For apt repositories you can do pinning by origin, which should prevent this issue.
Does apt use tls by default today?
Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies
161–170 of 412 posts
Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies
#162Ex-Amazon SDE here. > a unique design flaw of the open-source ecosystems This is a big generalization. Inside Amazon, as well as in various Linux distributions, you cannot do network traffic at build time and you can only use dependencies from OS packages. Each library has its own package and the code and licensing is reviewed. The only open source distribution that I know to have similar strict requirements is Debia…
I work in this area. This is not a supply chain attack. This is a typosquatting "attack" people keep rediscovering every year or two. I know, because I wrote an as yet unpublished paper on safely pulling packages from private and public repos.
Can you share a link to the paper? My email is in my HN bio.
Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies
#163I have to build some CSS libraries that sadly use npm for building. The way I approach this is through rubber gloves: I create custom docker containers with npm and a specific set of dependencies, frozen in time. This way I can at least get reproducible and reliable builds.
This doesn't mean I'm not vulnerable to dependency attacks, but it at least limits the window, because I update these dependencies very, very rarely.
Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies
#164Pulling packages down at build time seems ludicrous to me, I can understand it in a development environment, but I don't understand how "Pull packages from the public internet and put them into our production codebase" past any kind of robustness scrutiny. I guess it's a case of the ease of use proving too great, so convenient in fact that we just kind of swept the implications under the rug.
99% of everyone does exactly this, though. Partly because nobody has any fucking idea what they are doing, and because this is what all the documentation everywhere tells you to do, so that's what the guy who gets tasked with setting up the CI build does...
Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies
#165Can't there be a "package signature" of some sort that is specified and checked against in a package-lock.json or yarn.lock?
pip has hashing signatures and i don't know why people don't use it. it's quite easy too.
https://pip.pypa.io/en/stable/reference/pip_hash/
https://pip.pypa.io/en/stable/reference/pip_install/#hash-ch...
Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies
#166I'm surprised the reverse fully-qualified domain name (FQDN) model used by Java isn't more widely adopted. If you want to upload artifacts to the main repository (Maven Central) you first need to show ownership of a particular domain. For example, via a DNS TXT record (example [1]). Would make these kind of attacks a lot more difficult. [1] https://issues.sonatype.org/browse/OSSRH-61509
Hmm, I wonder when this policy started. I did not have to prove ownership of the domains for the coordinates I use, though I do happen to own them.
Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies
#167Ex-Amazon SDE here. > a unique design flaw of the open-source ecosystems This is a big generalization. Inside Amazon, as well as in various Linux distributions, you cannot do network traffic at build time and you can only use dependencies from OS packages. Each library has its own package and the code and licensing is reviewed. The only open source distribution that I know to have similar strict requirements is Debia…
I work in this area. This is not a supply chain attack. This is a typosquatting "attack" people keep rediscovering every year or two. I know, because I wrote an as yet unpublished paper on safely pulling packages from private and public repos.
I think you’re getting downvoted because your point is obscured by the confrontational tone. Argument by authority is especially unconvincing when you aren’t using common terms correctly. In normal usage, “typosquatting” refers to someone registering common misspellings in a shared namespace. As clearly described in the post this is not that but rather exploiting non-obvious differences in the order in which different namespaces are checked.
Using terms correctly is especially important in security: someone who read your comment might incorrectly believe that this did not affect them because they are using the correct names for all of their dependencies.
Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies
#168Earlier quoted context omitted.
apples and oranges, the name conflict was perfectly disambiguated by the use of the mandatory group identifier. npm design was so bad that you could at the beginning upload over an existing version of your package name and break dependencies retroactively even to people that pinned versions. if you want to try some good old whataboutism, at least try to be in the same ballpark.
Nobody in this thread argues that npm is not bad (it is), the current topic is: “is maven's design[1] better” and there is little evidence on this front. Maven was (yes, I'm using the past on purpose) not a panacea that later system failed to equal: it has the usability of an IRS form and never gained as much popularity in the Java world than npm in the JavaScript one for that reason. In 2014, last time I did Java fo…
Maven is ubiquitous in the Java world and the de-facto package/dependency management system out there. Has been since the mid-2000's and as of 2018 when I last did Java development (Scala really), it is still widely in use. Getting jar files manually would have me running from whatever company that was doing that. Let me guess, they wrote all their code in Notepad because IDE's are a "fucking mess" too right?
Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies
#169The only really shocking part of this is that Artifactory is vulnerable to this. I expect developers to be lazy about build security because I've seen it over and over again at multiple companies, but Artifactory's whole purpose is to provide secure build dependency management.
I'll be rethinking using Artifactory in my infrastructure.
Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies
#170Earlier quoted context omitted.
Yes. The way we develop software quite frankly scares the shit out of me on a daily basis.
Well it's mostly held together by trust and (in the commercial case) warranty. That said there's so many potential entry points for malicious actors it's not even funny anymore (esp. in desktop computing)... I try not to think about it too much and have faith in the powers that be
Can you point me to a documented instance where a warranty claim on a software product yielded a useful outcome for the claimant?
The only one I can remember was against Microsoft for forcing an upgrade to Windows 10, which wasn't (IIRC) a warranty claim but a bait-and-switch issue.