Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies • Hacker News Board

Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies

#301

Post by jpalomaki » Wed, Feb 10, 2021, 6:37 PM UTC

actuator wrote: post #203

mavhc wrote: post #179

https://security.googleblog.com/2021/02/know-prevent-fix-fra... At Google, we have those resources and go to extraordinary lengths to manage the open source packages we use—including keeping a private repo of all open source packages we use internally

But Google is more or less an exception in this regard, from hiring their own offensive penetration testing teams to having a lot of paranoia in general about anything from outside. They had adopted a lot of good practices early on. Even most big companies are not as thorough as them. I wonder how they built this culture and if it is even realistic for smaller companies to aim for it.

We could pay for Google (or somebody else) to do it for us.

We would pay to access their ”distribution”, a limited set of packages vetted by them. Distribution vendor would screen changes from upstream and incorporate into their versions.

Of course this is more limited world. It’s like using a paid Linux distribution with certain amount of software covered by the vendors support policies.

Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies

#302

Post by bslorence » Wed, Feb 10, 2021, 6:39 PM UTC

nightpool wrote: post #15

The article mentions that RubyGems is vulnerable to this, and that Shopify in particular downloaded and ran a gem named "shopify-cloud", but I'm curious as to how this is possible given a "normal" bundler pure-lockfile setup, or more generally the source-block directives I've seen in most Gemfiles. That is, given a Gemfile.lock like, e.g. GIT remote: https://github.com/thoughtbot/appraisal revision: 5675d17a95cfe904c…

If I'm reading bundler's docs rightly, the new 'source' syntax only appears to prevent this: https://bundler.io/man/gemfile.5.html#SOURCE-PRIORITY

Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies

#303

Post by tppiotrowski » Wed, Feb 10, 2021, 6:59 PM UTC

Dev 1: “npm -g package_name” doesn’t work.

Dev 2: try “sudo npm -g package_name”.

Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies

#304

Post by safog » Wed, Feb 10, 2021, 7:01 PM UTC

ryukafalz wrote: post #194

I see a lot of people saying things like "this is why package signing is important" and "we need to know who the developers are" and "we need to audit everything." Some of that is true to some degree, but let me ask you this: why do we consider it acceptable that code you install through a package manager implicitly gets to do anything to your system that you can do? That seems silly! Surely we can do better than tha…

This is a really nice idea but considering we haven't even solved the relatively simple case of users giving permissions to apps and expecting them to behave responsibly, I'm not optimistic that we can solve the much more challenging case of importing library code.

e.g., If someone gives an app the ability to upload photos, it can silently read all photo metadata, upload all photos to a private server instead of uploading just the single photo that the user picked. This can be solved with OS level standard photo pickers but it hasn't been yet.

Same with package code. Maybe a package needs network access for stuff it genuinely needs to do. However it can (and probably will) at some point go above and beyond in the amount of data it collects. FB Mobile SDK outage is a good example of this. https://www.bugsnag.com/blog/sdks-should-not-crash-apps

Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies

#305

Post by forty » Wed, Feb 10, 2021, 7:06 PM UTC

I don't understand why there is this issue. We publish our internal npm packages in the @company namespace and we own this namespace on the public npm registry. Problem solved, isn't it?

Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies

#306

Post by jjav » Wed, Feb 10, 2021, 7:09 PM UTC

ptx wrote: post #213

ryukafalz wrote: post #194

I see a lot of people saying things like "this is why package signing is important" and "we need to know who the developers are" and "we need to audit everything." Some of that is true to some degree, but let me ask you this: why do we consider it acceptable that code you install through a package manager implicitly gets to do anything to your system that you can do? That seems silly! Surely we can do better than tha…

Could you solve this in Java using the SecurityManager stuff that was used to sandbox applets, or is all that considered broken these days? (I'm not sure if you can different SecurityManagers for different parts of the app though.)

Yes, with Java you can.

That's how the web/application server containers worked (probably still do, but I've been disconnected). The server classes have different permissions from the application code classes (loaded from the .war/etc files). If an application code method calls into a system class, the permissions which apply are those or the application since that method is in the calling stack frame.

I wrote this support into several Java web container and J2EE application server products back in the day. AFAIK, all that still works great today in Java.

Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies

#307

Post by ratherbefuddled » Wed, Feb 10, 2021, 7:19 PM UTC

tarruda wrote: post #45

kasperni wrote: post #32

I'm surprised the reverse fully-qualified domain name (FQDN) model used by Java isn't more widely adopted. If you want to upload artifacts to the main repository (Maven Central) you first need to show ownership of a particular domain. For example, via a DNS TXT record (example [1]). Would make these kind of attacks a lot more difficult. [1] https://issues.sonatype.org/browse/OSSRH-61509

It seems some of the new package systems such as node/npm fail to learn from years of maturity of existing ecosystem such as Java's

As someone who worked with java for more than a decade before touching the js world, the degree to which npm has been hacked together without any of study prior art is extremely irritating. If you must build something from scratch at least invent some new problems instead of just re-discovering solved ones.

The very existence of package-lock grinds my gears and that's before it starts flip flopping because someone mistook URLs for URIs. Of course that only exists because ranged dependencies are a terrible idea, and that's before anybody even mentions things like namespaces or classifiers.

No maven wasn't perfection, and it could be (and has been) improved on - but npm doesn't even get into spitting distance.

Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies

#308

Post by Diggsey » Wed, Feb 10, 2021, 7:27 PM UTC

austincheney wrote: post #204

Diggsey wrote: post #177

Earlier quoted context omitted.

I disagree: the problem is not that package managers make things easy, it's just that several of them are poorly designed. The fact that pip/npm/gem etc. look for packages in a fallback location if not found in the private repository is a terrible design flaw. One which not all package managers have. For example, when you add a cargo dependency from a private registry, you have to specify the registry that the depend…

Whether the package managers are poorly designed is completely ancillary. It really is primarily about developer laziness, incompetence, easiness. Proof: https://www.theregister.com/2016/03/23/npm_left_pad_chaos/ Sudden unplanned loss of availability is a catastrophic security problem, the A in the security CIA[1]. Worse is that the dependency that caused that problem was something that should never have been a depen…

How is that proof? You're again pointing to a design flaw in NPM: that authors can easily delete packages without warning.

If you yank a package with cargo, it doesn't break people's builds who already depend on that package, it just makes it harder to add new dependencies on the package.

Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies

#309

Post by salawat » Wed, Feb 10, 2021, 7:30 PM UTC

nogbit wrote: post #226

easton wrote: post #217

Earlier quoted context omitted.

I believe that Deno (the "successor" to Node being written by Ryan Dahl) is supposed to fix this for server-side JavaScript/TypeScript. It doesn't grant any permissions to anything unless you specifically give them out (so you can say that only a specific module gets access to the filesystem, for instance, and on top of that it can only access /srv and not /etc). https://deno.land/manual@v1.7.2/getting_started/permis…

I think this is critical. The actual runtime of any code needs to do way more than what it’s doing now. Simply relying on package signing and the like permits trusted but malicious actors. With Deno packages configured well it can really lock down and limit a ton of attack vectors.

>trusted but malicious actors

I...think you might have bigger problems going on there. You're tryingto throw a tech solution at a problem that is fundamentally human in nature.

That tends to leave nobody satisfied.

Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies

#310

Post by nine_k » Wed, Feb 10, 2021, 7:30 PM UTC

randompwd wrote: post #298

nine_k wrote: post #245

Popularized 3 years ago: https://medium.com/hackernoon/im-harvesting-credit-card-numb...

Doesn't cover the same attack vector, and that link is a piece of fiction.

It's a piece of fiction, of course, but explains a very similar attack vector in colorful details.

Using DNS for exfiltration is a nice trick but does not change much in the general approach.