Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We all dodged a bullet

xeiaso.net

Post reply on HN
Print view View original

481–490 of 498 posts

Re: We all dodged a bullet

#481

Post by darthwalsh »

apple1417 wrote: post #316
cyphar wrote: post #128

Earlier quoted context omitted.

A few years ago our annual corporate phishing training was initiated by an email sent from a random address asking us to log in with our internal credentials on a random website. A week later some executive pushing the training emailed the entire company saying that it was unacceptable that nobody from engineering had logged into the training site and spun some story about regulatory requirements. After lots of back…

I once got a "log into phishing training" email which spoofed the company address. No one even saw the email, it instantly hit the spam filter. Our infra guy then had to argue with them for quite a while to just email from their own domain, and that no, we're weren't going to add their cert to our DNS, and let a third party spoof us (or however that works, idk). Absolutely shocking lack of self awareness.

When they send out the phishing-simulation email campaign from the "compromised insider account" it's going to fool a lot more people!

Re: We all dodged a bullet

#482

Post by darthwalsh »

JackFr wrote: post #44
scotty79 wrote: post #24

Is there a tool that you can put between your npm client and npm web servers that serves package versions that are month old and possibly also tracks discovered malware and never serves infected versions?

Artifactory. Nexus. I believe AWS/GCP/Azure have offerings. No bank, and almost no large corporations go directly to artifact/package repos. They all host them internally.

Yes, but the public npmjs repository also blocks our corporate IP addresses, so our CI/CD pipelines can't ruin npm for everybody else.

Re: We all dodged a bullet

#483

Post by maleldil »

strogonoff wrote: post #445
maleldil wrote: post #433

Earlier quoted context omitted.

I've never seen Pylance automatically install anything. Are you talking about the stubs that come packaged with Pylance, which Microsoft maintains?

It was the Microsoft’s official Python extension, as far as I recall. It was possible to use some other extension for typechecking but there were some other issues with it. (Now everything works perfectly in Neovim, and my setup respects to only use typing stubs I specify in the project.)

The Microsoft official Python extension uses Pylance, which is a closed-source extension of Pyright with additional features such as built-in type stubs. This is probably what you saw.

Re: We all dodged a bullet

#484

Post by jamietanna »

jamietanna wrote: post #459
fclairamb wrote: post #365

Earlier quoted context omitted.

Renovate is a great (and free) tool to update your dependencies. By default it will update packages in the hours (often minutes) of their release but you can change that behavior with the minimumReleaseAge parameter. https://docs.renovatebot.com/configuration-options/#minimumr...

Yep, Renovate's `minimumReleaseAge` is what you want here Dependabot has recently added this functionality too - it's called `cooldown` https://docs.github.com/en/code-security/dependabot/working-... (I'm soon to be working at Mend on Renovate full time, but have been a big fan of Renovate over other tools for years)

For anyone following, we (Renovate maintainers) are making this an inbuilt "best practice" that users who already opt into using the `config:best-practices` preset will start getting for free!

https://github.com/renovatebot/renovate/pull/37967

Re: We all dodged a bullet

#485

Post by Groxx »

darthwalsh wrote: post #478
Groxx wrote: post #474

Earlier quoted context omitted.

"it exists as a niche feature that few use and fewer understand" isn't exactly "mainstream" IMO (it's significantly less common from what I've seen than manual classloader shenanigans, for example). But yes, it's nice that it exists, and I wish it were used more - it'd catch low-effort stuff like this one was.

No, C# had it: past tense. CAS was neutered in .NET Framework 4.0 then removed in dotnet core.

alas. don't suppose you know of any good articles on why it's removed? I'd be curious about the reasoning / challenges.

there are some rather obvious challenges, but a huge amount of the ones I've run across end up looking mostly like "it's hard to add to an existing language" which is extremely understandable, but hardly a blocker for new ones.

Re: We all dodged a bullet

#486

Post by kiitos »

junon wrote: post #476
kiitos wrote: post #473

Earlier quoted context omitted.

huh? the from: address in every email is an arbitrary and unverified text string that the sender provides, anyone can send an email to anyone else and specify a from: president@whitehouse.gov and that's how it will show up to the recipient what do you mean by the URL scheme? a URL scheme is the http or https part of it? and for sure the host part of the URL was not the same as the real npm's host part of their URL? i…

> the from: address in every email is an arbitrary and unverified text string that the sender provides DKIM et al came back clean. As for URL scheme, I mean the format and layout of URLs - because it was an MITM attack, they matched 1:1.

how did you evaluate the sender address via DKIM to get "clean" response? I mean I know there are methods to verify stuff about a received email, DKIM by itself only handles message integrity and not sender details, for that you need to fold in DMARC -- but there are all WILDLY technical details that are certainly not what anyone is gonna do before clicking a link in a message body

> As for URL scheme, I mean the format and layout of URLs - because it was an MITM attack, they matched 1:1.

"scheme" is a well-defined domain term that refers to the e.g. `https://` part of a URL/URI -- but that aside, I still don't get what you're saying here? what is "format and layout of URLs" and how does that relate to "mitm attack"?

to cut to the chase, a malicious email maybe contains a link, to a URL, that a victim can click on. but if that link says it goes to `https://npm.org` then it actually does go to `https://npm.org` and there isn't like any special secret way for an email to hijack or mitm that domain or URL resolution. if the link is actually `https://npn.org` then that's a totally different thing, it's not a mitm attack, there is no concept of "format or layout" of that totally different URL "matching 1:1" with `https://npm.org` -- unless you're talking about something totally different to what I'm understanding?

edit: wait are we talking about an email sent from a domain `npmjs.help`? DKIM and DMARC and URL scheme validation don't even enter the picture here, this was no kind of mitm attack by any definition -- "npmjs.help" is clear-as-day a malicious domain, and any email from it a clear-as-day phishing attempt.. ! it's fine, we're all human and etc. but it just underscores the issue here being minimizing blast radius of failures, and not anything related to any specific user/human

Re: We all dodged a bullet

#487

Post by efreak »

mikewarot wrote: post #28

>Saved by procrastination! Seriously, this is one of my key survival mechanisms. By the time I became system administrator for a small services company, I had learned to let other people beta test things. We ran Microsoft Office 2000 for 12 years, and saved soooo many upgrade headaches. We had a decade without the need to retrain. That, and like other have said... never clicking links in emails.

I ran office xp on my desktop and 2000 on my laptop until I got to college and _needed_ to upgrade so I could do work with others. Block it with the firewall and you're good. Now I mostly use WordPad, and use a recent (but rarely updated) version of open office on the rare occasions I actually need an office suite or spreadsheet.

If you're worried about vulnerabilities in older software these days, Windows has built-in security features that can help with that, from the sandbox to controlled folders access (intended for ransomware protection, I believe; I use it to prevent my media server from modifying tags)

Re: We all dodged a bullet

#488

Post by efreak »

aspenmayer wrote: post #327
babypuncher wrote: post #172

Earlier quoted context omitted.

Ultimately, stolen cryptocurrency doesn't cause real world damage for real people, it just causes a bad day for people who gamble on questionable speculative investments. The damage from this hack could have been far worse if it was stealing real money people rely on to feed their kids.

You have the context sort of wrong. To do a comparable “real money” heist en masse, you would be stealing from the banks or from the customers of one, or via debit or credit cards. It’s real enough money, but those fraudulent transactions would be covered by existing protections, like FDIC insurance or chargebacks. I don’t think anyone could steal much cash from a single heist from a bank or other hard target, so you…

Unless they've changed something, I know at least at the very beginning Zelle had no fraud protection.

https://techcrunch.com/2018/02/16/zelle-users-are-finding-ou...

It appears they still have issues with (more advanced forms of) fraud:

https://thecyberexpress.com/zelle-lawsuit-2025-scam-hit-us-f... (this page won't stop reloading, but I think it's my adblock configuration) https://www.morningstar.com/news/marketwatch/20241221198/mor...

Re: We all dodged a bullet

#489

Post by int_19h »

Groxx wrote: post #485
darthwalsh wrote: post #478

Earlier quoted context omitted.

No, C# had it: past tense. CAS was neutered in .NET Framework 4.0 then removed in dotnet core.

alas. don't suppose you know of any good articles on why it's removed? I'd be curious about the reasoning / challenges. there are some rather obvious challenges, but a huge amount of the ones I've run across end up looking mostly like "it's hard to add to an existing language" which is extremely understandable, but hardly a blocker for new ones.

I don't know if there were any articles specifically detailing it, but from blog posts at the time the clear message was that they didn't consider the intended security guarantees to be possible to uphold in practice, so much so that "CAS and appdomains shouldn't be considered a security boundary".

Re: We all dodged a bullet

#490

Post by junon »

kiitos wrote: post #486
junon wrote: post #476

Earlier quoted context omitted.

> the from: address in every email is an arbitrary and unverified text string that the sender provides DKIM et al came back clean. As for URL scheme, I mean the format and layout of URLs - because it was an MITM attack, they matched 1:1.

how did you evaluate the sender address via DKIM to get "clean" response? I mean I know there are methods to verify stuff about a received email, DKIM by itself only handles message integrity and not sender details, for that you need to fold in DMARC -- but there are all WILDLY technical details that are certainly not what anyone is gonna do before clicking a link in a message body > As for URL scheme, I mean the for…

I think you are missing a lot of information I've posted elsewhere in this thread and the original HN post. I didn't minimize anything; I would hope most agree that if anything I've maximized the message as much as I possibly could to prevent further damage.

1. My email client does the validation of certain integrity and security checks and shows a checkmark next to senders that pass. Since npmjs.help was a domain legitimately owned by the attackers, it passed.

2. The link in the email lead to their site at the same domain, most likely performing a MITM between my browser and npm's official servers.

3. You're arguing semantics about "scheme". Please try to understand what I'm attempting to convey: The URLs appeared to match the official npm's site. There was no trickery. Once I had it in my head (erroneously) that .help was fine, nothing else about the attack stood out as suspicious when it came to the URL or domains.

4. Emails themselves are not MITM attacks, no. I didn't respond to an email with my credentials. I would never do that. But that isn't what I've ever claimed to have happened.

5. The URLs being similar or identical to npm's isn't how they technically achieved the MITM. The URLs being similar was to avoid arousing suspicion.

Hopefully that's explanatory enough.

Post reply on HN