Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We all dodged a bullet

xeiaso.net

Post reply on HN
Print view View original

201–210 of 498 posts

Re: We all dodged a bullet

#201

Post by ameliaquining »

nottorp wrote: post #192
ameliaquining wrote: post #166

Earlier quoted context omitted.

I mean, real deadlines do exist. The better heuristic is that, if a message seems to be deliberately trying to spur you into immediate action through fear of missing a deadline, it's probably some kind of trick. In this respect, the phishing message that was used here was brilliantly executed; it calmly, without using panic-inducing language, explains that action is required and that there's a deadline (that doesn't…

With credentials? Aren’t you always forced to refresh them right after a login? As in right then, without being given a deadline…

Yeah, this particular situation's a bit weird because it's asking the user to do something (rotate their 2FA secret) that in real life is not really a thing; I'm not sure what to think of it. But you could imagine something similar like "we want you to set up 2FA for the first time" or "we want you to supply additional personal information that the government has started making us collect", where the site might have to disable some kind of account functionality (though probably not a complete lockout) for users who don't do the thing in time.

Re: We all dodged a bullet

#203

Post by ameliaquining »

zahlman wrote: post #154
ameliaquining wrote: post #148

Earlier quoted context omitted.

This is the point of the "passkey" branding. The idea is to get to the point where these alphabet-soup acronyms are no longer exposed to normal users and instead they're just like "oh, I have to set up a passkey to log into this website", the way they currently understand having to set up a password.

Sure. That still doesn't make Yubikey-style physical devices (or desktop keyring systems that work the same way) viable for everyone, everywhere, though.

Yeah, the pressure needs to be put on vendors to accept passkeys everywhere (and to the extent that there are technical obstacles to this, they need to be aggressively remediated); we're not yet at the point where user education is the bottleneck.

Re: We all dodged a bullet

#204

Post by zaik »

We need a permission system for packages just like with Android apps. The text coloring package suddenly needs a file access permission for the new version? Seems strange.

Re: We all dodged a bullet

#205

Post by captn3m0 »

bobbylarrybobby wrote: post #100
com2kid wrote: post #58

Earlier quoted context omitted.

> You're a criminal with a one-in-a-million opportunity. Wouldn't you invest an extra week pushing a more fledged out exploit? Because the way this was pulled off, it was going to be found out right away. It wasn't a subtle insertion, it was a complete account take over. The attacker had only hours before discovery - so the logical thing to do is a hit and run. They asked what is the most money that can be extracted…

If they'd waited a week before using their ill-gotten credentials to update the packages, would they have been detected in that week?

That is what the tj-actions attacker did: https://unit42.paloaltonetworks.com/github-actions-supply-ch...

Re: We all dodged a bullet

#206

Post by croemer »

_fat_santa wrote: post #13

I know this isn't really possible for smaller guys but larger players (like NPM) really should buy up all the TLD versions of "npm" (that is: npm.io, npm.sh, npm.help, etc). One of the reasons this was so effective is that the attacker managed to snap up "npm.help"

npmjs.help not npm.help - the typo is also in the article.

Re: We all dodged a bullet

#207

Post by procaryote »

christophilus wrote: post #135
procaryote wrote: post #124

Earlier quoted context omitted.

I've nixed javascript in the backend in several places, partly because of the weird culture around dependencies. Having to audit that for compliance, or keeping it actually secure, is a nightmare. Nixing javascript in the frontend is a harder sell, sadly

What did you switch to instead? I used to be a C# dev, and have done my fair share of Go. Both of those have decent enough standard libraries that I never found myself with a large 3rd party dependency tree. Ruby, Python, and Clojure, though? They weren’t any better than my npm projects, being roughly the same order of magnitude. Same seems to be true for Rust.

You can get pretty far in python without a lot of dependencies, and the dependencies you do need tend to be more substantial blocks of functionality. Much easier to keep the tree small than npm.

Same with Java, if you avoid springboot and similar everything frameworks, which admittedly is a bit of an uphill battle given the state of java developers.

You can of course also keep dependencies small in javascript, but it's a very uphill fight where you'll have just a few options and most people you hire are used to including a library (that includes 10 libraries) to not have to so something like `if (x % 2 == 1)`

Just started with golang... the language is a bit annoying but the dependency culture seems OK

Re: We all dodged a bullet

#208

Post by blamestross »

kevinrineer wrote: post #156
blamestross wrote: post #129

Earlier quoted context omitted.

"Just wait 2 weeks to use new versions by default" is an amazing defense method against supply chain attacks.

Its also really ineffective defense against 0 days!

Sadly we don't have any defense against 0 days if an emergency patch is indistinguishable from an attack itself.

Better defense would be to delete or quarantine the compromised versions, fail to build and escalate to a human for zero-day defense.

Re: We all dodged a bullet

#209

Post by captn3m0 »

anon7000 wrote: post #31

The nx supply chain attack via npm was the bullet many companies did not doge. I mean, all you needed was to have the VS Code nx plugin installed — which always checked for the latest published nx version on npm. And if you had a local session with GitHub (eg logged into your company’s account via the GH CLI), or some important creds in a .env file… that was exfiltrated. This happened even if you had pinned dependenc…

Yeah, Editor extensions are both auto-updated and installed in high risk dev environments. Quite a juicy target and I am surprised we haven’t seen large scale purchases by bad actors similar to browser extensions yet. However, I remember reading that the VsCode team puts a lot of effort in catching malware. But do all editors (with auto-updates) such as Sublime have such checks?

Re: We all dodged a bullet

#210

Post by lxe »

Gmail could have easily placed a red banner like

> "Warning! This is the first time you have received a message from sender support@npmjs.help. Please be careful with links and attachments, and verify the sender's identity before taking any action."

Post reply on HN