Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies

medium.com

Post reply on HN
Print view View original

31–40 of 412 posts

Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies

#31

Post by CaptArmchair »

rachelbythebay wrote: post #4

I’m cackling at how great this is. This is what happens when you trust the internet forever and just scarf down any old thing at build time. Of course it’ll get exploited! That’s what evil people do.

There are a lot of expensive things you can outsource. Responsibility isn't among those.

Free software / open source propels engineering as you can share and leverage the results of collective efforts. However, at no point did the concept come with inherent guarantees about concerns such as security.

esr defined 19 points for "good" open source software development in his seminal essay "The Cathedral and the Bazaar". I feel some of those are sometimes easily thrown out of the window for the sake of "efficiency" or "cost-effectiveness".

This issue resonates with bullet point 17 in particular:

> A security system is only as secure as its secret. Beware of pseudo-secrets.

I think this issue has less to do with package managers, and a lot with companies rushing into the convenience of public code platforms such as Github without properly vetting whether or not they might be inadvertently leaking internal information through packaging manifests.

https://en.wikipedia.org/wiki/The_Cathedral_and_the_Bazaar

Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies

#32

Post by kasperni »

I'm surprised the reverse fully-qualified domain name (FQDN) model used by Java isn't more widely adopted. If you want to upload artifacts to the main repository (Maven Central) you first need to show ownership of a particular domain. For example, via a DNS TXT record (example [1]). Would make these kind of attacks a lot more difficult.

[1] https://issues.sonatype.org/browse/OSSRH-61509

Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies

#33

Post by nightpool »

withinboredom wrote: post #21
nightpool wrote: post #15

The article mentions that RubyGems is vulnerable to this, and that Shopify in particular downloaded and ran a gem named "shopify-cloud", but I'm curious as to how this is possible given a "normal" bundler pure-lockfile setup, or more generally the source-block directives I've seen in most Gemfiles. That is, given a Gemfile.lock like, e.g. GIT remote: https://github.com/thoughtbot/appraisal revision: 5675d17a95cfe904c…

Someone will eventually update deps, not necessarily CI. But now that devs machine is compromised. The attacker probably only has a small window of time after it gets in, but it should be long enough to exfiltrate dot-files and the source code of whatever it gets included in. Now they have ssh keys (mine are on a yubikey), and the GitHub url. They can further push malicious code into the repo.

I would hope most SSH keys are password-encrypted if not protected by a hardware token like yours, but I agree that the "unscoped-source" Gemfile syntax is a huge vulnerable hole, and a bad one. I'm just confused about how what seems like a pretty uncommon operation led to such an immediate response and code execution from Shopify.

(I also don't think it's true that the attacker has a "small window of time"—as soon as they get a single RCE, it's over, if they're running on a normal dev machine then they can daemonize into the background, add persistence, and snoop events over time. CI systems are obviously less vulnerable to this by nature.)

Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies

#34

Post by hanselot »

peteretep wrote: post #29
rachelbythebay wrote: post #4

I’m cackling at how great this is. This is what happens when you trust the internet forever and just scarf down any old thing at build time. Of course it’ll get exploited! That’s what evil people do.

You say this, but I feel like in the 20-odd years I’ve been using package managers I’ve seen very very few real world exploits?

Why would the ones getting away with it bother publishing articles about it? Rather, 20 years is a plenty long enough time to cover your tracks.

Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies

#35

Post by PartiallyTyped »

greggman3 wrote: post #22
rachelbythebay wrote: post #4

I’m cackling at how great this is. This is what happens when you trust the internet forever and just scarf down any old thing at build time. Of course it’ll get exploited! That’s what evil people do.

There's more coming.... tons of github integrations ask for blanket access to your account vs Oauth, ( https://github.com/marketplace ). Tons of github users give that access, the access_tokens are only a password type breach away. If you have these access_tokens you can edit the repos they are for all you want.

Different access tokens have different permissions, you can't just do whatever you want.

Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies

#36

Post by leetrout »

greggman3 wrote: post #22
rachelbythebay wrote: post #4

I’m cackling at how great this is. This is what happens when you trust the internet forever and just scarf down any old thing at build time. Of course it’ll get exploited! That’s what evil people do.

There's more coming.... tons of github integrations ask for blanket access to your account vs Oauth, ( https://github.com/marketplace ). Tons of github users give that access, the access_tokens are only a password type breach away. If you have these access_tokens you can edit the repos they are for all you want.

Apparently the Oauth scopes are much worse than GitHubs apps. Only GitHub apps allow read only access to the “metadata” by default whereas Oauth apps get access to the code, deploy keys, etc with no way to limit that access per repo.

https://docs.github.com/en/developers/apps/scopes-for-oauth-...

https://docs.github.com/en/rest/reference/permissions-requir...

Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies

#37

Post by walrus01 »

npm in particular has been problematic for a long time:

https://naildrivin5.com/blog/2019/07/10/the-frightening-stat...

https://techbeacon.com/security/check-your-dependencies-gith...

https://thenewstack.io/npm-password-resets-show-developers-n...

Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies

#38

Post by walrus01 »

rachelbythebay wrote: post #4

I’m cackling at how great this is. This is what happens when you trust the internet forever and just scarf down any old thing at build time. Of course it’ll get exploited! That’s what evil people do.

Hey let's just sudo curl | bash

what could possibly go wrong?

Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies

#39

Post by gardaani »

greggman3 wrote: post #22
rachelbythebay wrote: post #4

I’m cackling at how great this is. This is what happens when you trust the internet forever and just scarf down any old thing at build time. Of course it’ll get exploited! That’s what evil people do.

There's more coming.... tons of github integrations ask for blanket access to your account vs Oauth, ( https://github.com/marketplace ). Tons of github users give that access, the access_tokens are only a password type breach away. If you have these access_tokens you can edit the repos they are for all you want.

At the moment, there's a story about github1s.com on the front page of HN and people are asking how to give it access to their company private repos [1][2]. Scary.

[1] https://news.ycombinator.com/item?id=26087017

[2] https://news.ycombinator.com/item?id=26086789

Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies

#40

Post by Cthulhu_ »

peteretep wrote: post #29
rachelbythebay wrote: post #4

I’m cackling at how great this is. This is what happens when you trust the internet forever and just scarf down any old thing at build time. Of course it’ll get exploited! That’s what evil people do.

You say this, but I feel like in the 20-odd years I’ve been using package managers I’ve seen very very few real world exploits?

Consider yourself lucky I guess? I mean in the 20-odd years I've been driving I've never had an accident either.
Post reply on HN