Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies

medium.com

Post reply on HN
Print view View original

341–350 of 412 posts

Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies

#341

Post by ryukafalz »

korijn wrote: post #334
jonny_eh wrote: post #234

Earlier quoted context omitted.

You're right. Deno only has app-level permissions. We need module level too.

Wether controls are coarse or fine (all the way to function level, or even line by line), you still need to audit the source code to see if a package is not going to abuse the permissions you grant it. Right?

Not to nearly the same extent; the key is to not grant unnecessary authority in the first place.

Let's say I'm using a `left-pad` function that someone else wrote, and I'm using a system in which modules aren't granted any authority except what you give them. If I then call

  left-pad('foo', 5')
...I don't really have to worry that it'll go rummaging around my filesystem for my private keys and exfiltrate them somewhere. After all, I didn't give it access to my filesystem or the network! (Side-channel attacks notwithstanding, things get thorny real quick at that point.)

Now, you still have to worry about the function not doing what being correct - it might return an empty string, it might go into an infinite loop, etc - but you've tremendously reduced the scope of what this module could do if the developer were malicious.

Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies

#342

Post by HereBeBeasties »

PhineasRex wrote: post #169

The only really shocking part of this is that Artifactory is vulnerable to this. I expect developers to be lazy about build security because I've seen it over and over again at multiple companies, but Artifactory's whole purpose is to provide secure build dependency management. I'll be rethinking using Artifactory in my infrastructure.

A good look at their (public) bug tracker might change your mind about how surprising this is.

Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies

#343

Post by alkonaut »

What I don’t get from the article is the reasoning behind the design that the central repository “wins” over the local/override repository.

How was that design chosen, not just once but in all 3 of those large package ecosystems. Did pypi/gems/node borrow their design from each other given their similarity in other aspects?

Are there any situations where this behavior is desired?

Does any of the other ecosystems have flaws like this (nuget, cargo..)?

Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies

#344

Post by HereBeBeasties »

baybal2 wrote: post #18

This is why end-developer signing is essential. This is not as amendable to CI, but that's the point.

How does it work in practice, though? For example, create-react-app in NPM has a bajillion deps. Do I trust 8,000 keys? Which ones are OK?

I get that you could in principle namespace things (at least for package managers that support this) and insist on a small set of company-internal signing keys for those namespaces. But managing all that isn't easy and what about for package ecosystems that don't really have namespaces (e.g. PyPI, NuGet)?

Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies

#345

Post by HereBeBeasties »

throwaheyy wrote: post #297
ritchiea wrote: post #263

Earlier quoted context omitted.

Ok so you're going to argue to an engineering manager or product manager that you need a day or days to do a full code audit of each external package you use? Or write your own library instead? That's, if anything, more unrealistic than just writing your own package manager. Do you actually get to do this wherever you work? Honestly it would be great to have the luxury of that kind of patience and time to invest in m…

Who said anything about requiring a full code audit? Parent post is suggesting being selective about which packages you consume and which third-party developers you trust, including transitive dependencies pulled in by any package you consume.

I just don't think that's realistic for the JavaScript ecosystem, for the majority of projects. E.g. The weight of something "standard" like create-react-app.

Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies

#346

Post by zomgwat »

ryukafalz wrote: post #194

I see a lot of people saying things like "this is why package signing is important" and "we need to know who the developers are" and "we need to audit everything." Some of that is true to some degree, but let me ask you this: why do we consider it acceptable that code you install through a package manager implicitly gets to do anything to your system that you can do? That seems silly! Surely we can do better than tha…

Not a complete answer (by any means) but keeping tight control over egress network access helps (I wish it was easier to limit egress access over port 443).

Systemd has some capability to restrict access to system resources. I haven't experimented with the capabilities yet so not sure what's all there.

Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies

#347

Post by Robotbeat »

bluefirebrand wrote: post #256
ryandrake wrote: post #237

Earlier quoted context omitted.

Coming from the embedded world, where a lot of projects are safety-critical, it always kind of shocks me to see how cavalier others in the software world are about bringing in third party dependencies. Need a bit of code that would take you a day to write? Naaah, just find a third party library that does it (and does god knows what else). And bam! Like that it's part of the build. No code review of the dependency. No…

> Need a bit of code that would take you a day to write? Even if it is a small library that has only a single maintainer the chances of you replicating it in a day seem slim to me unless it is truly trivial, or the library was also written in a day. More likely you get a day in and realize that the problem has a whole bunch of gotchas that you didn't anticipate and the library maintainer already found and dealt with.…

Usually you don’t need the entire functionality of a library. So writing something for your use case may only take a day.

Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies

#348

Post by salawat »

salawat wrote: post #329
josephg wrote: post #315

Earlier quoted context omitted.

Tech solutions are the best solutions when they work! Fighting with your spouse over who does the dishes? Buy a dishwasher! Don’t want your ISP snooping on traffic? Use https / a VPN! Unfortunately, package signing does nothing to protect against the threat vector presented here. The authentication system in npm is working fine. The problem is we put too much trust in software from the internet.

...Hence my classification of it as a human problem. I apologize, this is a quirk of my personal vernacular. This is a problem that emergently arises out of the way human beings interact with each other socially, even before tool use comes into the picture. Alice has a thing. Bob had a thing that Alice figured would make her life easier so integrates it without looking too hard at it. Alice didn't reallize that by ad…

In a rare self-reply, this feeds into the reason why I scratch my head at the whole license based IP distribution thing.

By bringing licenses into it, you push for a business relationship first, but discourage further toolmaking. Programs are math. Rederivation and application should really be the norm, but can't be if we're drawing boxes around arrangements of symbols and saying "Do not cross."

It's the weird contradiction at the core of what we do as software people that still keeps me scratching my head. We all run to make a hydrant to mark, then try to make rent extracting business around it instead of maximizing the number of variants of hopefully practical and efficient ways to allow everyone else to solve their own problems.

I'm not against people being able to make a living doing what they love, but the incentive structure seems all out of jibe with what I understood to be the overall goal.

Or something. Still wrapping my head around it I guess.

Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies

#349

Post by HereBeBeasties »

nijave wrote: post #160
ehnto wrote: post #117

Pulling packages down at build time seems ludicrous to me, I can understand it in a development environment, but I don't understand how "Pull packages from the public internet and put them into our production codebase" past any kind of robustness scrutiny. I guess it's a case of the ease of use proving too great, so convenient in fact that we just kind of swept the implications under the rug.

Some things are like that but there is a decent amount of package managers now a days that at least pin package hashes so they'll fail if the package has been tampered with. I'm not aware of many places that audit dependencies to a greater extent than "the license is compatible and it has reasonable maintenance". Pulling packages from the internet is fine and that's how all Linux distros work but the more important t…

This really doesn't help when devs just upgrade everything. Or if they simply install the latest (p0wned) version of something. Pinning hashes really isn't the answer here.

Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies

#350

Post by jjn2009 »

ryukafalz wrote: post #194

I see a lot of people saying things like "this is why package signing is important" and "we need to know who the developers are" and "we need to audit everything." Some of that is true to some degree, but let me ask you this: why do we consider it acceptable that code you install through a package manager implicitly gets to do anything to your system that you can do? That seems silly! Surely we can do better than tha…

Its unfortunate that the proposed realms is still just a proposal. Even still I've heard many arguments that since the method of isolation lives inside JS it cannot be expected to be entirely secure and you would be much better off relying on OS level security primitives, a point that comments I've read so far completely glosses over. I'd love for someone to prove me wrong that this is air tight so we can champion realms at my work.

POLA is good to live by regardless if it can be implemented.

Post reply on HN