this shouldn't be a problem with golang right? because it uses an id when go mod is used. I'm rusty on go since I haven't used it in over 2 years but I believe this shouldn't affect it?
Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies
281–290 of 412 posts
Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies
#282Earlier quoted context omitted.
This looks like it's... getting there, but still too coarse-grained. It looks like those permissions are granted to the whole Deno process? So if your program needed both access to sensitive data on the filesystem and network access, and it used a malicious dependency, that dependency could take advantage of those permissions and exfiltrate that data. I could be wrong, but I don't see any mention of permissions on im…
You're right. Deno only has app-level permissions. We need module level too.
I think it could be something like only the root module could import net, fs, os... then in order for modules to access those things the root module would need to pass it in explicitly. Of course if you don't import the module at all there is no access.
Of course JS isn't a great language for this. A malicious program could spider the object graph looking for something valuable. You would have to be very careful to keep these objects hidden. And a container library would have huge amounts of access with it needs none. (For example if you want to store a hashmap of open sockets)
A stronger typed language like Rust or Haskell could do better, as you container library can be prevented from casting T to File. However even that is not enough as you can just manually cast a pointer if you somehow know what type it is. (And there is a small amount of reflection that can do this even in safe code).
Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies
#283Earlier quoted context omitted.
I agree on "not maven fault" but I don't find that much bureaucracy insane, for one changing dependencies on a mature java project doesn't happen that often, and for another knowing licensing, possible patent violation and a scan against a known vulnerabilities database is not a bad thing to do and it's normal for it to take some time as it passes hand between different people, after all you don't want devs working o…
50 hours pr top level dependency not once or twice or ten times but every time does however sound like something "cache-like" is missing on the human level?
true I was reasoning more on the 4 hour per package, which is in line. but you're right for sure the unique dependency graph can't be averaging that high
Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies
#284Earlier quoted context omitted.
You're right. Deno only has app-level permissions. We need module level too.
I think it could be something like only the root module could import net, fs, os... then in order for modules to access those things the root module would need to pass it in explicitly. Of course if you don't import the module at all there is no access. Of course JS isn't a great language for this. A malicious program could spider the object graph looking for something valuable. You would have to be very careful to k…
> Of course JS isn't a great language for this. A malicious program could spider the object graph looking for something valuable.
Deno can provide extra syntax or annotations for imports to allow the dev to explicitly allow permission per-import. These can be in the source code, or in a config file.
Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies
#285Bullshit you would be next to julian
Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies
#286Earlier quoted context omitted.
I think it could be something like only the root module could import net, fs, os... then in order for modules to access those things the root module would need to pass it in explicitly. Of course if you don't import the module at all there is no access. Of course JS isn't a great language for this. A malicious program could spider the object graph looking for something valuable. You would have to be very careful to k…
> Of course JS isn't a great language for this. A malicious program could spider the object graph looking for something valuable. Deno can provide extra syntax or annotations for imports to allow the dev to explicitly allow permission per-import. These can be in the source code, or in a config file.
How would this work exactly? How do you control what module's permission to use for any IO?
For example what if you have a callback library that calls a function that does IO? What if you pass an IO function directly as a callback? (For example File.close) If it is the file where the call is textually written how do you handle dynamic calls? (or are they forbidden).
I think the capability model is probably the right one here.
Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies
#287Earlier quoted context omitted.
If the signature reqt is attached to the package metadata, the new package just removed it. If it's part of their custom build system, what signs third party packages? Would it just sign the new one anyway, because how does it know which ones should have PayPal internal signing? Or are you proposing manual controls? shudder Channels and priorities embedded in the package tools are a better approach, combined with som…
> Or are you proposing manual controls? That's what we do. Dependencies are committed to our repository, so changes show up as diffs which are looked through then. Then again we don't use libraries for padding strings and such...
I've found that it is easy for discipline to slide on manual controls. It starts off rigourous and tails off into being done infrequently (which makes it a big job) and perfunctorily. This will save you from things that hit the bleeding edge, the idiots who pull from latest on a prod instance, but leaves you exposed to the patched bugs, with increasingly good exploits.
Diff inspection will catch some obviously bad things, but it will rarely catch anything clever. So it would be down to luck, if you had merged in this patch before it was spotted/announced. Unless you have something to separate the namespaces? Check for conflicts? I guess CI might work, hoping your CI machines are sandboxed.
Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies
#288> The packages had preinstall scripts that automatically launched a script to exfiltrate identifying information from the machine as soon as the build process pulled the packages in. Pre and post install scripts in NPM packages are such a terrible idea. Even when it’s not malware, it usually just a nagging donation request with a deliberate “sleep 5” to slow down your build and keep the text displayed.
Are there many package manager that do not have either pre-, post- or build scripts or plugins allowing arbitrary code execution during build? pkg managers that do have that: cargo (build.rs), pip (setup.py), npm (install scripts), apt/rpm/pacman (postinstall hooks) Maybe the only exceptions are Go and Java package managers?
Go considers this to be a security bug, as was seen recently with: https://blog.golang.org/path-security (talked about briefly here: https://news.ycombinator.com/item?id=25881212)
Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies
#289luckily I reserved my company's namespace in packagist few months ago. each package manager works differently and it is hard to know inner workings of all package managers
Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies
#290I’m cackling at how great this is. This is what happens when you trust the internet forever and just scarf down any old thing at build time. Of course it’ll get exploited! That’s what evil people do.
Also happy.
I'm very happy to finally have a real world example to motivate all the folks that eye-rolled me every time I've raised it in the past. It just resonates better, especially with less technical leadership folks.