Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to gain code execution on hundreds of millions of people and popular apps

kibty.town

Post reply on HN
Print view View original

151–160 of 350 posts

Re: How to gain code execution on hundreds of millions of people and popular apps

#151

Post by pjerem »

RadiozRadioz wrote: post #132
felixrieseberg wrote: post #31

As an Electron maintainer, I'll re-iterate a warning I've told many people before: Your auto-updater and the underlying code-signing and notarization mechanisms are sacred . The recovery mechanisms for the entire system are extremely painful and often require embarrassing emails to customers. A compromised code-sign certificate is close to the top of my personal nightmares. Dave and toDesktop have build a product tha…

How about we don't build an auto-updater? Maybe some apps require an extremely tight coupling with a server, but we should try our best to release complete software to users that will work as close to forever as possible. Touching files on a user's system should be treated as a rare special occurrence. If a server is involved with the app, build a stable interface and think long and hard about every change. Meticulou…

I do agree with you but I think that unfortunately you are wrong on the job of updates. You have an idealistic vision that I share but well, it remains idealistic.

Apart from, maybe, Linux distros, neither Apple or Microsoft are providing anything to handle updates that isn’t a proprietary store with shitty rules.

For sure the rules are broken on desktop OSs but by the meantime, you still have to distribute and update your software. Should the update be automatic ? No. Should you provide an easy way to update ? I’d said that at the end it depends on if you think it’s important to provide updates to your users. But should you except your users or their OSs to somehow update your app by themselves ? Nope.

Re: How to gain code execution on hundreds of millions of people and popular apps

#152

Post by filleokus »

felixrieseberg wrote: post #31

As an Electron maintainer, I'll re-iterate a warning I've told many people before: Your auto-updater and the underlying code-signing and notarization mechanisms are sacred . The recovery mechanisms for the entire system are extremely painful and often require embarrassing emails to customers. A compromised code-sign certificate is close to the top of my personal nightmares. Dave and toDesktop have build a product tha…

> For Windows signing, use Azure Trusted Signing

I recently checked it out as an alternative to renewing our signing cert, but it doesn't support issuing EV certs.

I've understood it as having an EV code signing cert on Windows is required for drivers, but somehow also gives you better SmartScreen reputation making it useful even for user space apps in enterprisey settings?

Not sure if this is FUD spread by the EV CA's or not though?

Re: How to gain code execution on hundreds of millions of people and popular apps

#153

Post by lloeki »

ok_dad wrote: post #138
carcabob wrote: post #80

Earlier quoted context omitted.

Ironically, it actually helped me stay focused on the article. Kind of like a fidget toy. When part of my brain would get bored, I could just move the cat and satisfy that part of my brain while I keep reading. I know that sounds kind of sad that my brain can't focus that well (and it is), but I appreciated the cat.

I can't see the cat! I went back and it just isn't working for me. I'm sad, I like cats.

Here it is:

https://en.m.wikipedia.org/wiki/Neko_(software)

Ah, whimsy memories of running that on beige boxen of my youth.

Also remember a similar thing with some Lemmings randomly falling and walking around on windows.

Played way too long having them pile up and yank the window from under them.

Re: How to gain code execution on hundreds of millions of people and popular apps

#154

Post by swiftcoder »

> update: cursor (one of the affected customers) is giving me 50k USD for my efforts.

Kudos to cursor for compensating here. They aren't necessarily obliged to do so, but doing so demonstrates some level of commitment to security and community.

Re: How to gain code execution on hundreds of millions of people and popular apps

#155

Post by zx8080 »

> [please don't] make it seem like it's their fault, it's not. it's todesktop's fault if anything

What?! It's not some kind of joke. This could _already_ literally kill people, stole money and ruin lives.

It isn't even an option to avoid taking reaponsibility for the decisions which lead to security and safety of users for any app owner/author.

It's as simple as this: no safety record to 3rd party - no trust, for sure. No security audit - no trust. No transparency in the audit - no trust.

Failing to make the right decision does not exempt from the liability, and should not.

Is it a kindergarden with "it's not me, it's them" play? It does not matter who failed, the money could has been be stolen already from the random ones (who just installed an app wrapped with this todesktop installer), and journalists could have been tracked and probably already killed in some dictatorship or conflict.

Bad decisions does not always make the bad owner.

But don't take it lightly, and don't advocate (for those who just paid you some money) "oh, they are innocent". As they are not. Be a grown-up, please, and let's make this world better together.

Re: How to gain code execution on hundreds of millions of people and popular apps

#156

Post by bashback »

zx8080 wrote: post #155

> [please don't] make it seem like it's their fault, it's not. it's todesktop's fault if anything What?! It's not some kind of joke. This could _already_ literally kill people, stole money and ruin lives. It isn't even an option to avoid taking reaponsibility for the decisions which lead to security and safety of users for any app owner/author. It's as simple as this: no safety record to 3rd party - no trust, for sur…

The problem is that this entire sclerotic industry is so allergic to accountability, that, if you want people to start, you probably have to fire 90% of the workforce. If it were up to me, the developers responsible for this would never write software "professionally" again.

Re: How to gain code execution on hundreds of millions of people and popular apps

#157

Post by cdmyrm »

Hackbraten wrote: post #149
RadiozRadioz wrote: post #132

Earlier quoted context omitted.

How about we don't build an auto-updater? Maybe some apps require an extremely tight coupling with a server, but we should try our best to release complete software to users that will work as close to forever as possible. Touching files on a user's system should be treated as a rare special occurrence. If a server is involved with the app, build a stable interface and think long and hard about every change. Meticulou…

> Maybe some apps require an extremely tight coupling with a server, but we should try our best to release complete software to users that will work as close to forever as possible. That sounds like a good idea. Unless you’re the vendor, and instead of 1000 support requests for version N, you’re now facing 100 support requests for version N, 100 for N−1, 100 for N−2, …, and 100 for N−9.

You're allowed to have a support matrix. You can refuse to support versions that are too old, but you can also just... let people keep using programs on their own computers.

Re: How to gain code execution on hundreds of millions of people and popular apps

#158

Post by cdmyrm »

pjerem wrote: post #151
RadiozRadioz wrote: post #132

Earlier quoted context omitted.

How about we don't build an auto-updater? Maybe some apps require an extremely tight coupling with a server, but we should try our best to release complete software to users that will work as close to forever as possible. Touching files on a user's system should be treated as a rare special occurrence. If a server is involved with the app, build a stable interface and think long and hard about every change. Meticulou…

I do agree with you but I think that unfortunately you are wrong on the job of updates. You have an idealistic vision that I share but well, it remains idealistic. Apart from, maybe, Linux distros, neither Apple or Microsoft are providing anything to handle updates that isn’t a proprietary store with shitty rules. For sure the rules are broken on desktop OSs but by the meantime, you still have to distribute and updat…

This is actually precisely how package management works in Linux today... you release new versions, package maintainers package and release them, while ensuring they actually work. This is a solve problem, it's just that nobody writing JavaScript is old enough to realize it's an option.

Re: How to gain code execution on hundreds of millions of people and popular apps

#159

Post by cdmyrm »

gamedever wrote: post #46
felixrieseberg wrote: post #31

As an Electron maintainer, I'll re-iterate a warning I've told many people before: Your auto-updater and the underlying code-signing and notarization mechanisms are sacred . The recovery mechanisms for the entire system are extremely painful and often require embarrassing emails to customers. A compromised code-sign certificate is close to the top of my personal nightmares. Dave and toDesktop have build a product tha…

And yet, tons of developers install github apps that ask for full permissions to control all repos and can therefore do to same things to every dev usings those services. github should be ashamed this possibility even exists and double ashamed that their permission system and UX is so poorly conceived that it leads apps to ask for all the permissions. IMO, github should spend significant effort so that the default is…

Yeah, turns out "modern" software development has more holes than Swiss cheese. What else is new?

Re: How to gain code execution on hundreds of millions of people and popular apps

#160

Post by cdmyrm »

morgante wrote: post #67
hakaneskici wrote: post #51

Earlier quoted context omitted.

With privileged access, the attackers can tamper with the evidence for repudiation, so although I'd say "nothing in the logs" is acceptable, not everyone may. These two attack vectors are part of the STRIDE threat modeling approach.

They don’t elaborate on the logging details, but certainly must good systems don’t allow log tampering even for admins.

How confident are you that their log system is resilient, given the state of the rest of their software?
Post reply on HN