Question for you guys here: Is this kind of attack possible using Nuget-Package manager?
Yes, it's possible. I've tried it myself.
Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies
241–250 of 412 posts
Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies
#242Question for you guys here: Is this kind of attack possible using Nuget-Package manager?
Fresh [PDF from MSFT mentioning nuget](https://azure.microsoft.com/mediahandler/files/resourcefiles...)
Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies
#243I see a lot of people saying things like "this is why package signing is important" and "we need to know who the developers are" and "we need to audit everything." Some of that is true to some degree, but let me ask you this: why do we consider it acceptable that code you install through a package manager implicitly gets to do anything to your system that you can do? That seems silly! Surely we can do better than tha…
This is so obviously what needs to happen, it's really surprising it's not a feature in all major languages by now. I bet in 10 years time, giving dependencies complete control would seem crazy.
Here is an interesting proposal on how to possibly get there in JS with import maps: https://guybedford.com/secure-modular-runtimes
Deno uses ambient permissions for the entire process and unfortunately missed the opportunity to do it right.
Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies
#244Earlier quoted context omitted.
Nobody in this thread argues that npm is not bad (it is), the current topic is: “is maven's design[1] better” and there is little evidence on this front. Maven was (yes, I'm using the past on purpose) not a panacea that later system failed to equal: it has the usability of an IRS form and never gained as much popularity in the Java world than npm in the JavaScript one for that reason. In 2014, last time I did Java fo…
Sounds like you had some poor experiences with people who didn't know what they were doing. The proper way to audit your dependencies is to run an in-house Maven repository server. Just like you would for npm, or any package repository really. So you just spin up Sonatype Nexus, proxy the repositories you trust and disallow releases from being overwritten. That way you're certain the jar you're using today, is the ex…
We do this. I had to work on a greenfield project and it used a ton of libs that weren’t in our repo. It was so annoying to have a list of repos to add to the in-house list, then discover things didn’t work, so now we need these. It literally added weeks of man-hours to the project, per day.
Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies
#245Popularized 3 years ago: https://medium.com/hackernoon/im-harvesting-credit-card-numb...
Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies
#246Earlier quoted context omitted.
Could you solve this in Java using the SecurityManager stuff that was used to sandbox applets, or is all that considered broken these days? (I'm not sure if you can different SecurityManagers for different parts of the app though.)
I'm not familiar enough with Java to have a strong opinion on this, but this HN comment from the linked article mentions that you can only have one SecurityManager per app, so sounds like that's still too coarse-grained: https://news.ycombinator.com/item?id=18599365
In my experience, the biggest problem with the Java SecurityManager approach is that it's thought of as too difficult to understand / cumbersome to configure (and I'm not saying this belief is wrong), and so most apps either run with no SecurityManager explicitly configured or configure things the "simplest possible way" which usually winds up being approximately equivalent to "anybody can do anything".
Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies
#247I see a lot of people saying things like "this is why package signing is important" and "we need to know who the developers are" and "we need to audit everything." Some of that is true to some degree, but let me ask you this: why do we consider it acceptable that code you install through a package manager implicitly gets to do anything to your system that you can do? That seems silly! Surely we can do better than tha…
Indeed, being able to apply capabilities on a package level would be great, but I don't know many languages/environments that implement this as a first-class feature.
The WASM ecosystem is exploring this through the use of what they call "nanoprocesses" wherein libraries are wrapped into modules and provided access to nothing by default [1]. This seems to be more of a pattern and consequence of how WASM works than a specific feature.
1. https://hacks.mozilla.org/2019/11/announcing-the-bytecode-al... (ignore the title, it's irrelevant to the excellent explanation that constitutes 70% of the post)
Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies
#248Earlier quoted context omitted.
apples and oranges, the name conflict was perfectly disambiguated by the use of the mandatory group identifier. npm design was so bad that you could at the beginning upload over an existing version of your package name and break dependencies retroactively even to people that pinned versions. if you want to try some good old whataboutism, at least try to be in the same ballpark.
Nobody in this thread argues that npm is not bad (it is), the current topic is: “is maven's design[1] better” and there is little evidence on this front. Maven was (yes, I'm using the past on purpose) not a panacea that later system failed to equal: it has the usability of an IRS form and never gained as much popularity in the Java world than npm in the JavaScript one for that reason. In 2014, last time I did Java fo…
> it has the usability of an IRS form and never gained as much popularity in the Java world than npm in the JavaScript one for that reason.
I thought IRS forms were hard?
I have more than a decade of experience collected from work with CDs (Delphi), downloaded libraries (Delphi, Java, PHP), Ant (Java), Maven (Java), PEAR (PHP), Composer (PHP), Nuget (.Net), NPM/Yarn (Javascript/TypeScript) and Gradle (Java/Kotlin).
Two of these have been somewhat easy to work with for as long as I used them: Maven and Yarn. I hear NPM us usable now, but it absolutely wasn't good early on.
> “we are getting .jar files individually and not using maven because it's a [...] mess”
It seems obvious from your writing that you either worked in a place that was really serious about security or had no clue. Both could result in this conclusion, but based on your writing my bet is on the latter, i.e. they were clueless.
Edit:
Reading your comment here: https://news.ycombinator.com/item?id=26091480
I have concluded that it was a mix of those two: the people you worked for were trying really hard to be really serious about security and failing to automate it.
Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies
#249Earlier quoted context omitted.
Yes. The way we develop software quite frankly scares the shit out of me on a daily basis.
Well it's mostly held together by trust and (in the commercial case) warranty. That said there's so many potential entry points for malicious actors it's not even funny anymore (esp. in desktop computing)... I try not to think about it too much and have faith in the powers that be
Every software package and SaaS provider always includes an explicit lack of warranty somewhere in their TOS - and if that means we’re just working off trust, we probably need to move to more ‘trust but verify’ instead of the current ‘fool me once, well just fool me as many times as you want because I won’t use something else anyway and you know it’ model we seem to be using now.
Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies
#250Earlier quoted context omitted.
Nobody in this thread argues that npm is not bad (it is), the current topic is: “is maven's design[1] better” and there is little evidence on this front. Maven was (yes, I'm using the past on purpose) not a panacea that later system failed to equal: it has the usability of an IRS form and never gained as much popularity in the Java world than npm in the JavaScript one for that reason. In 2014, last time I did Java fo…
Maven is ubiquitous in the Java world and the de-facto package/dependency management system out there. Has been since the mid-2000's and as of 2018 when I last did Java development (Scala really), it is still widely in use. Getting jar files manually would have me running from whatever company that was doing that. Let me guess, they wrote all their code in Notepad because IDE's are a "fucking mess" too right?
You vastly underestimate the level of bureaucracy that can exist in the biggest Java users of this planet (namely banks and public administrations): in these organization (at least a few years ago, the Solarwind attack shows it may not be the case anymore) every single dependency you want to use must be justified, and then is audited by a dedicated team, which ends up handing you the validated .jar.
It was a common development practice in these entities (I was working as a contractor, for different customers), most of them have been using computer programs at there core long before the internet went mainstream.