Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I found 10k GitHub repositories distributing Trojan malware

orchidfiles.com

Post reply on HN
Print view View original

91–100 of 268 posts

Re: I found 10k GitHub repositories distributing Trojan malware

#91

Post by rectang »

Terr_ wrote: post #86
tedd4u wrote: post #80

Earlier quoted context omitted.

Strong support for the strategy of not putting your TOTP/MFA in your password manager, which has been argued on HN in the past.

> putting your TOTP/MFA in your password manager I suppose the inverse would be starting with a device that offers TOTP/MFA, and then making your password-manager/vault somehow available on that same device. In either case, bringing them together makes it easier for an attacker to compromise both at the same time. On reflection, I've never actually put my (personal) password vault on my phone, but that may be less of…

As much as I like the Apple Passwords app, one of its downsides is that if I have my TOTP app on my iPhone, both passwords and TOTP live on the same device. So for many services I use Bitwarden for passwords.

Re: I found 10k GitHub repositories distributing Trojan malware

#92

Post by xantronix »

bananamogul wrote: post #77

I reported a repo containing obvious nulled software to GitHub in February 2024. The title is "nulled WHMCS" and it's a full copy of that software with copy protection removed. It couldn't be more cut and dried. The repo is still there 2+ years later and GitHub has taken no action. If GitHub can't respond to tickets pointing out obvious pirated software, I don't think they care about anything anyone puts up.

GitHub is so close to becoming SourceForge. In order to become the scum-infested cesspool it truly longs to be, Microsoft needs to relentlessly serve ads on GitHub. Then, the cycle will once again be complete.

I can't wait to discover the next thing to be disappointed by in a decade's time.

Re: I found 10k GitHub repositories distributing Trojan malware

#93

Post by swatcoder »

StableAlkyne wrote: post #17

> I typed the project name into Google, and my repository appeared in the results. I entered the same query into Bing, and someone else’s repository appeared in the results Side story, this kind of thing is what made me stop using Bing. I had been using it as the default for searches (it sucks, but it's at least not Google), until I landed on a phishing page for my bank (I haven't committed it to memory yet). The pag…

> I never see Google return phishing pages

Maybe you're not looking or maybe you're lucky.

Either way, many of us see it happen all the time there too. For GitHub especially, I almost never get the canonical repo for a project in my Google results. Phishing or innocuous, it's almost always some fork at the top and then a bunch of non-github.com sites.

Search is more or less "cooked" now, as they say. Google vs Bing vs DDG vs Kagi is mostly in the noise.

Re: I found 10k GitHub repositories distributing Trojan malware

#94

Post by swatcoder »

spicyusername wrote: post #45
emodendroket wrote: post #8

I have to say, the principle that open-source software can't do anything nefarious because the source is open just hasn't held up for a lot of reasons -- including that nobody has the time to inspect the code, let alone ensure that it matches the binaries; and also that GitHub has become a distribution hub for software used by lots of people with no ability or interest in auditing the software they use.

The choice is between code you can validate and code you can't, not code that has malware and code that doesn't.

That's not a distinction that people really benefit from.

Approximately nobody can read other people's code for intent or quality, let alone to surface malware meant to be hidden in it.

For almost everyone, the only hope is that somebody else validated the code you want to use before you choose to use it and successfully interfered with its distribution upon finding an issue. That's why the culture of automatic-updating package managers and bloated dependency graphs are so dangerous and why inserting delays into package managers can make such a difference in exposure to supply chain attacks for those that are intent to use them.

It's true that open source provides the transparency that makes any kind of third-party validation possible, but closed source benefits from commercial vendors staking their brand on what they release. It's a tradeoff, not a straightforward win for one side.

Re: I found 10k GitHub repositories distributing Trojan malware

#95

Post by giancarlostoro »

danso wrote: post #74

Being reminded of this anecdote from NYMag's recent cover story (which had previously been reported in a WSJ story[0]) about a Disney engineer who downloaded an AI-gen tool from Github and "checked the code himself, it had looked legitimate": https://archive.is/yAUNy > He had no idea why the hackers had targeted him or what their plan was, whether they would drain his family’s finances or stalk his home. Eventually,…

If I go through the effort to view the code for something, I then compile it myself.

Re: I found 10k GitHub repositories distributing Trojan malware

#96

Post by embedding-shape »

Defletter wrote: post #63
embedding-shape wrote: post #9

Earlier quoted context omitted.

> the principle that open-source software can't do anything nefarious because the source is open just hasn't held up for a lot of reasons You've been living on such a principle? That sounds insane, why would something not be nefarious just because you can read the code? The way I was "raised" by FOSS greybeards screaming at me through web forums, was that any software available on 3rd party websites anyone can upload…

> You've been living on such a principle? That sounds insane Fun fact, I've spent the last few days fretting over whether to add H2 to my FabricMC mod. The problem being that I don't know what class-loading shenanigans could possibly occur if I jar-in-jar include it: what happens if another mod has H2 jar-in-jar included? Will my mod only reference its own version of H2? What implications [if any] would that have? Or…

It's worth remembering that mod development/ecosystem has a very different engineering approach compared to software engineering in companies, or even FOSS at large. If you asked around in a modding community about software development, you'd get very different responses compared to the in-house company Slack or whatever.

Re: I found 10k GitHub repositories distributing Trojan malware

#97

Post by hnlmorg »

giancarlostoro wrote: post #95
danso wrote: post #74

Being reminded of this anecdote from NYMag's recent cover story (which had previously been reported in a WSJ story[0]) about a Disney engineer who downloaded an AI-gen tool from Github and "checked the code himself, it had looked legitimate": https://archive.is/yAUNy > He had no idea why the hackers had targeted him or what their plan was, whether they would drain his family’s finances or stalk his home. Eventually,…

If I go through the effort to view the code for something, I then compile it myself.

What makes you think he downloaded a pre-compiled binary? The link article doesn’t explicitly say that’s what happened. It just says he downloaded software from GitHub. Which might well have been the source code that he then compiled.

Re: I found 10k GitHub repositories distributing Trojan malware

#98

Post by rolph »

tedd4u wrote: post #80
danso wrote: post #74

Being reminded of this anecdote from NYMag's recent cover story (which had previously been reported in a WSJ story[0]) about a Disney engineer who downloaded an AI-gen tool from Github and "checked the code himself, it had looked legitimate": https://archive.is/yAUNy > He had no idea why the hackers had targeted him or what their plan was, whether they would drain his family’s finances or stalk his home. Eventually,…

Strong support for the strategy of not putting your TOTP/MFA in your password manager, which has been argued on HN in the past.

i would also offer, do not use the same device for everything, make sure any local connectivity has firewalled [dot]finances, and [dot]tech lab from each other and else. you should probably split your network to further isolate.

use intentional spelling mistakes in your password vault, edit the password by hand. you also need to have some way of authenticating login components to be sure your running your version of login, and not a trojan login.

Re: I found 10k GitHub repositories distributing Trojan malware

#100

Post by LtWorf »

vel0city wrote: post #75
someguyiguess wrote: post #36

Earlier quoted context omitted.

And when your keychain gets lost then what?

Then I use the authenticator built into my phone. Or the authenticator built into my desktop. Or the authenticator built into my laptop. Or my other authenticator. My phone was destroyed not too long ago. I had been using it for passkeys. Oh no, all those passkeys were gone. No problem, when I got my new phone I just used the authenticator on my keyring to get back into my accounts. If my keyring authenticator got lo…

https://xkcd.com/981/
Post reply on HN