case you missed it, this principle has been used by open source proponents for decades. I'm an open source developer myself, but always found it odd.

This is not the argument at all. It's just easier to discover malware in closed software.

Re: I found 10k GitHub repositories distributing Trojan malware

#22

Post by vel0city »

weird-eye-issue wrote: post #19
StableAlkyne wrote: post #17

> I typed the project name into Google, and my repository appeared in the results. I entered the same query into Bing, and someone else’s repository appeared in the results Side story, this kind of thing is what made me stop using Bing. I had been using it as the default for searches (it sucks, but it's at least not Google), until I landed on a phishing page for my bank (I haven't committed it to memory yet). The pag…

This is where password managers are useful because they would refuse to fill in login information since the domain doesn't match

"Dang, this site isn't working right with the password manager's detection. Guess I just gotta paste the password in again..."

Meanwhile U2F/Passkeys can't possibly be abused like this.

Re: I found 10k GitHub repositories distributing Trojan malware

#23

Post by tjoff »

vel0city wrote: post #22
weird-eye-issue wrote: post #19

Earlier quoted context omitted.

This is where password managers are useful because they would refuse to fill in login information since the domain doesn't match

"Dang, this site isn't working right with the password manager's detection. Guess I just gotta paste the password in again..." Meanwhile U2F/Passkeys can't possibly be abused like this.

Yeah but the downsides of passkeys make them so much worse anyway.

Re: I found 10k GitHub repositories distributing Trojan malware

#24

Post by bonoboTP »

vel0city wrote: post #22
weird-eye-issue wrote: post #19

Earlier quoted context omitted.

This is where password managers are useful because they would refuse to fill in login information since the domain doesn't match

"Dang, this site isn't working right with the password manager's detection. Guess I just gotta paste the password in again..." Meanwhile U2F/Passkeys can't possibly be abused like this.

Exactly. All these ideals work in theory but then in reality banks are also incompetent and will use all kinds of domains.

Same with meta and Google where they often direct you to domains that aren't under their main one and it's actually legit, but there's no way to know. It's impossible to teach family members to pay attention if it's really that domain because it's often legit not that domain.

Re: I found 10k GitHub repositories distributing Trojan malware

#26

Post by CapsAdmin »

embedding-shape wrote: post #14
emodendroket wrote: post #12

Earlier quoted context omitted.

No, I've not been "living on" such a principle but it was a big claim for "the bazaar."

Aha, wasn't that argument more about that closed source software is more likely to hide stuff you don't agree with, than FOSS? Not necessarily that FOSS won't have any viruses or malware, but it's at least less likely. That was my take away, but long time ago I read the book admittedly, I might misremember or transformed it automagically over time.

This is my takeaway as well. Having the source code open makes it auditable, if not by you, maybe the community.

The free software license specifically gives the software an extra advantage in that changes to the software must be shared openly, if distributed as as binaries.

Re: I found 10k GitHub repositories distributing Trojan malware

#27

Post by aweiher »

junon wrote: post #15
rkozik1989 wrote: post #11

People need to do their due diligence when including open-source software and packages not just when they first use them but anytime you have a need to upgrade them. I highly doubt I'm the first one to think of this, but there really aught to be tool or comprehensive set of tools that routinely scan open-source software and packages for potentially malicious code and alert users of the problem(s).

There are. Socket, Aikido, and a number of others do this all the time.

Step-Security, Wiz ..

Re: I found 10k GitHub repositories distributing Trojan malware

#29

Post by atmosx »

emodendroket wrote: post #8

I have to say, the principle that open-source software can't do anything nefarious because the source is open just hasn't held up for a lot of reasons -- including that nobody has the time to inspect the code, let alone ensure that it matches the binaries; and also that GitHub has become a distribution hub for software used by lots of people with no ability or interest in auditing the software they use.

Not true. If statistics offer a “measure” of reality, my guess is that “OS doing nefarious things” must fall between 0,005% and 0,007%. In any case compared to the extracted value it’s … nothing.

Re: I found 10k GitHub repositories distributing Trojan malware

#30

Post by jcattle »

tjoff wrote: post #23
vel0city wrote: post #22

Earlier quoted context omitted.

"Dang, this site isn't working right with the password manager's detection. Guess I just gotta paste the password in again..." Meanwhile U2F/Passkeys can't possibly be abused like this.

Yeah but the downsides of passkeys make them so much worse anyway.

Pretty happy with having a yubikey on my keychain. Log in someplace new? plonk in your yubikey and off you go!
Post reply on HN