Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We all dodged a bullet

xeiaso.net

Post reply on HN
Print view View original

31–40 of 498 posts

Re: We all dodged a bullet

#31

Post by anon7000 »

The nx supply chain attack via npm was the bullet many companies did not doge. I mean, all you needed was to have the VS Code nx plugin installed — which always checked for the latest published nx version on npm. And if you had a local session with GitHub (eg logged into your company’s account via the GH CLI), or some important creds in a .env file… that was exfiltrated.

This happened even if you had pinned dependencies and were on top of security updates.

We need some deeper changes in the ecosystem.

https://github.com/nrwl/nx/security/advisories/GHSA-cxm3-wv7...

Re: We all dodged a bullet

#32

Post by cgh »

Havoc wrote: post #12

Really feels like these big open packages repos need a better security solution. Or at least a core subset of carefully vetted ones. Same issue with python, rust etc. It’s all very trust driven

Is the fundamental problem with npm still a lack of enforced namespacing?

In the Java world, I know there’s been griping from mostly juniors re “why isn’t Maven easy like npm?” (I work with some of these people). I point them to this article: https://www.sonatype.com/blog/why-namespacing-matters-in-pub...

Maven got a lot of things right back in the day. Yes POM files are in xml and we all know xml sucks etc, but aside from that the stodgy focus on robustness and carefully considered change gets more impressive all the time.

Re: We all dodged a bullet

#33

Post by [deleted] »

ivape wrote: post #6

Dat domain name. Yeah, stop those cute domain names. I never got the memo on Youtu.be, I just had “learn” it was okay. Of course people started to let their guard down because dumbasses started to get cute. We all did dodge a bullet because we’ve been installing stuff from NPM with reckless abandon for awhile. Can anyone give me a reason why this wouldn’t happen in other ecosystems like Python, because I really don’t…

[deleted]

Re: We all dodged a bullet

#34

Post by wzamqo »

1-more wrote: post #29
ivape wrote: post #6

Dat domain name. Yeah, stop those cute domain names. I never got the memo on Youtu.be, I just had “learn” it was okay. Of course people started to let their guard down because dumbasses started to get cute. We all did dodge a bullet because we’ve been installing stuff from NPM with reckless abandon for awhile. Can anyone give me a reason why this wouldn’t happen in other ecosystems like Python, because I really don’t…

of all people my mortgage servicer is the worst about this. Your login is valid on like 3 different top level domains and you get bounced between them when you sign in, eventually going from servicer.com to myservicer.com to servicer.otherthing.com! It's as though they were training you to not care about domain names.

Paying US taxes online is just as bad. The official way to pay tax balances with a debit card online is to use officialpayments[.]com. This is what the IRS advises you to use. Our industry is a clown factory.

Re: We all dodged a bullet

#35

Post by cataflam »

Besides the ecosystem issues, for the phishing part, I'll repost what I responded somewhere in the other related post, for awareness

---

I figure you aren't about to get fooled by phishing anytime soon, but based on some of your remarks and remarks of others, a PSA:

TRUSTING YOUR OWN SENSES to "check" that a domain is right, or an email is right, or the wording has some urgency or whatever is BOUND TO FAIL often enough.

I don't understand how most of the anti-phishing advice focuses on that, it's useless to borderline counter-productive.

What really helps against phishing :

1. NEVER EVER login from an email link. EVER. There are enough legit and phishing emails asking you to do this that it's basically impossible to tell one from the other. The only way to win is to not try.

2. U2F/Webauthn key as second factor is phishing-proof. TOTP is not.

That is all there is. Any other method, any other "indicator" helps but is error-prone, which means someone somewhere will get phished eventually. Particularly if stressed, tired, or in a hurry. It just happened to be you this time.

Re: We all dodged a bullet

#36

Post by leoc »

> Even then, that wouldn't really stand out to me because I've seen companies use new generic top level domains to separate out things like the blog at .blog or the docs at .guide, not to mention the .new stack.

This is very much a 'can we please not' situation, isn't it? (Obviously it's not something that the email recipients can (usually) control, so it's not a criticism of them.) It also has to meaningfully increase the chance that someone will eventually forget to renew a domain, too.

Re: We all dodged a bullet

#37

Post by PaulHoule »

This has so many dimensions.

An authentication environment which has gotten so complex we expect to be harassed by messages say "your Plex password might be compromised", "your 2FA is all fucked up", etc.

And the crypto thing. Xe's sanguine about the impact, I mean, it just the web3 degens [1] that are victimized, good innocent decent people like us aren't hurt. From the viewpoint of the attacker it is all about the Benjamins and the question is: "does an attack like this make enough money to justify the effort?" If the answer is yes than we'll see more attacks like this.

There are just all of these things that contribute to the bad environment: the urgent emails from services you barely use, the web3 degens, etc.

[1] if it's an insult it is one the web3 community slings https://www.webopedia.com/crypto/learn/degen-meaning/

Re: We all dodged a bullet

#38

Post by RedShift1 »

mikewarot wrote: post #28

>Saved by procrastination! Seriously, this is one of my key survival mechanisms. By the time I became system administrator for a small services company, I had learned to let other people beta test things. We ran Microsoft Office 2000 for 12 years, and saved soooo many upgrade headaches. We had a decade without the need to retrain. That, and like other have said... never clicking links in emails.

I'll reply to you tomorrow

Re: We all dodged a bullet

#39

Post by balder1991 »

dsff3f3f3f wrote: post #5

> These kinds of dependencies are everywhere and nobody would even think that they could be harmful. Tons of people think these kind of micro dependencies are harmful and many of them have been saying it for years.

Working for a bank did make me think much more about all the vulnerabilities that can go into certain tools. The company has a lot of bureaucracy to prevent installing anything or adding external dependencies.

Re: We all dodged a bullet

#40

Post by progval »

cataflam wrote: post #35

Besides the ecosystem issues, for the phishing part, I'll repost what I responded somewhere in the other related post, for awareness --- I figure you aren't about to get fooled by phishing anytime soon, but based on some of your remarks and remarks of others, a PSA: TRUSTING YOUR OWN SENSES to "check" that a domain is right, or an email is right, or the wording has some urgency or whatever is BOUND TO FAIL often enou…

> 2. U2F/Webauthn key as second factor is phishing-proof. TOTP is not.

TOTP doesn't need to be phishing-proof if you use a password manager integrated with the browser, though.

Post reply on HN