Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Keylogger discovered in image generator extension

old.reddit.com

Post reply on HN
Print view View original

31–40 of 102 posts

Re: Keylogger discovered in image generator extension

#31

Post by froggertoaster »

tamimio wrote: post #28
vvpan wrote: post #27

Earlier quoted context omitted.

Which is everybody in the world except for a handful of people.

Not really, and it takes a few minutes because most of these packages (including npm) are small. You don’t have to read the WireGuard codebase because it’s reputable enough, but for obscure or unknown add-ons/package code, it’s on you to double-check, just like reading the ‘readme’.

You can't "not really" this away. Most people don't bother looking at small package code, much less code for packages that are far more complex.

Re: Keylogger discovered in image generator extension

#32

Post by redserk »

tamimio wrote: post #28
vvpan wrote: post #27

Earlier quoted context omitted.

Which is everybody in the world except for a handful of people.

Not really, and it takes a few minutes because most of these packages (including npm) are small. You don’t have to read the WireGuard codebase because it’s reputable enough, but for obscure or unknown add-ons/package code, it’s on you to double-check, just like reading the ‘readme’.

So just sneak the code in a dependency of a dependency.

Who’s diving 3-4 layers deep into dependencies?

Re: Keylogger discovered in image generator extension

#33

Post by Maxious »

nsingh2 wrote: post #7

Not surprised at all, ComfyUI extensions are just arbitrary python code. The first time I tried ComfyUI extensions I put it in a podman container with GPU passthrough and blocked network access.

Comfy UI manager recently added some security levels so that by default you can't accidentally leave a public instance that allows remotely installing arbitrary python code https://github.com/ltdrdata/ComfyUI-Manager?tab=readme-ov-fi...

Re: Keylogger discovered in image generator extension

#34

Post by yonixw »

Geee wrote: post #29
tamimio wrote: post #25

Lesson for the people who run and execute stuff without looking at the code first.

Ain't nobody got time for that. LLMs should be capable of analysing code for anything malicious / suspicious.

Since LLM and keyloggers are turing machines, it won't happen. (Or more precisely: it won't beat the cat and mouse game of obfuscations.)

Re: Keylogger discovered in image generator extension

#35

Post by bdlowery »

tamimio wrote: post #28
vvpan wrote: post #27

Earlier quoted context omitted.

Which is everybody in the world except for a handful of people.

Not really, and it takes a few minutes because most of these packages (including npm) are small. You don’t have to read the WireGuard codebase because it’s reputable enough, but for obscure or unknown add-ons/package code, it’s on you to double-check, just like reading the ‘readme’.

I haven’t looked at the source code of a single npm package I’ve installed in the past 5 years.

“It takes a few minutes”

Dude my web dev projects have like 1,000s of dependencies. I’m not going to check the source code of every package tailwind requires.

Re: Keylogger discovered in image generator extension

#36

Post by kibwen »

Geee wrote: post #29
tamimio wrote: post #25

Lesson for the people who run and execute stuff without looking at the code first.

Ain't nobody got time for that. LLMs should be capable of analysing code for anything malicious / suspicious.

Unfortunately, no, because the existence of LLMs that can automatically determine code that is suspicious will be offset by the existence of LLMs that can generate malicious code that bypasses the detection abilities of the aforementioned LLMs.

Re: Keylogger discovered in image generator extension

#37

Post by astromaniak »

Geee wrote: post #29
tamimio wrote: post #25

Lesson for the people who run and execute stuff without looking at the code first.

Ain't nobody got time for that. LLMs should be capable of analysing code for anything malicious / suspicious.

No, they cannot work with large code base, not yet. And have very limited talent for logic and debugging. They may improve at some point, probably will be hooked up with external tools.

Re: Keylogger discovered in image generator extension

#38

Post by netule »

redserk wrote: post #32
tamimio wrote: post #28

Earlier quoted context omitted.

Not really, and it takes a few minutes because most of these packages (including npm) are small. You don’t have to read the WireGuard codebase because it’s reputable enough, but for obscure or unknown add-ons/package code, it’s on you to double-check, just like reading the ‘readme’.

So just sneak the code in a dependency of a dependency. Who’s diving 3-4 layers deep into dependencies?

No need to hide it inside dependencies, just modify the code before building and pushing the package to PyPi.

Re: Keylogger discovered in image generator extension

#40

Post by ehsankia »

14 wrote: post #8

Is there no way to defend against a keylogger? What can you do if a simple keylogger can steal your passwords?

"keylogger" may not be the right term here? I'm not familiar with how that term is broadly used for, but my definition of that term is a tool that logs your keypresses. Here, it seems like it was scraping your chrome/firefox data for login cookies?

Honestly there's quite a lot of malware that go against those files, I wonder if there's a way to require high privilege to accessing chrome/firefox appdata, or just block it entirely from other apps.

Post reply on HN