Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We all dodged a bullet

xeiaso.net

Post reply on HN
Print view View original

291–300 of 498 posts

Re: We all dodged a bullet

#291

Post by brazzy »

benoau wrote: post #142
pluto_modadic wrote: post #89

Earlier quoted context omitted.

"found out right away"... by people with time to review security bulletins. There's loads of places I could see this slipping through the cracks for months.

There's probably already hundreds of thousands of Jira tickets to fix it with no sprint assigned....

I feel attacked.

And very, very happy that we're proxying all access to npm through Artifactory, which allowed us to block the affected versions and verify that they were in fact never pulled by any of our builds.

Re: We all dodged a bullet

#292

Post by minitech »

blamestross wrote: post #208
kevinrineer wrote: post #156

Earlier quoted context omitted.

Its also really ineffective defense against 0 days!

Sadly we don't have any defense against 0 days if an emergency patch is indistinguishable from an attack itself. Better defense would be to delete or quarantine the compromised versions, fail to build and escalate to a human for zero-day defense.

> Sadly we don't have any defense against 0 days if an emergency patch is indistinguishable from an attack itself.

Reading the code content of emergency patches should be part of the job. Of course, with better code trust tools (there seem to have been some attempts at that lately, not sure where they’re at), we can delegate that and still do much better than the current state of things.

Re: We all dodged a bullet

#293

Post by mhh__ »

simoncion wrote: post #81
quectophoton wrote: post #62

Earlier quoted context omitted.

Then you have companies like AWS, they were sending invoices from `no-reply-aws@amazon.com` but last month they changed it to `no-reply@tax-and-invoicing.us-east-1.amazonaws.com`. That looks like a phishing attempt from someone using a random EC2 instance or something, but apparently it's legit. I think . Even the "heads-up" email they sent beforehand looked like phishing, so I was waiting for the actual invoice to s…

> These companies tell customers to be suspicious of phishing attempts, and then they pull these stunts. Yep. At every BigCo I've worked at, nearly all of the emails from Corporate have been indistinguishable from phishing. Sometimes, they're actual spam! Do the executives and directors responsible for sending these messages care? No. They never do, and get super defensive and self-righteous when you show them exactl…

Yielding to anything you say is a no-no because part of the deal is that you, as a geek, must bend over to their unilateral veto over everything in the company

Re: We all dodged a bullet

#296

Post by karmakaze »

_fat_santa wrote: post #13

I know this isn't really possible for smaller guys but larger players (like NPM) really should buy up all the TLD versions of "npm" (that is: npm.io, npm.sh, npm.help, etc). One of the reasons this was so effective is that the attacker managed to snap up "npm.help"

First thing I do is check any domain that I don't recognize as official.

  Domain: NPMJS.HELP (85 similar domains)
  Registrar: Porkbun, LLC (4.84 million domains)
  Query Time: 8 Sep 2025 - 4:14 PM UTC  [1 DAY BACK] [REFRESH]

  Registered: 5th September 2025  [4 days back]
  Expiry: 5th September 2026  [11 months, 25 days left]
I'd be suspicious of anything registered with Porkbun discount registrar. 4 days ago, means it's fake.

> It sets a deadline a few days in the future. This creates a sense of urgency, and when you combine urgency with being rushed by life, you are much more likely to fall for the phishing link.

Any time I feel like I'm being rushed, I check deeper. It would help if everyone's official communications only came from the most well known domain (or subdomain).

Re: We all dodged a bullet

#297

Post by jowea »

com2kid wrote: post #58
sebstefan wrote: post #48

Dodged a bullet indeed I find it insane that someone would get access to a package like this, then just push a shitty crypto stealer. You're a criminal with a one-in-a-million opportunity. Wouldn't you invest an extra week pushing a more fledged out exploit? You can exfiltrate API keys, add your SSH public key to the server then exfiltrate the server's IP address so you can snoop in there manually, if you're on a dev…

> You're a criminal with a one-in-a-million opportunity. Wouldn't you invest an extra week pushing a more fledged out exploit? Because the way this was pulled off, it was going to be found out right away. It wasn't a subtle insertion, it was a complete account take over. The attacker had only hours before discovery - so the logical thing to do is a hit and run. They asked what is the most money that can be extracted…

To be fair, this wasn't a super demanding 0-day attack, it was a slightly targeted email phish. Maybe the attacker isn't that sophisticated and just went with what is familiar?

Re: We all dodged a bullet

#298

Post by pixl97 »

brazzy wrote: post #291
benoau wrote: post #142

Earlier quoted context omitted.

There's probably already hundreds of thousands of Jira tickets to fix it with no sprint assigned....

I feel attacked. And very, very happy that we're proxying all access to npm through Artifactory, which allowed us to block the affected versions and verify that they were in fact never pulled by any of our builds.

About to say, if you're in a company of any size and you're not doing it this way, you're doing it wrong.

Re: We all dodged a bullet

#299

Post by pixl97 »

boznz wrote: post #240
sebstefan wrote: post #48

Dodged a bullet indeed I find it insane that someone would get access to a package like this, then just push a shitty crypto stealer. You're a criminal with a one-in-a-million opportunity. Wouldn't you invest an extra week pushing a more fledged out exploit? You can exfiltrate API keys, add your SSH public key to the server then exfiltrate the server's IP address so you can snoop in there manually, if you're on a dev…

It is not a one-in-a-million opportunity though. I hate to take this to the next level, but as criminal elements wake up to the fact that a few "geeks" can possibly get them access to millions of dollars expect much worse to come. As a maintainer of any code that could gain bad guys access, I would be seriously considering how well my physical identity is hidden on-line.

As foretold by the prophet

https://xkcd.com/538/

Re: We all dodged a bullet

#300

Post by pixl97 »

deepanwadhwa wrote: post #260
sebstefan wrote: post #48

Dodged a bullet indeed I find it insane that someone would get access to a package like this, then just push a shitty crypto stealer. You're a criminal with a one-in-a-million opportunity. Wouldn't you invest an extra week pushing a more fledged out exploit? You can exfiltrate API keys, add your SSH public key to the server then exfiltrate the server's IP address so you can snoop in there manually, if you're on a dev…

What makes you so sure that the exploit is over? Maybe they wanted their secondary exploit to get caught to give everyone a sense of security? Their primary exploit might still be lurking somewhere in the code?

Well, because it is really easy to diff an npm package.

The attacker had access to the user's npm repository only.

Post reply on HN