Diffend allows you to manage the risks that come with using open-source third party dependencies by providing malware detecting security scanning and a risk management platform for your Ruby dependencies.
Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies
391–400 of 412 posts
Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies
#392Earlier quoted context omitted.
Wether controls are coarse or fine (all the way to function level, or even line by line), you still need to audit the source code to see if a package is not going to abuse the permissions you grant it. Right?
Not to nearly the same extent; the key is to not grant unnecessary authority in the first place. Let's say I'm using a `left-pad` function that someone else wrote, and I'm using a system in which modules aren't granted any authority except what you give them. If I then call left-pad('foo', 5') ...I don't really have to worry that it'll go rummaging around my filesystem for my private keys and exfiltrate them somewher…
In obvious cases like that, I agree with you. In real life however my dependencies are rarely that simple.
So let's imagine a REST API library that needs disk and network access to do it's work. How do I know it doesn't abuse my permission?
And what about its transient dependencies?
Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies
#393Earlier quoted context omitted.
Not to nearly the same extent; the key is to not grant unnecessary authority in the first place. Let's say I'm using a `left-pad` function that someone else wrote, and I'm using a system in which modules aren't granted any authority except what you give them. If I then call left-pad('foo', 5') ...I don't really have to worry that it'll go rummaging around my filesystem for my private keys and exfiltrate them somewher…
In obvious cases like that, I agree with you. In real life however my dependencies are rarely that simple. So let's imagine a REST API library that needs disk and network access to do it's work. How do I know it doesn't abuse my permission? And what about its transient dependencies?
But why would a REST API library need disk access? If it required that, it would raise suspicion for me.
Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies
#394Earlier quoted context omitted.
> If a library needs access to a remote service, you have to open the socket yourself and pass that in, and the library then needs to plumb it through the whole stack manually to the point where it's needed. You don't need to do this. There are a variety of ways to handle this, just as you would any other kind of dependency injection: 1. Design libraries to actually be modular so that dependencies (including capabili…
The policy file isn't required, by the way. That's just a default implementation. My PDF viewer had a hard-coded policy and didn't use the file. OK, so in a pure capability language how would you implement this: program A depends on dynamically loaded/installed plugin B written by some third party, that in turn depends on library C. One day library C gets a native implementation of some algorithm to speed it up. To l…
> OK, so in a pure capability language how would you implement this: program A depends on dynamically loaded/installed plugin B written by some third party, that in turn depends on library C. One day library C gets a native implementation of some algorithm to speed it up. To load that native library requires a capability, as native code can break the sandbox.
Now, I'm a little outside my area of expertise due to not having worked with capability systems very much yet. (There aren't that many of them and they're still often obscure, so even just trying to gain experience with them is difficult at this point.)
But that said... in an ideal capability system, isn't the idea that native code could just break the sandbox also wrong? I would imagine that in such a system, depending on another module that's running native code would be just fine, and the capability system's constraints would still apply. Maybe that could be supported by the OS itself on a capability OS; maybe the closest thing we'll get to native code for that on our existing POSIX systems is something like WASI[0].
> You often wouldn't need to. What permissions a module has is dependent on its implementation. It's legitimate for a library to be upgraded such that it needs newer permissions but that fact is encapsulated and abstracted away - just like if it needed a newer Java or a newer transitive dependency.
If our goal is to know that the dependencies we're using don't have more authority than they need, isn't it a problem if a module's permissions may increase without explicit input from the module's user (transitive or otherwise)?
[0] https://hacks.mozilla.org/2019/03/standardizing-wasi-a-webas...
Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies
#395Earlier quoted context omitted.
The policy file isn't required, by the way. That's just a default implementation. My PDF viewer had a hard-coded policy and didn't use the file. OK, so in a pure capability language how would you implement this: program A depends on dynamically loaded/installed plugin B written by some third party, that in turn depends on library C. One day library C gets a native implementation of some algorithm to speed it up. To l…
> OK, so in a pure capability language how would you implement this: program A depends on dynamically loaded/installed plugin B written by some third party, that in turn depends on library C. One day library C gets a native implementation of some algorithm to speed it up. To load that native library requires a capability, as native code can break the sandbox. Now, I'm a little outside my area of expertise due to not…
One of the foundations of object-capability security is memory safety, so loading arbitrary native code does subvert that. You can get around this by, for example, requiring native code to be loaded in a separate process. As you say, a capability OS and/or CPU architecture [1] is able to confine native code.
> isn’t it a problem if a module’s permissions may increase without explicit input from the module’s user (transitive or otherwise)?
Exactly right.
[1]: https://www.cl.cam.ac.uk/research/security/ctsrd/cheri/
Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies
#396Earlier quoted context omitted.
I believe the TXT record validation is only an additional measure, eg to prevent a random developer from registering/uploading a package like org.apache.http2. Surely other authentication methods are used in practice. I find it hard to believe any high profile organization would allow their domains to expire, or else they would also lose e-mail and websites, right?
> I find it hard to believe any high profile organization would allow their domains to expire Off the top of my head I remember both Microsoft (hotmail.co.uk) and Foursquare forgetting to renew their domains.
And a few years ago some guy was able to buy google.com for a few minutes or hours, I don't quite recall.
Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies
#397Why would you want your CI to depend on an external source. Say a legit upgrade happened, but it has a breaking change. Now your build is broken. Fixed versions for as many things as you can (including OS images, apt packages, Docker images, etc) lead to changes in your CI under your control. Sure, you have to upgrade manually or by a script. But isn't plain build stability worth it? Not even talking about security.
It probably doesn't. But are you saying devs never updates their dependencies?
When one updates internal dependency versions one usually has to find them. At least that was the story with my gigs. So there's a listing somewhere.
So you wouldn't get a random version even considered.
Version shadowing and overriding is a totally different concern of course.
Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies
#398Earlier quoted context omitted.
The policy file isn't required, by the way. That's just a default implementation. My PDF viewer had a hard-coded policy and didn't use the file. OK, so in a pure capability language how would you implement this: program A depends on dynamically loaded/installed plugin B written by some third party, that in turn depends on library C. One day library C gets a native implementation of some algorithm to speed it up. To l…
Typically libraries don’t directly load one another. The language runtime does this.
Yes, but authorisation to do so must come from somewhere. In Java it's ambient. In a pure caps system, I'm not sure how it'd work.
Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies
#399Earlier quoted context omitted.
The policy file isn't required, by the way. That's just a default implementation. My PDF viewer had a hard-coded policy and didn't use the file. OK, so in a pure capability language how would you implement this: program A depends on dynamically loaded/installed plugin B written by some third party, that in turn depends on library C. One day library C gets a native implementation of some algorithm to speed it up. To l…
> OK, so in a pure capability language how would you implement this: program A depends on dynamically loaded/installed plugin B written by some third party, that in turn depends on library C. One day library C gets a native implementation of some algorithm to speed it up. To load that native library requires a capability, as native code can break the sandbox. Now, I'm a little outside my area of expertise due to not…
isn't it a problem if a module's permissions may increase without explicit input from the module's user (transitive or otherwise)?
The modules permissions can't increase without explicit input e.g. changes to the policy file. But the person who cares about the sandbox integrity is the user of the overall software or computing system. The plugin developer doesn't really care how the API is implemented or what permissions it needs. They just want it to work. The person who cares is the person who owns the resource or data an attacker may be trying to breach.
Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies
#400This doesn't surprise me. Horrify.. yes. I've noticed more dev teams succumbing to the temptation of easiness that many modern package managers provide (NPM, Cargo, Ivy, etc.) - especially as someone who has to work with offline systems on a regular basis. Because of that ease there are fewer tools and tutorials out there to support offline package management. There are more for using caches, though these are often a…
I disagree: the problem is not that package managers make things easy, it's just that several of them are poorly designed. The fact that pip/npm/gem etc. look for packages in a fallback location if not found in the private repository is a terrible design flaw. One which not all package managers have. For example, when you add a cargo dependency from a private registry, you have to specify the registry that the depend…
I haven't used private packages, but it astonishes me you don't just add private packages with some kind of flag so it knows to not try to pull a public package.
Anyone who uses this must have already understood and just overlooked this vulnerability when they realize their private package must have a unique name that doesn't match a public package