Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

socket.dev

Post reply on HN
Print view View original

121–130 of 458 posts

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#121

Post by ThePowerOfFuet »

sph wrote: post #109
flossly wrote: post #15

Never used the CLI, but I do use their browser plugin. Would be quite a mess if that got compromised. What can I do to prevent it? Run old --tried and tested-- versions? Quite bizarre to think much much of my well-being depends on those secrets staying secret.

> What can I do to prevent it? My two most precious digital possessions - my email and my Bitwarden account - are protected by a Yubikey that's always on my person (and another in another geographical location). I highly recommend such a setup, and it's not that much effort (I just keep my Yubikey with my house keys) I got a bit scared reading the title, but I'm doing all I can to be reasonably secure without devolvi…

If the software gets poisoned then your YubiKey will not save you.

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#122

Post by hootz »

nothinkjustai wrote: post #49

Remember how the White House published that document on memory safe languages? I think it’s time they go one step further and ban new development in JavaScript. Horrible language horrible ecosystem and horrible vulns.

Supply chain attacks aren't exclusive to JS just like malware isn't exclusive to Windows, it's just that JS/Windows is more popular and widespread. Kill JS and you will get supply chain attacks on the next most popular language with package managers. Kill Windows and you will get a flood of Linux/MacOS malware.

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#123

Post by QuantumNomad_ »

embedding-shape wrote: post #110
yborg wrote: post #104

Earlier quoted context omitted.

My approach is that for critical sites like banking, I use the site URL stored in the password manager too, I don't navigate via any link clicking. I personally am fine with thinking when my entire net worth is potentially at stake.

It's not only about how you get there, but that the autofill shows/doesn't show, which is the true indicator (beyond the URL) if you're in the right place or not. Rouge browser extensions for example could redirect you away from the bank website (if the bank website has poor security) when you go there, so even if you use the URL from the password manager, if you don't use the autofill feature, you can still get phis…

If you have rogue browser extensions installed, the browser extension can surely read the values that got filled into the login page without having to redirect to another site.

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#124

Post by embedding-shape »

QuantumNomad_ wrote: post #111
embedding-shape wrote: post #80

Earlier quoted context omitted.

> The 1Password mobile and desktop apps have such a nice UX that I’m happy copy pasting from and into it instead of having any of the browser extensions enabled. Also a great way of missing out on one of the best protections of password managers; completely eliminating phishing even without requiring thinking. And yes, still requires you to avoid manually copy-pasting without thinking when it doesn't work, but so muc…

In Safari on iOS I have all the main pages I use as favourites, so that they show on the home screen of Safari. Likewise I have links in the bookmarks bar on desktop. I use these links to navigate to the main sites I use. And log in from there. I don’t really need to think that way either. But I agree that eliminating the possibility all-together is a nice benefit of using the browser integration, that I am missing o…

Which works great until tags.tiqcdn.com, insuit.net or widget-mediator.zopim.com (example 3rd party domains loaded when you enter the landing page from some local banks) get compromised. I guess it's less likely to happen with the bigger banks, my main bank doesn't seem to load any scripts from 3rd party as an counter-example. Still, rouge browser extensions still scare me, although I only have like three installed.

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#125

Post by ripped_britches »

dgellow wrote: post #92
fraywing wrote: post #55

Can we please get a break? Praying to the security gods. It seems like we've have non-stop supply chain attacks for months now?

Expect to continue for years to come

This is the break right now, we will smile back on these times

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#126

Post by hgoel »

rvz wrote: post #105
hgoel wrote: post #77

Earlier quoted context omitted.

You initially complained about CLIs, not the dependency mess of the JS ecosystem. You still have not said why this is an issue of having a CLI.

> You initially complained about CLIs, not the dependency mess of the JS ecosystem. I complained about both. What does this say from the start? >> Once again, it is in the NPM ecosystem. > You still have not said why this is an issue of having a CLI. Why do you need one? Automation reasons? OpenClaw? This is an attractive way for an attacker to get ALL your passwords in your vault. The breach itself if run in GitHub…

>Why do you need one? Automation reasons? OpenClaw? This is an attractive way for an attacker to get ALL your passwords in your vault.

I need one because I am not always using a graphical interface. What exactly in a GUI do you think makes it harder/less attractive for an attacker?

If the GUI code is compromised in the same way as the CLI, it'll have the same level of access to your vault as soon as you enter your master password, exactly the same as in the CLI.

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#128

Post by embedding-shape »

QuantumNomad_ wrote: post #123
embedding-shape wrote: post #110

Earlier quoted context omitted.

It's not only about how you get there, but that the autofill shows/doesn't show, which is the true indicator (beyond the URL) if you're in the right place or not. Rouge browser extensions for example could redirect you away from the bank website (if the bank website has poor security) when you go there, so even if you use the URL from the password manager, if you don't use the autofill feature, you can still get phis…

If you have rogue browser extensions installed, the browser extension can surely read the values that got filled into the login page without having to redirect to another site.

Not necessarily, a user could have accepted a permission request for some (legit) redirect extension that never asked for content permission, then when the rogue actor takes over, they want to compromise users and not change the already accepted permissions.

Concretely, I think for redirect browser extension users I'd use "webRequest" permission, while for in page access you'd need a content-script for specific pages, so in practice they differ in what the extension gets access to.

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#129

Post by embedding-shape »

mayama wrote: post #112
pregnenolone wrote: post #91

Earlier quoted context omitted.

Well.. https://github.com/doy/rbw/blob/main/Cargo.toml#L16 You're still pulling a lot of dependencies. At least they're pinned though.

That's just direct dependencies. Including all the dependency tree is 785k LOC according to lib.rs. Most rust libraries include tons of others. https://lib.rs/crates/rbw

326 packages right now when doing a build. Seems large in general, but for a Rust project, not abnormal.

Takes what, maybe 15 seconds to compile on a high-core machine from scratch? Isn't the end of the world.

Worse is the scope to have to review all those things, if you'd like to use it for your main passwords, that'd be my biggest worry. Luckily most are well established already as far as I can tell.

Post reply on HN