Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies

medium.com

Post reply on HN
Print view View original

361–370 of 412 posts

Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies

#361

Post by itake »

ex_amazon_sde wrote: post #280
itake wrote: post #270

Earlier quoted context omitted.

forgive my naivety, but my understanding of the NPM and rubygems ecosystem is open source packages host their source code on github/gitlab. The source code is super easy to view. Often times, the author will use tags or branches dedicated to specific versions of the code. For distribution, js and ruby use rubygems and npm to host packages. If a developer wants to verify that the package hosted on npm is the same code…

I'm not sure what point you are making. Yet, reviewing hundreds of thousands SLOCs (across different languages) and also checking legal compliance requires significant skills, time and efforts. As an individual, you cannot justify reviewing the entire dependency tree across all your projects. Thankfully you can rely on the packages reviewed and built internally by your colleagues - or use a Linux distribution that do…

Amazon probably builds everything in house. Smaller shops rely more on open source tools like npm or Ruby gems.

I think there are supply chain attack vectors in those resources

Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies

#362

Post by ryukafalz »

mike_hearn wrote: post #354
ryukafalz wrote: post #337

Earlier quoted context omitted.

> Sometimes you need to wrap a privileged operation to "dilute" it somehow. For example, imagine you have a module that allows arbitrary socket access. You also have an HTTP client. You would like the HTTP client to have network access, but for it to be usable by other modules that should only be able to contact specific hosts. Given what I've described so far that wouldn't work: the highly privileged code that can d…

That's the same thing I was just describing but recursed another level. It doesn't help by itself. Something needs to have permission to use the higher level of privilege - raw network access in my example, 'raw' http client access in yours. And something else needs to check that permission. Yes, you could wrap that privilege in a capability afterwards, but the reason Java has both capabilities and stack walking is b…

Maybe I'm missing something about the use case, but I'm not sure I quite follow.

Sure, something needs to have permission to use the higher level of privilege. On your typical POSIX OS, your program is probably born with the ability to create arbitrary TCP/UDP sockets by default; on a capability OS, maybe you've explicitly provided it with access to your network stack. Regardless, at the entry point to your program you presumably have modules providing arbitrary network access in scope somehow.

If I'm understanding correctly, the case you described is that you have an HTTP client module that you'd like to have direct access to the network, but you'd like to restrict the consumers of the HTTP client to only querying certain hosts. From the start of your program, you'd instantiate an HTTP client (passing it a capability to use the network interface) then instantiate one of those HTTP client proxy objects that only allows communication with one host (passing it a capability to use the HTTP client). From there, you pass the capability to that proxy object to the unprivileged consumer of the module.

This seems to work without any kind of stack walking authentication logic, just normal variable scope, provided the language is capability-based. Am I missing something?

Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies

#363

Post by leetrout »

prepend wrote: post #335
0xbadcafebee wrote: post #201

Earlier quoted context omitted.

> It seems dumb that they don’t have per repo tokens. Technically you can create one new GitHub account per repo and generate a token for that... But that is highly annoying :) They need to support IAM / RBAC style policies and tie every authn+z method to those policies, but my guess is they have different auth methods strung all throughout their codebase so implementing it will take a few years. Then of course they…

Comically, that’s why my GitHub recommended. Of course that’s a nightmare for a user to manage, violates our sso requirement, and GitHub charges per user.

We do this at work. And you pay per user per team so we’re paying double or triple in some cases by managing access via teams.

Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies

#364

Post by didibus »

the_af wrote: post #323
didibus wrote: post #299

Earlier quoted context omitted.

I think you're confusing the client side build tool Maven with the artifact repository Maven. Gradle for example still uses Maven for its dependency artifact repository. So Maven is still the standard for Java.

I am confusing what now? I'm the one arguing Maven is huge and that the parent post I'm replying to is mistaken. I never mentioned Gradle, that was a sibling comment.

I might have misinterpreted you the first time around. I thought you were saying that people have moved on from Maven, when in fact Maven is still the defacto repository for open source Java projects. Sorry if I did.

Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies

#365

Post by hda2 »

thombles wrote: post #61
walrus01 wrote: post #38

Earlier quoted context omitted.

Hey let's just sudo curl | bash what could possibly go wrong?

Not sure if serious, but I will point out this is significantly different. If I'm installing an application like homebrew or the Rust toolchain then I am explicitly giving them the right to code execution. It doesn't much matter whether they get it through the script on their website or the binaries downloaded from that website. Random libraries, possibly pulled in by a dependency of a dependency of a dependency... n…

I know this is besides the point, but rust can be installed - without piping the output of a public-facing server into a privileged shell - by using their offline installer: https://forge.rust-lang.org/infra/other-installation-methods...

They offer PGP signatures too!

Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies

#368

Post by greggman3 »

PartiallyTyped wrote: post #35
greggman3 wrote: post #22

Earlier quoted context omitted.

There's more coming.... tons of github integrations ask for blanket access to your account vs Oauth, ( https://github.com/marketplace ). Tons of github users give that access, the access_tokens are only a password type breach away. If you have these access_tokens you can edit the repos they are for all you want.

Different access tokens have different permissions, you can't just do whatever you want.

Most integrations just ask for blanket all permissions. They do this because it means they can give you a list of repos and let you choose which ones to integrate their service into with no work on your part except "click yes to give us permission to do everything for you and ... we'll do everything for you"

Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies

#369

Post by szc »

eecc wrote: post #223
ryukafalz wrote: post #194

I see a lot of people saying things like "this is why package signing is important" and "we need to know who the developers are" and "we need to audit everything." Some of that is true to some degree, but let me ask you this: why do we consider it acceptable that code you install through a package manager implicitly gets to do anything to your system that you can do? That seems silly! Surely we can do better than tha…

Uh, well the original developers of the Sun JVM didn’t do such a bad job after all when designing it: https://docs.oracle.com/javase/7/docs/technotes/guides/secur...

The Sun JVM, as originally implemented, can express operations that are not valid for Java objects. There are parts of the JVM that attempt to constrain opcode sequences to only be from "valid java compilers operating on java objects".

In 1996, Java was being overwhelmed by exploits because the mapping of the language to the VM was not well matched. There was a Java summit with lots of interesting people. This summit was also when Sun got confirmation that MicroSoft had quite a few engineers working on an independently implemented runtime. To Sun's credit, they did get rather more serious about Java security -- but they had already created a rocky foundation.

It is my opinion, that the business model Sun had "in mind" for Java was a free runtime for everyone that they were in control of, but to make money from selling an "official" Java compiler suite.

I do not believe that the Sun Java JVM was created with security in mind.

Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies

#370

Post by nmadden »

ryukafalz wrote: post #362
mike_hearn wrote: post #354

Earlier quoted context omitted.

That's the same thing I was just describing but recursed another level. It doesn't help by itself. Something needs to have permission to use the higher level of privilege - raw network access in my example, 'raw' http client access in yours. And something else needs to check that permission. Yes, you could wrap that privilege in a capability afterwards, but the reason Java has both capabilities and stack walking is b…

Maybe I'm missing something about the use case, but I'm not sure I quite follow. Sure, something needs to have permission to use the higher level of privilege. On your typical POSIX OS, your program is probably born with the ability to create arbitrary TCP/UDP sockets by default; on a capability OS, maybe you've explicitly provided it with access to your network stack. Regardless, at the entry point to your program y…

Exactly. What usually happens in capability systems is that the main() method gets all the capabilities (or whatever capabilities the user allowed it) and then does dependency injection to distribute those to other components. No need for complex stack-based authentication or policy rule evaluation.

Indeed, if you look at the history of Java sandbox escapes they are largely confused deputy attacks: some privileged code source can be tricked into doing something it shouldn’t do.

Post reply on HN