Typosquatting programming language package managers • Hacker News Board

Re: Typosquatting programming language package managers

#101

Post by pc86 » Wed, Jun 08, 2016, 7:39 PM UTC

throwawaysocks wrote: post #41

PeterisP wrote: post #36

Earlier quoted context omitted.

Banks generally solve the issue with simple classic checksumming methods that guarantee that any number with a typo or swapped neighbouring characters will always result in an invalid number. That doesn't work with arbitrary names because they are, well, arbitrary.

Why not? Central repositories could require that all names are within a certain Levenshtein distance of one another. This could get mildly annoying every once in a while when there are legitimate non-clashing names. A better metric/typo recognition technique is probably possible. Or else some manual process for requesting exceptions (maybe with a tiny fee to help fund the overall project) would also address this prob…

"Sorry, the otherwise 100% valid and reasonable name you've selected for your project is invalid because an algorithm has determined it is arbitrarily too close to this other unrelated project. Try again."

Who would use that?

Re: Typosquatting programming language package managers

#102

Post by placeybordeaux » Wed, Jun 08, 2016, 8:03 PM UTC

Mizza wrote: post #20

This seems like pretty unethical research to me. Also, doesn't point out that the bigger threat is that this is wormable.

Yeah I wouldn't want to find myself in court hearing

>17000 computers were forced to execute [unauthorized] arbitrary code

Certainly a crime in the US, not sure about Germany.

Nice execution though!

Re: Typosquatting programming language package managers

#103

Post by sqeaky » Wed, Jun 08, 2016, 8:05 PM UTC

utexaspunk wrote: post #17

wycats wrote: post #16

Earlier quoted context omitted.

That would mean that, for example on crates.io, you couldn't create a `libm`, because `libc` is already very popular. I don't think that works.

True- levenshtein isn't the best algorithm for the purpose. Is there an algorithm that takes key proximity into account? Like, 'libm' and 'libc' are sufficiently different to preclude typos, but 'lib[n/j/k]' or 'lib[x/d/f/v]' are not?

Key proximity on which of the hundreds of keyboard layouts?

Re: Typosquatting programming language package managers

#104

Post by kibwen » Wed, Jun 08, 2016, 8:06 PM UTC

blowski wrote: post #67

Klathmon wrote: post #63

Earlier quoted context omitted.

Or just refer to packages by 2 names. Maintainer/PackageName It solves so many problems, this included.

I guess that would work, as long as you require PackageName to be unique across all Maintainers.

Though this would obviate the most compelling argument for namespacing, which is to allow exactly that.

Re: Typosquatting programming language package managers

#105

Post by placeybordeaux » Wed, Jun 08, 2016, 8:07 PM UTC

throwawaysocks wrote: post #45

Mizza wrote: post #20

This seems like pretty unethical research to me. Also, doesn't point out that the bigger threat is that this is wormable.

There was no actual intrusion, so this feels like fair game to me. Especially since mitigating a very possible attack vector is a direct result of running experiment. Still, hopefully the researchers got an IRB to sign off on the experiment setup...

The research got computers to execute code on them without authorization and extracted information from them.

That is a crime under the CFAA in the USA. Not sure what it is in Germany/EU.

Re: Typosquatting programming language package managers

#106

Post by kibwen » Wed, Jun 08, 2016, 8:12 PM UTC

zardeh wrote: post #88

tatterdemalion wrote: post #65

Earlier quoted context omitted.

This is obviously not true. If `serde` resided at `erickt/serde` (as the counterproposal for Rust would've had it), I could create `erict/serde` or `erick-t/serde` or any other variations of erickt's handle. The only way this is 'solved' is if some third party authority hands out top level names and refuses to register names that are similar to other names for some definition of similar. The number of levels between…

Well, you could also solve it by saying that the post slash names are unique. ie. There can't exist zardeh/serde if erickt/serde already exists. Then the author-name works as a logical checksum, and you aren't any worse off than you were with a global namespace.

The purpose of a namespace is to make it possible to disambiguate two otherwise identical identifiers. If you force package names to be unique across all namespaces, then you don't have namespaces at all, you just have a single global namespace where you're forced to prepend an author name to the package name.

Re: Typosquatting programming language package managers

#107

Post by zmanian » Wed, Jun 08, 2016, 8:15 PM UTC

We need operating system vendors to give us a mechanism for easily creating and managed sandboxed dev environments.

Ones dev environment should be a place where remote code execution is a high probablity and we need better tools to partition that from high value data.

Re: Typosquatting programming language package managers

#108

Post by kibwen » Wed, Jun 08, 2016, 8:15 PM UTC

airless_bar wrote: post #46

This only seems to be an issue for languages where packages reside in a global namespace, like Python, Rust etc. I think most languages these days are a bit smarter and avoid this beginner mistake (for various reasons).

This is incorrect. Package repositories with namespacing are just as vulnerable to these attacks.

Re: Typosquatting programming language package managers

#109

Post by 21 » Wed, Jun 08, 2016, 8:22 PM UTC

Mizza wrote: post #20

This seems like pretty unethical research to me. Also, doesn't point out that the bigger threat is that this is wormable.

I wonder about the legality. It looks to me like he isn't technically responsible, since he didn't access any authorized computer himself.

If I intentionally leave an infected USB drive on the ground, someone picks it up and sticks it into it's computer, am I liable?

Seems like it could go either way.

Re: Typosquatting programming language package managers

#110

Post by kibwen » Wed, Jun 08, 2016, 8:24 PM UTC

Klathmon wrote: post #80

anentropic wrote: post #76

Earlier quoted context omitted.

maybe I don't understand the namespaces... but if you are targeting a package `someuser/popularpackage` can you not just register your own malicious `popularpackage` under a typo namespace like `smoeuser`?

Yes, but my thought was it gives a bit more "data" to work with on the package manager's side. They can see someone registering popular package names under something with a similar namespace and can flag them for manual review (which can be done for namespace-less packages, but there will be much more noise), they can apply things like "This is the first time you are installing a package from 'smoeuser' would you lik…

  > "This is the first time you are installing a package 
  > from 'smoeuser' would you like to continue?"

You don't need package namespacing for this. All package repositories already require a registered account to publish a package.