Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mini Shai-Hulud Strikes Again: 314 npm Packages Compromised

safedep.io

Post reply on HN
Print view View original

191–200 of 329 posts

Re: Mini Shai-Hulud Strikes Again: 314 npm Packages Compromised

#191

Post by zahlman »

mapontosevenths wrote: post #77
mentalgear wrote: post #13

> Docker Container Escape > The payload checks for the Docker socket and, if present, attempts container escape through three sequential methods: So even if you're running devcontainers / VMs, these worms are already trying to escape. Make sure you're running a rootless VM engine (e.g. podman instead of docker) !

Despite what some people will tell you (including many in the security indistry), Docker is not a strong security boundary, and it should not be treated as one. It shares a kernel with the running system. It reminds me of the good old days when people would hand out low privilege Linux accounts and rely on the kernel to prevent privilige escalation. Docker is literally the same thing, just with extra steps. Especiall…

> the good old days when people would hand out low privilege Linux accounts and rely on the kernel to prevent privilige escalation.

... Did that actually stop?

... Is that not the purpose of being able to make multiple accounts (even on a random desktop or laptop system) and restrict their privileges?

Re: Mini Shai-Hulud Strikes Again: 314 npm Packages Compromised

#192

Post by WorldMaker »

tln wrote: post #168
gherkinnn wrote: post #109

> In regards to the whole ecosystem: TC39 should take a look into adding a better standard library to JS itself, which would reduce the amount of one-liner packages. I concur, the best part of working with Deno way back was its standard library [0] and overall complete dev environment. It is just so damn obvious that a runtime comes with an integrated test runner and assertion library. 0 - https://docs.deno.com/runti…

I'm not sure any of the packages here would be part of a "better standard library". Do any language standard libraries have a "3 hours ago" formatter? Thats what timeago.js does Maybe slice.js, which just does python-style indexing with negative numbers. TC39 already made array.at() and array.slice() handle negative numbers.

> Do any language standard libraries have a "3 hours ago" formatter? Thats what timeago.js does

There's also a platform feature for that now: Intl.RelativeTimeFormat: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Refe...

It asks you to do the basic time math to determine your granularity so there's still a role for a library, but also that time math gets easier with Temporal: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Refe...

(Specifically `Temporal.Now.instant().since(somePastInstant)` returns a Temporal.Duration that you can relatively easily determine the highest granularity you want and pass that to an Intl.RelativeTimeFormat instance. Also Intl.DurationFormat which is what a Temporal.Duration's `toLocaleString()` uses may also be good enough in many "x hours ago" type situations, though it is over-precise for them.)

Re: Mini Shai-Hulud Strikes Again: 314 npm Packages Compromised

#193

Post by zahlman »

btown wrote: post #113

At a certain point, is it better to just turn off Dependabot and freeze all NPM packages (minor/patch version and all), rather than continuously update? Particularly for frontend packages, meaningful security fixes seem less likely than supply chain attacks these days. It's a sad state of affairs, for sure - but is there a reason we can't just switch our frontends to static BOMs, and trust that NPM at least gets thei…

> and trust that NPM at least gets their "you can't republish to an old version" bare-minimum constraint right?

... Does NPM not create full lockfiles, with hashes and pinned transitive dependencies and everything?

Re: Mini Shai-Hulud Strikes Again: 314 npm Packages Compromised

#194

Post by thrownthatway »

cyanydeez wrote: post #47
abhisek wrote: post #34

Earlier quoted context omitted.

Attackers are just having fun due to abysmal state of npm and some of the insecure design choices by GitHub and GitHub Actions. Every attack gives them credentials which in turn used to stage more attacks.

perfect capitalism writ technology

You making a good point.

Socialism or our right communism would probably fix this.

But only as a second order effect of fucking everything.

3.5 to 6 million Ukrainians died in the Holodomor.

None of them really had any issues with technology. Not so much because they didn’t have any, but more so because they were dead.

Re: Mini Shai-Hulud Strikes Again: 314 npm Packages Compromised

#195

Post by ErroneousBosh »

Icathian wrote: post #136
throw0101c wrote: post #97

Earlier quoted context omitted.

> Despite what some people will tell you (including many in the security indistry), Docker is not a strong security boundary, and it should not be treated as one. It shares a kernel with the running system. Solaris Zones and FreeBSD Jails (their inspiration) also share a kernel with the running system and do not seem to have as many escape vulnerabilities. (Though partly because there may not be as much scrutiny of c…

Yeah, I'm reminded of 15 years ago being told Linux was super secure because people were popping Windows all the time. Turns out it was mostly just a function of effort pointed at the target, and I don't have any reason to believe that's not the case here too.

Linux has had 100% market penetration for 20 years or so now. Everyone using a computer uses Linux *somewhere* in it.

You'd think if it was that easy, there would be exploits all over the place.

Why isn't every single desk phone and router part of a botnet?

Re: Mini Shai-Hulud Strikes Again: 314 npm Packages Compromised

#196

Post by ErroneousBosh »

moebrowne wrote: post #22
mentalgear wrote: post #13

> Docker Container Escape > The payload checks for the Docker socket and, if present, attempts container escape through three sequential methods: So even if you're running devcontainers / VMs, these worms are already trying to escape. Make sure you're running a rootless VM engine (e.g. podman instead of docker) !

Or don't mount the Docker socket into containers

Or mount it read-only if you do, like for Traefik.

Re: Mini Shai-Hulud Strikes Again: 314 npm Packages Compromised

#198

Post by mghackerlady »

sph wrote: post #181
mghackerlady wrote: post #142

Earlier quoted context omitted.

Also, I feel like a lot of fullstack JS is written by people who started with frontend JS and don't have nearly enough backend experience

JS programmers today are the PHP programmers of 25 years ago. Remember how many SQL injection bugs there was at the time? Little Bobby Tables remembers. The standards haven't changed; for the vast majority of JS programmers, this is their first programming language and they have no solid foundation of architecture and security. So what you get are these overly enthusiastic newbies that want to share their latest achi…

And before PHP it was Visual Basic, and COBOL even further back. I'm convinced trying to teach people to program without them understanding the basics of how computers work will lead to this.

Re: Mini Shai-Hulud Strikes Again: 314 npm Packages Compromised

#199

Post by thrownthatway »

LtWorf wrote: post #57
somelamer567 wrote: post #28

In the fictional universe of William Gibson's Sprawl trilogy, it is legal and normal for defenders to go kinetic on cyberattackers. How long until it is simply easier for governments and big business in the countries victimised by these criminal groups, to find the path of least resistance and go after them personally?

What they do is already illegal. The problem is finding out who they are and where they live to go and arrest them.

I’m not convinced.

My understanding is that the problem is more that calling in the heavy artillery for what amounts to an annoyance, and maybe some financial harm, is generally considered impolite, even among nations that have conflicting worldviews.

Re: Mini Shai-Hulud Strikes Again: 314 npm Packages Compromised

#200

Post by zahlman »

mentalgear wrote: post #12

The situation is getting crazy ... personally I have already uninstalled node, python and all package managers from my machine and instead only use them in devcontainers / VMs. But even if the dev community comes up with super hardened security, I fear in at least a year the models will be good enough in social engineering that we are still running a losing game.

> the models will be good enough in social engineering

Never mind questions of how good the models will/can get. I'm confused why people expect that, in principle, models getting really good at social engineering would have such huge impact. Seems to me like it has diminishing returns and is severely bottlenecked by the fact that the target operates at human speed.

The amount of effort involved in the XZ hack, for example, was immense, and it couldn't have been accelerated because it worked specifically by wearing the existing maintainer down over time. You could generate and send all the necessary nastygrams in seconds and it wouldn't speed up the human consuming them (and in fact, having all of them arrive at once would raise suspicion).

And there is a limit to how persuasive that input can be. Take any of the random nastygrams directed at the XZ maintainer; maybe they could have been made more nasty, more pointed, more aware of the maintainer's personal weaknesses and fears — but would that have actually been overall more effective? I think not, or at most only a tiny bit.

Post reply on HN