Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We all dodged a bullet

xeiaso.net

Post reply on HN
Print view View original

371–380 of 498 posts

Re: We all dodged a bullet

#371

Post by giveita »

creesch wrote: post #370
mdavid626 wrote: post #369

How would any normal person know that npmjs.help is phising, but npmjs.com is valid?

To state the obvious, one ends with "help" on with "com". It effectively is phishing awareness 101 that domains need to match. You still don't know then of course. When in doubt you shouldn't do the action that is asked through clicking on links in the mail. Instead go to the domain you know to be legit and execute the action there. Having said all that, even the most aware people are only human. So it is always poss…

Corollary: dont click on any emails links. (Most use some dumb domain name that could be phishing)

Re: We all dodged a bullet

#372

Post by cyphar »

lovich wrote: post #272
cyphar wrote: post #128

Earlier quoted context omitted.

A few years ago our annual corporate phishing training was initiated by an email sent from a random address asking us to log in with our internal credentials on a random website. A week later some executive pushing the training emailed the entire company saying that it was unacceptable that nobody from engineering had logged into the training site and spun some story about regulatory requirements. After lots of back…

If Kevin mitnick shows up or is referenced then I’m pretty sure it’s performance art

If only, it would've been an honour to get phished by Mitnick. Rest in peace...

Re: We all dodged a bullet

#373

Post by raffraffraff »

WD-42 wrote: post #368
RVuRnvbM2e wrote: post #290

Earlier quoted context omitted.

Fucking this. I have seen so many takes lamenting how this kind of supply chain attack is such a difficult problem to fix. No it really isn't. It's an ecosystem and cultural problem that npm encourages huge dependency trees that make it impractical to review dependency updates so developers just don't.

I would say Javascript's lack of a standard library is at least in part responsible for encouraging npm use, things just spiraled out of control from there.

[not a dev] why isn't there the equivalent of "Linux distributions" for npm? I know I know: because developers all need a different set of libs. But if there were thousands of packages required to provide basic "stdlib-like functionality" couldn't there be an npm distribution that you can safely use as a starting point, avoiding importing asinine stuff like 'istrue' (yea I'm kinda joking there). Or is that just what bloated Frameworks all start out as?

Re: We all dodged a bullet

#374

Post by giveita »

ameliaquining wrote: post #133
wongarsu wrote: post #127

Earlier quoted context omitted.

If you steal the cookies from dev machines or steal ssh keys along with a list of recent ssh connections or do any other credential theft there are going to be lots of people left impacted. Yes, lots of people reading tech news or security bulletins is going to check if they were compromised and preemptively revoke those credentials. But that's work , meaning even among those informed there will be many who just assu…

If a dev doesn't happen to run npm install during the period between when the compromised package gets published and when npm yanks it (which for something this high-profile is generally measured in hours, not days), then they aren't going to be impacted. So an attacker's patience won't be rewarded with many valid credentials.

Dev, or their IDE, agent, etc.

Re: We all dodged a bullet

#375

Post by JoshTriplett »

mikestorrent wrote: post #167
JoshTriplett wrote: post #93

Earlier quoted context omitted.

Manual dependency management without a package manager does not lead people to do more auditing. And at least with a standardized package manager, the packages are in a standard format that makes them easier to analyze, audit, etc.

Well, consider that a lot of these functions that were exploited are simple things. We use a library to spare ourselves the drugdery of rewriting them, but now that we have AI, what's it to me if I end up with my own string-colouring functions for output in some file under my own control, vs. bringing in an external dependency that puts me on a permanent upgrade treadmill and opens the risk to supply chain attacks? L…

> but now that we have AI, what's it to me if I end up with my own string-colouring functions for output in some file under my own control

Before AI code generation, we would have called that copy-and-paste, and a code smell compared to proper reuse of a library. It's not any better with AI. That's still code you'd have to maintain, and debug. And duplicated effort from all the other code doing the same thing, and not de-duplicated across the numerous libraries in a dependency tree or on a system, and not benefiting from multiple people collaborating on a common API, and not benefiting from skill transfer across projects...

Re: We all dodged a bullet

#376

Post by giveita »

> One of the important things to take away from this is that every dependency could be malicious. We should take the time to understand the entire dependency tree of our programs, but we aren't given that time. At the end of the day, we still have to ship things.

That's why you need vuln scanners and not upgrade to the latest thing as soon as released.

Re: We all dodged a bullet

#377

Post by cyphar »

ornornor wrote: post #263
cyphar wrote: post #128

Earlier quoted context omitted.

A few years ago our annual corporate phishing training was initiated by an email sent from a random address asking us to log in with our internal credentials on a random website. A week later some executive pushing the training emailed the entire company saying that it was unacceptable that nobody from engineering had logged into the training site and spun some story about regulatory requirements. After lots of back…

It’s all just box ticking and CYA compliance. “We got pwned but the entire company went through a certified phishing awareness program and we have a DPI firewall. Nothing more we could have done, we’re not liable.”

I agree, but I really wonder where on earth they find these people.

Re: We all dodged a bullet

#378

Post by giveita »

easterncalculus wrote: post #326

> This post and its online comment sections are blame-free zones The author is claiming control over other comment sections? Where is this entitlement coming from? They hide that behind some fictional persona, as if that changes anything. The author then proceeds to list several reasons someone would fall for this, carefully ignoring the most important detail of the email, being its address. The absolute very first s…

NPM should promptly email everyone to upgrade their 2FA

Re: We all dodged a bullet

#379

Post by giveita »

cataflam wrote: post #35

Besides the ecosystem issues, for the phishing part, I'll repost what I responded somewhere in the other related post, for awareness --- I figure you aren't about to get fooled by phishing anytime soon, but based on some of your remarks and remarks of others, a PSA: TRUSTING YOUR OWN SENSES to "check" that a domain is right, or an email is right, or the wording has some urgency or whatever is BOUND TO FAIL often enou…

NPM needs to do better. Almost think there needs to be regulations / fines unfortunately.

If I sell corn syrup for downstream food consumers and dont lock my factory doors and let whoever walk in, isn't it reckless?

Post reply on HN