Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies • Hacker News Board

Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies

#221

Post by DecoPerson » Wed, Feb 10, 2021, 3:50 PM UTC

Imagine we navigated the web using a command line tool called “goto” which works exactly like a package manager. If I want to open my bank’s site, I type “goto mybank” .

I could easily find myself in trouble, because:

- There’s no autocomplete or bookmarks, so typos are easy.

- If “mybank” is a name provided by my company’s name server, I could find myself redirected to the public “mybank” entry because Mr. Not-A-Hacker says his name entry is more up to date (or because I forgot to tell ‘goto’ to check the company name server.)

- There’s no “green padlock” to check while I’m actively using the destination site. (Though at this point it’s too late because a few moments after I hit enter the destination site had the same access to my machine & network that I do from my current terminal.)

- A trusted site may later become malicious, which is bad due to the level of unrestricted and unmonitored access to my PC the site can have.

- Using scripting tricks, regular sandboxed browser websites can manipulate my clipboard so I paste something into ‘goto’ that I didn’t realize would be in my clipboard, making me navigate to some malicious site and giving it full access to my machine (if ‘sudo’ as added to the front).

This is just a few cases off the top of my head. If ‘goto’ was a real thing, we’d laugh it into being replaced by something more trustable.

How have current package managers not had these vulnerabilities fixed yet? I don’t understand.

Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies

#222

Post by bagacrap » Wed, Feb 10, 2021, 3:50 PM UTC

unilynx wrote: post #211

These install hooks... Why are they needed at all and why can't package (de)installation be without side effects ? I'm sure the hooks are needed for things NPM can't do by itself, but they shouldn't run by default. That puts pressure on developers to avoid them, and puts pressure on NPM to add whatever functionality is missing from package.json in a safe way. (and have npmjs.com search rank packages without scripts a…

What would happen if the install hooks weren't there? You'd still have client code calling into the compromised package. Would it be possible to handle those calls without knowing the symbol names used by the internal package?

Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies

#223

Post by eecc » Wed, Feb 10, 2021, 3:52 PM UTC

ryukafalz wrote: post #194

I see a lot of people saying things like "this is why package signing is important" and "we need to know who the developers are" and "we need to audit everything." Some of that is true to some degree, but let me ask you this: why do we consider it acceptable that code you install through a package manager implicitly gets to do anything to your system that you can do? That seems silly! Surely we can do better than tha…

Uh, well the original developers of the Sun JVM didn’t do such a bad job after all when designing it: https://docs.oracle.com/javase/7/docs/technotes/guides/secur...

Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies

#224

Post by eecc » Wed, Feb 10, 2021, 3:52 PM UTC

detaro wrote: post #208

ryukafalz wrote: post #194

I see a lot of people saying things like "this is why package signing is important" and "we need to know who the developers are" and "we need to audit everything." Some of that is true to some degree, but let me ask you this: why do we consider it acceptable that code you install through a package manager implicitly gets to do anything to your system that you can do? That seems silly! Surely we can do better than tha…

Indeed, being able to apply capabilities on a package level would be great, but I don't know many languages/environments that implement this as a first-class feature.

Java does. Of course it’s never been used systematically and it has received precious little attention to DevOps ergonomics, but the infrastructure is there

Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies

#225

Post by zaphar » Wed, Feb 10, 2021, 3:53 PM UTC

0xbadcafebee wrote: post #187

mavhc wrote: post #179

https://security.googleblog.com/2021/02/know-prevent-fix-fra... At Google, we have those resources and go to extraordinary lengths to manage the open source packages we use—including keeping a private repo of all open source packages we use internally

That's more for availability than security. Assuming you keep the crypto checksums / author signatures of all the source code and packages, you don't need to keep a copy of the source / packages. Just verify them at download time. Many Linux distros don't even have a copy of all those binaries, they rely on HTTP mirrors of random organizations. It's also useful for your organization to rebuild all of the source code…

It's not just that. Because it's all in the same repo and built with the same build tool it's also easier to run the same security checks you would use for your own code all automatically as part of your build process. All the tooling you use to secure your own code can be used to secure third party code as well with the same low level of friction.

Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies

#226

Post by nogbit » Wed, Feb 10, 2021, 3:54 PM UTC

easton wrote: post #217

ryukafalz wrote: post #194

I see a lot of people saying things like "this is why package signing is important" and "we need to know who the developers are" and "we need to audit everything." Some of that is true to some degree, but let me ask you this: why do we consider it acceptable that code you install through a package manager implicitly gets to do anything to your system that you can do? That seems silly! Surely we can do better than tha…

I believe that Deno (the "successor" to Node being written by Ryan Dahl) is supposed to fix this for server-side JavaScript/TypeScript. It doesn't grant any permissions to anything unless you specifically give them out (so you can say that only a specific module gets access to the filesystem, for instance, and on top of that it can only access /srv and not /etc). https://deno.land/manual@v1.7.2/getting_started/permis…

I think this is critical. The actual runtime of any code needs to do way more than what it’s doing now.

Simply relying on package signing and the like permits trusted but malicious actors. With Deno packages configured well it can really lock down and limit a ton of attack vectors.

Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies

#227

Post by austincheney » Wed, Feb 10, 2021, 3:56 PM UTC

ritchiea wrote: post #212

austincheney wrote: post #204

Earlier quoted context omitted.

Whether the package managers are poorly designed is completely ancillary. It really is primarily about developer laziness, incompetence, easiness. Proof: https://www.theregister.com/2016/03/23/npm_left_pad_chaos/ Sudden unplanned loss of availability is a catastrophic security problem, the A in the security CIA[1]. Worse is that the dependency that caused that problem was something that should never have been a depen…

You can call it laziness but lots of developers correctly assume they'd be out of their jobs or at best out of favor at their company if they raised a fuss about dependency management rather than use (flawed) industry standard tools and get to work on features. No one gets fired for using npm, you might get fired for insisting you build your own dependency management system because npm is insecure rather than working…

> No one gets fired for using npm

Most developers are eager to accept any resulting consequences because they don't own the consequences and because they are fearful of writing original code.

Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies

#228

Post by ryukafalz » Wed, Feb 10, 2021, 3:57 PM UTC

easton wrote: post #217

ryukafalz wrote: post #194

I see a lot of people saying things like "this is why package signing is important" and "we need to know who the developers are" and "we need to audit everything." Some of that is true to some degree, but let me ask you this: why do we consider it acceptable that code you install through a package manager implicitly gets to do anything to your system that you can do? That seems silly! Surely we can do better than tha…

I believe that Deno (the "successor" to Node being written by Ryan Dahl) is supposed to fix this for server-side JavaScript/TypeScript. It doesn't grant any permissions to anything unless you specifically give them out (so you can say that only a specific module gets access to the filesystem, for instance, and on top of that it can only access /srv and not /etc). https://deno.land/manual@v1.7.2/getting_started/permis…

This looks like it's... getting there, but still too coarse-grained. It looks like those permissions are granted to the whole Deno process? So if your program needed both access to sensitive data on the filesystem and network access, and it used a malicious dependency, that dependency could take advantage of those permissions and exfiltrate that data.

I could be wrong, but I don't see any mention of permissions on imported code: https://deno.land/manual@v1.7.2/examples/import_export

Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies

#229

Post by dwohnitmok » Wed, Feb 10, 2021, 3:59 PM UTC

detaro wrote: post #208

ryukafalz wrote: post #194

I see a lot of people saying things like "this is why package signing is important" and "we need to know who the developers are" and "we need to audit everything." Some of that is true to some degree, but let me ask you this: why do we consider it acceptable that code you install through a package manager implicitly gets to do anything to your system that you can do? That seems silly! Surely we can do better than tha…

Indeed, being able to apply capabilities on a package level would be great, but I don't know many languages/environments that implement this as a first-class feature.

Safe Haskell is one in this vein (it's lower level and you would apply a capability layer on top), although like other past efforts on this front it's mostly languished in obscurity even among the Haskell community and is used by very few people.

The main hope at the moment seems to be JS.

Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies

#230

Post by ritchiea » Wed, Feb 10, 2021, 4:00 PM UTC

austincheney wrote: post #227

ritchiea wrote: post #212

Earlier quoted context omitted.

You can call it laziness but lots of developers correctly assume they'd be out of their jobs or at best out of favor at their company if they raised a fuss about dependency management rather than use (flawed) industry standard tools and get to work on features. No one gets fired for using npm, you might get fired for insisting you build your own dependency management system because npm is insecure rather than working…

> No one gets fired for using npm Most developers are eager to accept any resulting consequences because they don't own the consequences and because they are fearful of writing original code.

Some developers are fearful of writing original code. Others realize it's not going to be appreciated by their colleagues to write their own package manager to solve a problem most of the industry disregards. Imagine arguing for getting the "write our own package manager to replace npm/yarn/pip" ticket into a sprint.