> security incidents happen all the time, its natural. what matters is the company's response, and todesktop's response has been awesome, they were very nice to work with.
This was an excellent conclusion for the article.
How to gain code execution on hundreds of millions of people and popular apps
131–140 of 350 posts
Re: How to gain code execution on hundreds of millions of people and popular apps
#132As an Electron maintainer, I'll re-iterate a warning I've told many people before: Your auto-updater and the underlying code-signing and notarization mechanisms are sacred . The recovery mechanisms for the entire system are extremely painful and often require embarrassing emails to customers. A compromised code-sign certificate is close to the top of my personal nightmares. Dave and toDesktop have build a product tha…
How about we don't build an auto-updater? Maybe some apps require an extremely tight coupling with a server, but we should try our best to release complete software to users that will work as close to forever as possible. Touching files on a user's system should be treated as a rare special occurrence. If a server is involved with the app, build a stable interface and think long and hard about every change. Meticulously version and maintain everything. If a server is involved, it is completely unacceptable for a server-side change to break an existing user's local application unless it is impossible to avoid - it should be seen as an absolute last resort with an apology to affected customers (agree with OP on this one).
It is your duty to make sure _all_ of your users are able to continue using the same software they installed in exactly the same way for the reasonable lifetime of their contract, the package, or underlying system (and that lifetime is measured in years/decades, with the goal of forever where possible. Not months).
You can, if you must, include an update notification, but this absolutely cannot disrupt the user's experience; no popups, do not require action, include an "ignore forever" button. If you have a good product with genuinely good feature improvements, users will voluntarily upgrade to a new package. If they don't, that is why you have a sales team.
Additionally, more broadly, it is not your app's job to handle updates. That is the job of your operating system and its package manager. But I understand that Windows is behind in this regard, so it is acceptable to compromise there.
We go a step further at my company. Any customer is able to request any previous version of their package at any time, and we provide them an Internet download page or overnight ship them a CD free of charge (and now USB too).
Re: How to gain code execution on hundreds of millions of people and popular apps
#133Earlier quoted context omitted.
In what world do you have a machine which downloads source code to build it, but doesn't have outbound internet access so it can't download source code or build dependencies? Like, effectively the "build machine" here is a locked down docker container that runs "git clone && npm build", right? How do you do either of those activities without outbound network access? And outbound network access is enough on its own to…
In a world with an internal proxy/mirror for dependencies and no internet access allowed by build systems.
Which is not the world we live in.
Re: How to gain code execution on hundreds of millions of people and popular apps
#134Earlier quoted context omitted.
1. Yes 2. Because that requires you to know how to find the hash and add it. Truthfully the burden should be on the third party that's serving the script (where did you copy that HTML in the first place?) but they aren't incentivizes to have other sites use a hash.
Well, to be honest, the browsers could super easily solve that. In dev mode, just issue a warning "loaded script that has hash X but isn't statically defined. This is a huge security risk. Read more here" and that's it. Then you can just add the script, run the site, check the logs and add the hash, done.
You can define a CSP header to only exec 3rd Party scripts with known hashes
Re: How to gain code execution on hundreds of millions of people and popular apps
#135Earlier quoted context omitted.
Question. I've noticed a lot of websites import from other sites, instead of local. I almost never see a hash in there. Is this as dangerous as it looks, why don't people just use a hash?
Yes it is. Hashes must absolutely be used in that case.
It should just not be done at all. But the main browser vendor loves tracking so they won't forbid this.
Re: How to gain code execution on hundreds of millions of people and popular apps
#136Earlier quoted context omitted.
Well, to be honest, the browsers could super easily solve that. In dev mode, just issue a warning "loaded script that has hash X but isn't statically defined. This is a huge security risk. Read more here" and that's it. Then you can just add the script, run the site, check the logs and add the hash, done.
You can define a CSP header to only exec 3rd Party scripts with known hashes
But that doesn't make it easy to integrate a new script from an author who doesn't provide the hash already.
Re: How to gain code execution on hundreds of millions of people and popular apps
#137Re: How to gain code execution on hundreds of millions of people and popular apps
#138Earlier quoted context omitted.
I had to go back and enable JavaScript. Wow, is the goal to direct my attention away from reading the text?
Ironically, it actually helped me stay focused on the article. Kind of like a fidget toy. When part of my brain would get bored, I could just move the cat and satisfy that part of my brain while I keep reading. I know that sounds kind of sad that my brain can't focus that well (and it is), but I appreciated the cat.
I can't see the cat! I went back and it just isn't working for me. I'm sad, I like cats.
Re: How to gain code execution on hundreds of millions of people and popular apps
#139Dave here, founder of ToDesktop. I've shared a write-up: https://www.todesktop.com/blog/posts/security-incident-at-to... This vulnerability was genuinely embarrassing, and I'm sorry we let it happen. After thorough internal and third-party audits, we've fundamentally restructured our security practices to ensure this scenario can't recur. Full details are covered in the linked write-up. Special thanks to Eva for resp…
What horrible form not contacting affected customers right away after performing the patch.
Who knows what else was vulnerable in your infrastructure when you leaked .encrypted like that.
It should have been on your customers to decide if they still wanted to use your services.
Re: How to gain code execution on hundreds of millions of people and popular apps
#140Automatic update without some manual step by a user means that the devs have RCE on your machine.
I made Signal fix this, but most apps consider it working as intended. We learned nothing from Solarwinds.