Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies

medium.com

Post reply on HN
Print view View original

201–210 of 412 posts

Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies

#201

Post by 0xbadcafebee »

prepend wrote: post #124
greggman3 wrote: post #22

Earlier quoted context omitted.

There's more coming.... tons of github integrations ask for blanket access to your account vs Oauth, ( https://github.com/marketplace ). Tons of github users give that access, the access_tokens are only a password type breach away. If you have these access_tokens you can edit the repos they are for all you want.

I wish GitHub would create a proper auth design. I won’t grant blanket permissions to tokens because there’s too much risk of something going wrong. It seems dumb that they don’t have per repo tokens. I think the issue is with their licensing as if they made proper tokens users could abuse it by giving tokens to their friends. But this should be detectable in a friendly (please don’t do that) way. I want to be able t…

> It seems dumb that they don’t have per repo tokens.

Technically you can create one new GitHub account per repo and generate a token for that... But that is highly annoying :)

They need to support IAM / RBAC style policies and tie every authn+z method to those policies, but my guess is they have different auth methods strung all throughout their codebase so implementing it will take a few years. Then of course they have to make it "user friendly" as we all know how painful IAM can be...

Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies

#202

Post by tantalor »

Like some other commenters, I too initially balked at the apparent misuse of "supply chain attack" but the linked paper provides a good definition,

A software supply chain attack is characterized by the injection of malicious code into a software package in order to compromise dependent systems further down the chain.

Backstabber’s Knife Collection: A Review of Open Source Software Supply Chain Attacks

https://link.springer.com/chapter/10.1007%2F978-3-030-52683-...

To be clear, just calling this a "supply chain attack" and omitting "software" is going to cause confusion with traditional supply chains.

The analogy is not quite apt: in a software build system you have complete visibility into the dependency tree, so this attack is less useful, whereas with hardware suppliers you are relying on the security of your vendor.

Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies

#203

Post by actuator »

mavhc wrote: post #179

https://security.googleblog.com/2021/02/know-prevent-fix-fra... At Google, we have those resources and go to extraordinary lengths to manage the open source packages we use—including keeping a private repo of all open source packages we use internally

But Google is more or less an exception in this regard, from hiring their own offensive penetration testing teams to having a lot of paranoia in general about anything from outside. They had adopted a lot of good practices early on. Even most big companies are not as thorough as them.

I wonder how they built this culture and if it is even realistic for smaller companies to aim for it.

Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies

#204

Post by austincheney »

Diggsey wrote: post #177
Communitivity wrote: post #158

This doesn't surprise me. Horrify.. yes. I've noticed more dev teams succumbing to the temptation of easiness that many modern package managers provide (NPM, Cargo, Ivy, etc.) - especially as someone who has to work with offline systems on a regular basis. Because of that ease there are fewer tools and tutorials out there to support offline package management. There are more for using caches, though these are often a…

I disagree: the problem is not that package managers make things easy, it's just that several of them are poorly designed. The fact that pip/npm/gem etc. look for packages in a fallback location if not found in the private repository is a terrible design flaw. One which not all package managers have. For example, when you add a cargo dependency from a private registry, you have to specify the registry that the depend…

Whether the package managers are poorly designed is completely ancillary. It really is primarily about developer laziness, incompetence, easiness.

Proof: https://www.theregister.com/2016/03/23/npm_left_pad_chaos/

Sudden unplanned loss of availability is a catastrophic security problem, the A in the security CIA[1]. Worse is that the dependency that caused that problem was something that should never have been a dependency in the first place.

Proper dependency management requires a degree of trust and integrity validation which are completely counter to automation. Most developers are eager to accept any resulting consequences because they don't own the consequences and because they are fearful of writing original code.

[1] https://en.wikipedia.org/wiki/Information_security#Key_conce...

Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies

#205

Post by zaarn »

tl wrote: post #180
zaarn wrote: post #111

Earlier quoted context omitted.

Why would it be infinitely harder to obtain log5j.com compared to typosquatting on npm? .com domains aren't THAT expensive.

log5j.online is on sale for $5 / month. What's the expected ongoing cost of a package? If it's $0, then it's literally infinite. At $0.01 / month it's merely 500x more expensive. The real cost is somewhere in-bewteen.

That's cost, not how much harder it is. Buying a domain is a few clicks and costs little money.

Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies

#206

Post by actuator »

0xbadcafebee wrote: post #187
mavhc wrote: post #179

https://security.googleblog.com/2021/02/know-prevent-fix-fra... At Google, we have those resources and go to extraordinary lengths to manage the open source packages we use—including keeping a private repo of all open source packages we use internally

That's more for availability than security. Assuming you keep the crypto checksums / author signatures of all the source code and packages, you don't need to keep a copy of the source / packages. Just verify them at download time. Many Linux distros don't even have a copy of all those binaries, they rely on HTTP mirrors of random organizations. It's also useful for your organization to rebuild all of the source code…

One more advantage of keeping it together can be easier development cycle. IDE features like autocompletion and building would be faster if artifacts can be cached.

Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies

#207

Post by Terretta »

tantalor wrote: post #202

Like some other commenters, I too initially balked at the apparent misuse of "supply chain attack" but the linked paper provides a good definition, A software supply chain attack is characterized by the injection of malicious code into a software package in order to compromise dependent systems further down the chain. Backstabber’s Knife Collection: A Review of Open Source Software Supply Chain Attacks https://link.s…

> The analogy is not quite apt: in a software build system you have complete visibility into the dependency tree, so this attack is less useful, whereas with hardware suppliers you are relying on the security of your vendor.

Not necessarily — plenty software still ships with the third party supply chain bits incorporated as binaries, including commercial software. User is relying on security of one or more in a chain of upstream vendors.

See Cyberpunk 2077 DLLs for instance.

https://twitter.com/CDPRED_Support/status/135660404767189811...

Cyberpunk “builds” their game with a software build system, but not all of it is them building it.

Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies

#208

Post by detaro »

ryukafalz wrote: post #194

I see a lot of people saying things like "this is why package signing is important" and "we need to know who the developers are" and "we need to audit everything." Some of that is true to some degree, but let me ask you this: why do we consider it acceptable that code you install through a package manager implicitly gets to do anything to your system that you can do? That seems silly! Surely we can do better than tha…

Indeed, being able to apply capabilities on a package level would be great, but I don't know many languages/environments that implement this as a first-class feature.

Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies

#209

Post by [deleted] »

ryukafalz wrote: post #194

I see a lot of people saying things like "this is why package signing is important" and "we need to know who the developers are" and "we need to audit everything." Some of that is true to some degree, but let me ask you this: why do we consider it acceptable that code you install through a package manager implicitly gets to do anything to your system that you can do? That seems silly! Surely we can do better than tha…

[deleted]

Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies

#210

Post by beermonster »

keyle wrote: post #10

I'm flabbergasted by how silly this is. Bump the version and the package manager chooses yours online vs. the private one. Amazing. How silly and how expensive is this going to be as this blatant security issue is going ripple on for the next months to come.

Debian has apt pinning for this kind of thing.
Post reply on HN