Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I found 10k GitHub repositories distributing Trojan malware

orchidfiles.com

Post reply on HN
Print view View original

121–130 of 268 posts

Re: I found 10k GitHub repositories distributing Trojan malware

#121

Post by 14u2c »

8cvor6j844qw_d6 wrote: post #102
tedd4u wrote: post #80

Earlier quoted context omitted.

Strong support for the strategy of not putting your TOTP/MFA in your password manager, which has been argued on HN in the past.

> Strong support for the strategy of not putting your TOTP/MFA in your password manager Agreed, but I think using the same device to access your password manager and for dev is asking for trouble in the first place. Password managers assumes a non-compromised device. I don't think there exist a password manager that is explicitly designed for a compromised/hostile device. A password manager + built-in TOTP on a dedic…

>Agreed, but I think using the same device to access your password manager and for dev is asking for trouble in the first place.

That seems somewhat unrealistic? There are many passwords you need to use as part of dev work.

Re: I found 10k GitHub repositories distributing Trojan malware

#122

Post by auxinl »

cdmckay wrote: post #119
tedd4u wrote: post #80

Earlier quoted context omitted.

Strong support for the strategy of not putting your TOTP/MFA in your password manager, which has been argued on HN in the past.

You can make it so you need a YubiKey to login to 1Password the first time on a new device So just waiting for the password won’t be enough

The hackers will literally have access to _your_ device though. If your device is already trusted, I doubt that setting will do you any good.

Re: I found 10k GitHub repositories distributing Trojan malware

#123

Post by kgwxd »

emodendroket wrote: post #8

I have to say, the principle that open-source software can't do anything nefarious because the source is open just hasn't held up for a lot of reasons -- including that nobody has the time to inspect the code, let alone ensure that it matches the binaries; and also that GitHub has become a distribution hub for software used by lots of people with no ability or interest in auditing the software they use.

That's not a principle anyone, that knows anything about software, holds.

Re: I found 10k GitHub repositories distributing Trojan malware

#124

Post by mrguyorama »

StableAlkyne wrote: post #17

> I typed the project name into Google, and my repository appeared in the results. I entered the same query into Bing, and someone else’s repository appeared in the results Side story, this kind of thing is what made me stop using Bing. I had been using it as the default for searches (it sucks, but it's at least not Google), until I landed on a phishing page for my bank (I haven't committed it to memory yet). The pag…

>I never see Google return phishing pages or typo squatters in the first page

Our company constantly has phishing copies of our real pages as first results in Google. We have no ability to get them taken down. It costs us serious money every year, and hurts our customers who get swindled because Google lets some brand new domain registered yesterday come before the company that has existed for 20 years.

If you haven't seen it on google, you aren't looking hard enough.

Re: I found 10k GitHub repositories distributing Trojan malware

#125

Post by mcfly_c-137 »

rectang wrote: post #91
Terr_ wrote: post #86

Earlier quoted context omitted.

> putting your TOTP/MFA in your password manager I suppose the inverse would be starting with a device that offers TOTP/MFA, and then making your password-manager/vault somehow available on that same device. In either case, bringing them together makes it easier for an attacker to compromise both at the same time. On reflection, I've never actually put my (personal) password vault on my phone, but that may be less of…

As much as I like the Apple Passwords app, one of its downsides is that if I have my TOTP app on my iPhone, both passwords and TOTP live on the same device. So for many services I use Bitwarden for passwords.

For TOTP i use ente auth[0], which i can higly recommend.

i also force most apps on iOS to ask for face id (long press on app icon to set this).

[0] https://ente.com/auth/

Re: I found 10k GitHub repositories distributing Trojan malware

#126

Post by zygentoma »

deepsun wrote: post #118
8cvor6j844qw_d6 wrote: post #102

Earlier quoted context omitted.

> Strong support for the strategy of not putting your TOTP/MFA in your password manager Agreed, but I think using the same device to access your password manager and for dev is asking for trouble in the first place. Password managers assumes a non-compromised device. I don't think there exist a password manager that is explicitly designed for a compromised/hostile device. A password manager + built-in TOTP on a dedic…

But it's a hassle to have at least 2 yubikeys in case you lose one. And since you regularly sign up for new websites with OTPs, gotta keep them in sync. So always carry both with you. And if you carry both, then it's easy to lose both at the same time. UPDATE: also gotta keep track separatelt of non-resident passkeys tied to Yubikey, because Yubikey doesn't know where it was used for non-resident. If you lose one yub…

Would be nice if you could get an exact clone of a yubikey, so you always have a spare in case you lose one.

Though I think there is also the option that sites can store some sort of identifier on the key, then this would not work:/

Re: I found 10k GitHub repositories distributing Trojan malware

#127

Post by criddell »

tedd4u wrote: post #80
danso wrote: post #74

Being reminded of this anecdote from NYMag's recent cover story (which had previously been reported in a WSJ story[0]) about a Disney engineer who downloaded an AI-gen tool from Github and "checked the code himself, it had looked legitimate": https://archive.is/yAUNy > He had no idea why the hackers had targeted him or what their plan was, whether they would drain his family’s finances or stalk his home. Eventually,…

Strong support for the strategy of not putting your TOTP/MFA in your password manager, which has been argued on HN in the past.

On Linux, would something like Snap or Flatpak have protected them? It seems nuts that a random executable should have access to the password service.

Re: I found 10k GitHub repositories distributing Trojan malware

#128

Post by frereubu »

tedd4u wrote: post #80
danso wrote: post #74

Being reminded of this anecdote from NYMag's recent cover story (which had previously been reported in a WSJ story[0]) about a Disney engineer who downloaded an AI-gen tool from Github and "checked the code himself, it had looked legitimate": https://archive.is/yAUNy > He had no idea why the hackers had targeted him or what their plan was, whether they would drain his family’s finances or stalk his home. Eventually,…

Strong support for the strategy of not putting your TOTP/MFA in your password manager, which has been argued on HN in the past.

I think this is true in technical terms, but I have not seen a compelling description of what that looks like without it sounding like a real pain to manage.

Does anyone have a description of something manageable?

Re: I found 10k GitHub repositories distributing Trojan malware

#129

Post by frereubu »

mustaphah wrote: post #103

This is just one flavour of abuse. GitHub does NOT give a shit about the scale of the malware problem. I've seen so many forms of malware repos working on a GitHub trends newsletter [1], mostly about crypto, NFTs, KMS, and similar stuff. In the first runs of the project, I was so surprised by tens of malware repos that looked like trending repos. A lot of them share some common traits that made filtering feasible: -…

I have no idea of the kind of investment this would take in terms of time and money, but is it beyond the realms of possibility to run code submitted to GitHub through a basic filter? Genuine question - I have no experience of systems at that scale. But the fact that Microsoft is able to replace URLs in emails with ones that redirect through their systems so they can block malware URLs makes me feel like it should be possible.

Re: I found 10k GitHub repositories distributing Trojan malware

#130

Post by Sleaker »

frereubu wrote: post #128
tedd4u wrote: post #80

Earlier quoted context omitted.

Strong support for the strategy of not putting your TOTP/MFA in your password manager, which has been argued on HN in the past.

I think this is true in technical terms, but I have not seen a compelling description of what that looks like without it sounding like a real pain to manage. Does anyone have a description of something manageable?

Keepass, use different db stores for passwords than for the MFA/TOTP. never store the keepass db passwords anywhere except your head. Use a different device for the totp db than the passwords.
Post reply on HN