Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies

medium.com

Post reply on HN
Print view View original

331–340 of 412 posts

Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies

#331

Post by jjav »

littlestymaar wrote: post #250
stuff4ben wrote: post #168

Earlier quoted context omitted.

Maven is ubiquitous in the Java world and the de-facto package/dependency management system out there. Has been since the mid-2000's and as of 2018 when I last did Java development (Scala really), it is still widely in use. Getting jar files manually would have me running from whatever company that was doing that. Let me guess, they wrote all their code in Notepad because IDE's are a "fucking mess" too right?

You vastly underestimate the level of bureaucracy that can exist in the biggest Java users of this planet (namely banks and public administrations): in these organization (at least a few years ago, the Solarwind attack shows it may not be the case anymore) every single dependency you want to use must be justified, and then is audited by a dedicated team, which ends up handing you the validated .jar. It was a common d…

This "bureacucracy" is very necessary if security is at all a concern. Solarwinds is hot to talk about right now but it has always been the case that having a build download code willy-nilly is a recipe for getting attacked.

In any security conscious organization the only way to pull dependencies is from a local trusted repository. And the only way they get placed there is through a review process.

Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies

#332

Post by Gehinnn »

josephg wrote: post #315
salawat wrote: post #309

Earlier quoted context omitted.

>trusted but malicious actors I...think you might have bigger problems going on there. You're tryingto throw a tech solution at a problem that is fundamentally human in nature. That tends to leave nobody satisfied.

Tech solutions are the best solutions when they work! Fighting with your spouse over who does the dishes? Buy a dishwasher! Don’t want your ISP snooping on traffic? Use https / a VPN! Unfortunately, package signing does nothing to protect against the threat vector presented here. The authentication system in npm is working fine. The problem is we put too much trust in software from the internet.

What about reviews and review certificates then? If you review a the package foo@1.0 you could publicly certify that it is not malicious and maybe earn some money with it. In turn, you back your claim with a financial security that you pay in case the package actually contains malicious code.

Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies

#334

Post by korijn »

jonny_eh wrote: post #234
ryukafalz wrote: post #228

Earlier quoted context omitted.

This looks like it's... getting there, but still too coarse-grained. It looks like those permissions are granted to the whole Deno process? So if your program needed both access to sensitive data on the filesystem and network access, and it used a malicious dependency, that dependency could take advantage of those permissions and exfiltrate that data. I could be wrong, but I don't see any mention of permissions on im…

You're right. Deno only has app-level permissions. We need module level too.

Wether controls are coarse or fine (all the way to function level, or even line by line), you still need to audit the source code to see if a package is not going to abuse the permissions you grant it. Right?

Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies

#335

Post by prepend »

0xbadcafebee wrote: post #201
prepend wrote: post #124

Earlier quoted context omitted.

I wish GitHub would create a proper auth design. I won’t grant blanket permissions to tokens because there’s too much risk of something going wrong. It seems dumb that they don’t have per repo tokens. I think the issue is with their licensing as if they made proper tokens users could abuse it by giving tokens to their friends. But this should be detectable in a friendly (please don’t do that) way. I want to be able t…

> It seems dumb that they don’t have per repo tokens. Technically you can create one new GitHub account per repo and generate a token for that... But that is highly annoying :) They need to support IAM / RBAC style policies and tie every authn+z method to those policies, but my guess is they have different auth methods strung all throughout their codebase so implementing it will take a few years. Then of course they…

Comically, that’s why my GitHub recommended. Of course that’s a nightmare for a user to manage, violates our sso requirement, and GitHub charges per user.

Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies

#336

Post by bryanrasmussen »

ryukafalz wrote: post #194

I see a lot of people saying things like "this is why package signing is important" and "we need to know who the developers are" and "we need to audit everything." Some of that is true to some degree, but let me ask you this: why do we consider it acceptable that code you install through a package manager implicitly gets to do anything to your system that you can do? That seems silly! Surely we can do better than tha…

>why do we consider it acceptable that code you install through a package manager implicitly gets to do anything to your system that you can do?

I thought it was because operating systems still use access based instead of capabilities based security?

Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies

#337

Post by ryukafalz »

mike_hearn wrote: post #325
nmadden wrote: post #319

Earlier quoted context omitted.

Oracle’s own secure coding guidelines for Java [1] actually now recommend adopting a capability-based approach rather than relying on SecurityManager: > FUNDAMENTALS-5: Minimise the number of permission checks Java is primarily an object-capability language. SecurityManager checks should be considered a last resort. (Note: quite a lot of Java’s standard library is not designed along object-capability lines so you sho…

They are not in tension. The Java security architecture is a mix of capability and module-level security. It's probably worth posting a quick refresher. The system is old but people don't use it much these days, and the documentation isn't that good. At one point I wrote a small JavaFX PDF viewer that sandboxed the PDF rendering code, to learn the system. I lost the source code apparently, but the hard part wasn't co…

> Sometimes you need to wrap a privileged operation to "dilute" it somehow. For example, imagine you have a module that allows arbitrary socket access. You also have an HTTP client. You would like the HTTP client to have network access, but for it to be usable by other modules that should only be able to contact specific hosts. Given what I've described so far that wouldn't work: the highly privileged code that can do native calls would do a stack walk, discover the unprivileged module on the stack and throw an exception.

Not sure if this is something Java enables, but in principle you could do this in a capability-style way as well. Let's say you have an HTTP client module that you want to allow another module to use, but only to make requests to a specific host. You could write a wrapper with a subset of the HTTP client's functionality, only including (for example) a send() method that would send an HTTP request to the specified host. You'd then pass that to the module that you want to be able to make HTTP connections (rather than the raw HTTP client), and provided your wrapper object doesn't expose functionality from the underlying module that would let a client specify arbitrary hosts, you're in a pretty good spot.

Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies

#338

Post by randomsearch »

zaarn wrote: post #111
brabel wrote: post #102

Earlier quoted context omitted.

> Javas FQDN model is actually pretty bad in practice Right, that's why we see this kind of attack all the time on Maven Central, but never on npm... oh, wait?! NO! The kind of simple attacks you see routinely on npm (typo squatting, ownership transfers to malicious authors, now this) just doesn't happen on Maven Central at all.

Why would it be infinitely harder to obtain log5j.com compared to typosquatting on npm? .com domains aren't THAT expensive.

You never tried to get things published to maven, if you think that would be easy! It’s hard enough when you’re legit (and that is no bad thing).

Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies

#339

Post by randomsearch »

jbverschoor wrote: post #2

It won't be just companies. It'll be developers, sysops, etc who npm install a bazillion of packages, because the core language and libaries are not enough. Those people have keys, credentials and access to the internal networks.

Yep a big part of npm’s problems are actually just flaws with JS. Comparing with Java, it’s insane how many dependencies you have to manage, and that batteries are not included (esp weird when you consider front end apps involve downloading the code!).

Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies

#340

Post by danhor »

christophilus wrote: post #271
rachelbythebay wrote: post #4

I’m cackling at how great this is. This is what happens when you trust the internet forever and just scarf down any old thing at build time. Of course it’ll get exploited! That’s what evil people do.

Honestly, it’s one of the things that makes me nervous about running Linux on all of my computers. At least with Windows (and probably OSX), my updates come from a single vendor who has strict internal code audits and security requirements. With Linux (I’m using Pop), my updates come from a package manager with a crapload of packages, each maintained by a different team / group with no central policy. There’s no way…

At least with windows, the drivers aren't checked that much and accordingly, have had some serious issues.

I'd guess distros are generally better off in that respect, but kernel space & user space aren't that different nowadays, when caring about your own security

Post reply on HN