Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

socket.dev

Post reply on HN
Print view View original

301–310 of 458 posts

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#301

Post by xtracto »

boardwaalk wrote: post #285

I'm just hearing about this attack on Checkmarx. We recently adopted it at work, and I find the thing to just produce garbage. I've never tuned out noise so quickly. you have to appreciate the irony of a thing that's supposed to help protect you from vulnerabilities being one.

I think this is the real news. There seems to be an ongoing attack against Checkmarx.

That thing is expensive as he'll and used by lots of huge corps. I know at least one very large one in Mexico ... where the IT team is pretty useless.

So, I dont doubt the possibility that in the short future we will hear about more hacks.

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#302

Post by AgentME »

tomjen3 wrote: post #154
uyzstvqs wrote: post #94

Earlier quoted context omitted.

We need cooldowns everywhere , by default. Development package managers, OS package managers, browser extensions. Even auto-updates in standalone apps should implement it. Give companies like Socket time to detect malicious updates. They're good at it, but it's pointless if everyone keeps downloading packages just minutes after they're published.

I am not sure that works - imagine that the next shellshock had been found. Would you want to wait 7 days to update? We need to either screen everybody or cut of countries like North Korea and Iran from the Internet.

Shellshock was in 2014 and Log4Shell was 2021. It's far more likely that you're going to get pwned by using a too-recent unreviewed malicious package than to be unknowingly missing a security update that keeps you vulnerable to easy RCEs. And if such a big RCE vuln happens again, you're likely to hear about it and you can whitelist the update.

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#303

Post by kronks »

fragmede wrote: post #260
ef2k wrote: post #229

The issue was a compromised build pipeline that shipped a poisoned package. But PSA: If something is critical to the business and you’re using npm, pin your dependencies. I’ve had this debate with other devs throughout the years and they usually point to the lockfile as assurance, but version ranges with a ^ mean that when the lockfile gets updated, you can pull in newer versions you didn’t explicitly choose. If what…

But it goes the other way too. If there's a security vulnerability that was fixed in a later version, you want the system to automatically pick that up and apply it for you in an ideal scenario.

[dead]

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#304

Post by bfivyvysj »

fragmede wrote: post #260
ef2k wrote: post #229

The issue was a compromised build pipeline that shipped a poisoned package. But PSA: If something is critical to the business and you’re using npm, pin your dependencies. I’ve had this debate with other devs throughout the years and they usually point to the lockfile as assurance, but version ranges with a ^ mean that when the lockfile gets updated, you can pull in newer versions you didn’t explicitly choose. If what…

But it goes the other way too. If there's a security vulnerability that was fixed in a later version, you want the system to automatically pick that up and apply it for you in an ideal scenario.

Why would you patch a security vuln in a later version? Should be patched in all versions.. that's what semver is for.

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#305

Post by bfivyvysj »

hombre_fatal wrote: post #191
vablings wrote: post #173

Earlier quoted context omitted.

Wait, you're telling me that node deps are not pin by default. Every time you run your code you might be pulling in a new version. No wonder...

Node deps are pinned: https://docs.npmjs.com/cli/v8/configuring-npm/package-lock-j... The problem is that you also want to update deps.

Why?

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#306

Post by bfivyvysj »

saghm wrote: post #293
yangikan wrote: post #266

Earlier quoted context omitted.

Is there any downside to using the firefox builtin password manager?

Does it support autofill for other apps on mobile? I'd argue that putting passwords in your phone clipboard could itself be risky (although for someone who's extremely security conscious, maybe discouraging using apps isn't a downside)

Reddit is always pasting clipboard.

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#307

Post by hsbauauvhabzb »

fragmede wrote: post #260
ef2k wrote: post #229

The issue was a compromised build pipeline that shipped a poisoned package. But PSA: If something is critical to the business and you’re using npm, pin your dependencies. I’ve had this debate with other devs throughout the years and they usually point to the lockfile as assurance, but version ranges with a ^ mean that when the lockfile gets updated, you can pull in newer versions you didn’t explicitly choose. If what…

But it goes the other way too. If there's a security vulnerability that was fixed in a later version, you want the system to automatically pick that up and apply it for you in an ideal scenario.

At this point, the risk of a compromised package outweighs the risk of an upstream vuln that actually matters. Npm audit is full of junk like client side redos vulns, you could probably ignore 90%+ of the reports and still be secure against the majority of of-concern attack classes.

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#308

Post by hsbauauvhabzb »

saghm wrote: post #293
yangikan wrote: post #266

Earlier quoted context omitted.

Is there any downside to using the firefox builtin password manager?

Does it support autofill for other apps on mobile? I'd argue that putting passwords in your phone clipboard could itself be risky (although for someone who's extremely security conscious, maybe discouraging using apps isn't a downside)

So uninstall Reddit? That app is spyware at best and malware at worst.

Re: Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign

#310

Post by wycats »

subarctic wrote: post #300
saghm wrote: post #292

Earlier quoted context omitted.

> At least they're pinned though. Frustratingly, they're not by default though; you need to explicitly use `--locked` (or `--frozen`, which is an alias for `--locked --offline`) to avoid implicit updates. I've seen multiple teams not realize this and get confused about CI failures from it. The implicit update surface is somewhat limited by the fact that versions in Cargo.toml implicitly assume the `^` operator on ver…

Is there a plan to change this? I don't see why --locked shouldn't be the default

As one of the original authors of Cargo, I agree. lockfiles are for apps and CLIs are apps. QED.
Post reply on HN