Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I found 10k GitHub repositories distributing Trojan malware

orchidfiles.com

Post reply on HN
Print view View original

111–120 of 268 posts

Re: I found 10k GitHub repositories distributing Trojan malware

#111

Post by tuetuopay »

weird-eye-issue wrote: post #19
StableAlkyne wrote: post #17

> I typed the project name into Google, and my repository appeared in the results. I entered the same query into Bing, and someone else’s repository appeared in the results Side story, this kind of thing is what made me stop using Bing. I had been using it as the default for searches (it sucks, but it's at least not Google), until I landed on a phishing page for my bank (I haven't committed it to memory yet). The pag…

This is where password managers are useful because they would refuse to fill in login information since the domain doesn't match

That's without considering a lot of banks have non-textual inputs for their passwords. Man they love their scrambled virtual keyboard!

I think the worst I ever had was HSBC that asked me for fragments of my password, like characters 4, 6, 7, 11, and 12. Absolute bonkers of a security theatre.

Re: I found 10k GitHub repositories distributing Trojan malware

#112

Post by spicyusername »

swatcoder wrote: post #94
spicyusername wrote: post #45

Earlier quoted context omitted.

The choice is between code you can validate and code you can't, not code that has malware and code that doesn't.

That's not a distinction that people really benefit from. Approximately nobody can read other people's code for intent or quality, let alone to surface malware meant to be hidden in it. For almost everyone, the only hope is that somebody else validated the code you want to use before you choose to use it and successfully interfered with its distribution upon finding an issue. That's why the culture of automatic-updat…

    That's not a distinction that people really benefit from.

    Approximately nobody can read other people's code for intent or quality
I can't disagree more.

Re: I found 10k GitHub repositories distributing Trojan malware

#113

Post by uncivilized »

tedd4u wrote: post #80
danso wrote: post #74

Being reminded of this anecdote from NYMag's recent cover story (which had previously been reported in a WSJ story[0]) about a Disney engineer who downloaded an AI-gen tool from Github and "checked the code himself, it had looked legitimate": https://archive.is/yAUNy > He had no idea why the hackers had targeted him or what their plan was, whether they would drain his family’s finances or stalk his home. Eventually,…

Strong support for the strategy of not putting your TOTP/MFA in your password manager, which has been argued on HN in the past.

Story states he wasn't using 2FA for his 1password account at all.

Re: I found 10k GitHub repositories distributing Trojan malware

#114

Post by giancarlostoro »

hnlmorg wrote: post #97
giancarlostoro wrote: post #95

Earlier quoted context omitted.

If I go through the effort to view the code for something, I then compile it myself.

What makes you think he downloaded a pre-compiled binary? The link article doesn’t explicitly say that’s what happened. It just says he downloaded software from GitHub. Which might well have been the source code that he then compiled.

Looks like it was some comfyui plugin, so probably didn't even need to be compiled.

Re: I found 10k GitHub repositories distributing Trojan malware

#115

Post by mixdup »

uncivilized wrote: post #113
tedd4u wrote: post #80

Earlier quoted context omitted.

Strong support for the strategy of not putting your TOTP/MFA in your password manager, which has been argued on HN in the past.

Story states he wasn't using 2FA for his 1password account at all.

why was he even bothering then

Re: I found 10k GitHub repositories distributing Trojan malware

#116

Post by mustaphah »

rozab wrote: post #109
mustaphah wrote: post #103

This is just one flavour of abuse. GitHub does NOT give a shit about the scale of the malware problem. I've seen so many forms of malware repos working on a GitHub trends newsletter [1], mostly about crypto, NFTs, KMS, and similar stuff. In the first runs of the project, I was so surprised by tens of malware repos that looked like trending repos. A lot of them share some common traits that made filtering feasible: -…

If most malware repos are created in the last few days by a fresh user, then it sounds like GitHub is taking action against them? Or where are the old ones?

Well, my trend detection logic rewards recent stars more than older ones [1]. Recency is an important factor for many custom and public tools that track GitHub trends. I think the bad guys intentionally recreate repos - I actually noticed that.

That being said, they do take action if you report the repo. So I'm guessing good users are doing the heavy lifting here with reporting. I don't believe GitHub is taking enough proactive measures, or maybe they do, but it's not working well, obviously.

https://hadid.dev/posts/github-trends/#growth-based-approach

Re: I found 10k GitHub repositories distributing Trojan malware

#117

Post by cromka »

mustaphah wrote: post #103

This is just one flavour of abuse. GitHub does NOT give a shit about the scale of the malware problem. I've seen so many forms of malware repos working on a GitHub trends newsletter [1], mostly about crypto, NFTs, KMS, and similar stuff. In the first runs of the project, I was so surprised by tens of malware repos that looked like trending repos. A lot of them share some common traits that made filtering feasible: -…

This is the problem with software/services being taken over by big entities: they no longer have to care under the umbrella of "too big to fail".

Re: I found 10k GitHub repositories distributing Trojan malware

#118

Post by deepsun »

8cvor6j844qw_d6 wrote: post #102
tedd4u wrote: post #80

Earlier quoted context omitted.

Strong support for the strategy of not putting your TOTP/MFA in your password manager, which has been argued on HN in the past.

> Strong support for the strategy of not putting your TOTP/MFA in your password manager Agreed, but I think using the same device to access your password manager and for dev is asking for trouble in the first place. Password managers assumes a non-compromised device. I don't think there exist a password manager that is explicitly designed for a compromised/hostile device. A password manager + built-in TOTP on a dedic…

But it's a hassle to have at least 2 yubikeys in case you lose one. And since you regularly sign up for new websites with OTPs, gotta keep them in sync. So always carry both with you. And if you carry both, then it's easy to lose both at the same time.

UPDATE: also gotta keep track separatelt of non-resident passkeys tied to Yubikey, because Yubikey doesn't know where it was used for non-resident. If you lose one yubikey, need to sync all passkeys to a new replacement one.

Re: I found 10k GitHub repositories distributing Trojan malware

#119

Post by cdmckay »

tedd4u wrote: post #80
danso wrote: post #74

Being reminded of this anecdote from NYMag's recent cover story (which had previously been reported in a WSJ story[0]) about a Disney engineer who downloaded an AI-gen tool from Github and "checked the code himself, it had looked legitimate": https://archive.is/yAUNy > He had no idea why the hackers had targeted him or what their plan was, whether they would drain his family’s finances or stalk his home. Eventually,…

Strong support for the strategy of not putting your TOTP/MFA in your password manager, which has been argued on HN in the past.

You can make it so you need a YubiKey to login to 1Password the first time on a new device

So just waiting for the password won’t be enough

Re: I found 10k GitHub repositories distributing Trojan malware

#120

Post by djent »

emodendroket wrote: post #8

I have to say, the principle that open-source software can't do anything nefarious because the source is open just hasn't held up for a lot of reasons -- including that nobody has the time to inspect the code, let alone ensure that it matches the binaries; and also that GitHub has become a distribution hub for software used by lots of people with no ability or interest in auditing the software they use.

strawman
Post reply on HN