Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I found 10k GitHub repositories distributing Trojan malware

orchidfiles.com

Post reply on HN
Print view View original

71–80 of 268 posts

Re: I found 10k GitHub repositories distributing Trojan malware

#71

Post by nkrisc »

emodendroket wrote: post #8

I have to say, the principle that open-source software can't do anything nefarious because the source is open just hasn't held up for a lot of reasons -- including that nobody has the time to inspect the code, let alone ensure that it matches the binaries; and also that GitHub has become a distribution hub for software used by lots of people with no ability or interest in auditing the software they use.

Never heard of that principle. I have heard people say that if an open source project was doing something nefarious it would be easier for someone to discover it.

Re: I found 10k GitHub repositories distributing Trojan malware

#72

Post by AlotOfReading »

brendoelfrendo wrote: post #42
AlotOfReading wrote: post #39

Earlier quoted context omitted.

I used to keep a yubikey in a spare slot on my laptop. One day it fell out and subsequently escaped through an unnoticed hole in my backpack. I've never lost a password because my backpack was overly abused.

That's why you keep it on your keychain and not in a spare slot on your laptop.

It's not possible to put a 5c nano on a keychain. They're intended to be kept in the slot at all times.

Re: I found 10k GitHub repositories distributing Trojan malware

#73

Post by throawayonthe »

StableAlkyne wrote: post #32
weird-eye-issue wrote: post #19

Earlier quoted context omitted.

This is where password managers are useful because they would refuse to fill in login information since the domain doesn't match

I use keepass (FOSS under GPL, fully offline). It does not detect domains.

you can have it be offline and still a browser extension (when i used keepassxc it could to that)

Re: I found 10k GitHub repositories distributing Trojan malware

#74

Post by danso »

Being reminded of this anecdote from NYMag's recent cover story (which had previously been reported in a WSJ story[0]) about a Disney engineer who downloaded an AI-gen tool from Github and "checked the code himself, it had looked legitimate":

https://archive.is/yAUNy

> He had no idea why the hackers had targeted him or what their plan was, whether they would drain his family’s finances or stalk his home. Eventually, after running another anti-virus program, he found a piece of malware hidden in a plug-in he had downloaded from GitHub, the open-source coding site, one day in February when he was messing around with an AI image generator. He had checked the code himself, it had looked legitimate, and others had reviewed it positively. But it seems it contained a Trojan-horse virus that gave the hackers free rein of his PC. Once inside, they just had to wait for Van Andel to log in to 1Password. From there, they were able to steal all his credentials, plus many of his multifactor-authentication codes, so every time Van Andel logged in to an app, a website, or an account, they could follow behind him. They’d had access for months.

[0] https://www.wsj.com/tech/cybersecurity/disney-employee-ai-to...

Re: I found 10k GitHub repositories distributing Trojan malware

#75

Post by vel0city »

someguyiguess wrote: post #36
jcattle wrote: post #30

Earlier quoted context omitted.

Pretty happy with having a yubikey on my keychain. Log in someplace new? plonk in your yubikey and off you go!

And when your keychain gets lost then what?

Then I use the authenticator built into my phone. Or the authenticator built into my desktop. Or the authenticator built into my laptop. Or my other authenticator.

My phone was destroyed not too long ago. I had been using it for passkeys. Oh no, all those passkeys were gone. No problem, when I got my new phone I just used the authenticator on my keyring to get back into my accounts. If my keyring authenticator got lost I'd just buy a new authenticator eventually and add it to my accounts.

Re: I found 10k GitHub repositories distributing Trojan malware

#77

Post by bananamogul »

I reported a repo containing obvious nulled software to GitHub in February 2024.

The title is "nulled WHMCS" and it's a full copy of that software with copy protection removed. It couldn't be more cut and dried.

The repo is still there 2+ years later and GitHub has taken no action.

If GitHub can't respond to tickets pointing out obvious pirated software, I don't think they care about anything anyone puts up.

Re: I found 10k GitHub repositories distributing Trojan malware

#79

Post by flykespice »

emodendroket wrote: post #8

I have to say, the principle that open-source software can't do anything nefarious because the source is open just hasn't held up for a lot of reasons -- including that nobody has the time to inspect the code, let alone ensure that it matches the binaries; and also that GitHub has become a distribution hub for software used by lots of people with no ability or interest in auditing the software they use.

The xz backdoor should've been a wake up call for everyone subscribing to the classic cargo cult that "malware can't exist in open-source software". All the payload was submitted through auditable code that was cleverly concealed from review.

Re: I found 10k GitHub repositories distributing Trojan malware

#80

Post by tedd4u »

danso wrote: post #74

Being reminded of this anecdote from NYMag's recent cover story (which had previously been reported in a WSJ story[0]) about a Disney engineer who downloaded an AI-gen tool from Github and "checked the code himself, it had looked legitimate": https://archive.is/yAUNy > He had no idea why the hackers had targeted him or what their plan was, whether they would drain his family’s finances or stalk his home. Eventually,…

Strong support for the strategy of not putting your TOTP/MFA in your password manager, which has been argued on HN in the past.
Post reply on HN