Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I found 10k GitHub repositories distributing Trojan malware

orchidfiles.com

Post reply on HN
Print view View original

151–160 of 268 posts

Re: I found 10k GitHub repositories distributing Trojan malware

#151

Post by schrodinger »

8cvor6j844qw_d6 wrote: post #102
tedd4u wrote: post #80

Earlier quoted context omitted.

Strong support for the strategy of not putting your TOTP/MFA in your password manager, which has been argued on HN in the past.

> Strong support for the strategy of not putting your TOTP/MFA in your password manager Agreed, but I think using the same device to access your password manager and for dev is asking for trouble in the first place. Password managers assumes a non-compromised device. I don't think there exist a password manager that is explicitly designed for a compromised/hostile device. A password manager + built-in TOTP on a dedic…

That’s a good point.

Maybe a good compromise is to use 1pw for most TOTP but keep your gmail / iCloud and a few others in an iPhone only app?

Gmail is what scares me the most. It’s basically keys to the kingdom.

Re: I found 10k GitHub repositories distributing Trojan malware

#152

Post by schrodinger »

tedd4u wrote: post #80
danso wrote: post #74

Being reminded of this anecdote from NYMag's recent cover story (which had previously been reported in a WSJ story[0]) about a Disney engineer who downloaded an AI-gen tool from Github and "checked the code himself, it had looked legitimate": https://archive.is/yAUNy > He had no idea why the hackers had targeted him or what their plan was, whether they would drain his family’s finances or stalk his home. Eventually,…

Strong support for the strategy of not putting your TOTP/MFA in your password manager, which has been argued on HN in the past.

Wonder if you could run your password manager in an isolated sandbox that couldn’t provide the secret behind the TOTP, only the current value.

Re: I found 10k GitHub repositories distributing Trojan malware

#154

Post by Yokohiii »

birksherty wrote: post #59
Yokohiii wrote: post #33

Earlier quoted context omitted.

If all projects on github were closed source with public "trust me bro" binaries the situation would be of course much better.

"Trust me bro" is what people say about open source everywhere when it's not true.

No clue what that means.

Re: I found 10k GitHub repositories distributing Trojan malware

#155

Post by lukan »

xantronix wrote: post #92
bananamogul wrote: post #77

I reported a repo containing obvious nulled software to GitHub in February 2024. The title is "nulled WHMCS" and it's a full copy of that software with copy protection removed. It couldn't be more cut and dried. The repo is still there 2+ years later and GitHub has taken no action. If GitHub can't respond to tickets pointing out obvious pirated software, I don't think they care about anything anyone puts up.

GitHub is so close to becoming SourceForge. In order to become the scum-infested cesspool it truly longs to be, Microsoft needs to relentlessly serve ads on GitHub. Then, the cycle will once again be complete. I can't wait to discover the next thing to be disappointed by in a decade's time.

For it to be complete, they need to start changing binaries and bundling software with a microsoft launcher.

Re: I found 10k GitHub repositories distributing Trojan malware

#156

Post by GoodPepper50 »

tedd4u wrote: post #80
danso wrote: post #74

Being reminded of this anecdote from NYMag's recent cover story (which had previously been reported in a WSJ story[0]) about a Disney engineer who downloaded an AI-gen tool from Github and "checked the code himself, it had looked legitimate": https://archive.is/yAUNy > He had no idea why the hackers had targeted him or what their plan was, whether they would drain his family’s finances or stalk his home. Eventually,…

Strong support for the strategy of not putting your TOTP/MFA in your password manager, which has been argued on HN in the past.

Separate and additional auth service based on physical ownership is always nice!

Re: I found 10k GitHub repositories distributing Trojan malware

#157

Post by weird-eye-issue »

tuetuopay wrote: post #111
weird-eye-issue wrote: post #19

Earlier quoted context omitted.

This is where password managers are useful because they would refuse to fill in login information since the domain doesn't match

That's without considering a lot of banks have non-textual inputs for their passwords. Man they love their scrambled virtual keyboard! I think the worst I ever had was HSBC that asked me for fragments of my password, like characters 4, 6, 7, 11, and 12. Absolute bonkers of a security theatre.

Oh I've never seen anything like that. But it would still help because my password manager pops up matching logins so you could just open that manually and then copy paste parts of it or type it in.

Re: I found 10k GitHub repositories distributing Trojan malware

#158

Post by weird-eye-issue »

vel0city wrote: post #22
weird-eye-issue wrote: post #19

Earlier quoted context omitted.

This is where password managers are useful because they would refuse to fill in login information since the domain doesn't match

"Dang, this site isn't working right with the password manager's detection. Guess I just gotta paste the password in again..." Meanwhile U2F/Passkeys can't possibly be abused like this.

Well mine pops up a big warning if you try pasting when the domain doesn't match it so at least it would force you to take a second look. Also all the real world services that I use half past keys as 2fa which I also store in the password manager

Re: I found 10k GitHub repositories distributing Trojan malware

#160

Post by tedd4u »

14u2c wrote: post #121
8cvor6j844qw_d6 wrote: post #102

Earlier quoted context omitted.

> Strong support for the strategy of not putting your TOTP/MFA in your password manager Agreed, but I think using the same device to access your password manager and for dev is asking for trouble in the first place. Password managers assumes a non-compromised device. I don't think there exist a password manager that is explicitly designed for a compromised/hostile device. A password manager + built-in TOTP on a dedic…

>Agreed, but I think using the same device to access your password manager and for dev is asking for trouble in the first place. That seems somewhat unrealistic? There are many passwords you need to use as part of dev work.

One could perhaps put those in a different vault. Sounds like a pain to me. But nothing compared to an email and/or banking compromise.
Post reply on HN