I never understood why these package repositories don't include some (opt-in?) integrity checking option using digital signatures. If I download code that executes on my machine there should be at least the option to establish some level of trust. We have been doing that with linux distro package managers for decades. Seems like common sense to me.
Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies
51–60 of 412 posts
Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies
#52This is why end-developer signing is essential. This is not as amendable to CI, but that's the point.
As you see with chrome extensions and android barcode apps, this is not a solution. Developers change or for whatever reasons can change their mind and ship bad things.
Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies
#53The real solution is to design and build software components that can be finished , so they can be ruthlessly vetted - rather than the endless churn of updates.
Not sure why parent is being down-voted as I believe this is an important point. In my opinion this would be applying the unix philosophy of having small tools that does one thing and does it well to code libraries.
Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies
#54I’m cackling at how great this is. This is what happens when you trust the internet forever and just scarf down any old thing at build time. Of course it’ll get exploited! That’s what evil people do.
You say this, but I feel like in the 20-odd years I’ve been using package managers I’ve seen very very few real world exploits?
While the risk is low, the potential impact of a successful exploit is massive so the matter should be taken seriously.
Remember how much was temporarily broken in the leftPad event? Imagine if all that had been silently back-doored instead?
Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies
#55I know that node has `package-lock.json` and `yarn.lock`, which include integrity checks. Are these checks decorative only? How could npm have been affected by this issue?
You can easily misconfigure npm by using the `npm i`/`npm install` command on CI/CD instead of `npm ci`. `npm install` does not take any lockfiles into account and only uses the package.json and upgrades any package/dependency that is not pinned.
Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies
#56Earlier quoted context omitted.
Helps in this specific case, but will not eliminate the broader issue. The broader issue is how can you trust 3rd party code to not do anything harmful, and it’s not like we can even perfectly trust our own fingers in that regard.
But the broad issue will never be resolved. The entire foundation of society is built around some trust. What has proven to work is that we trust actors who are identifiable and have something to lose. This goes with everything from your bank, to government, to name brands, to your local restaurant. Nix package managers/repositories have a level of scrutiny to get into, and highly dedicated people in charge of. Rando…
>Nix package managers/repositories have a level of scrutiny to get into, and highly dedicated people in charge of. Random github repos (or npm packages) are extremely low effort/risk to set up.
That's not really true though. Nix doesn't support signed sources, there are no signatures in the package repository and in theory "John Doe" with no information can add packages and send pull-requests.
In practise nixpks is just a well moderated user repository and the level of scrutiny is less then the enterprise distros can offer.
Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies
#57To mitigate this kind of supply chain attacks for python, we have created following tool [1], that will check python packages on Artifactory instance you specify and create packages with the same name on the PyPi. [1] https://github.com/pan-net-security/artifactory-pypi-scanner
Uploading dummy packages to PyPi isn't the solution. It just pollutes PyPi and a nuisance to others. You have always been able to specify the `index-url` when installing packages using pip. This can also be added to `requirements.txt` files as well.
Specifying `index-url` is not a solution since `pip` will always choose a package with higher version regardless of the repository. Moreover, in case of same version, it will prioritize PyPI. This was discussed in following issues [0], [1].
Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies
#58I'm surprised the reverse fully-qualified domain name (FQDN) model used by Java isn't more widely adopted. If you want to upload artifacts to the main repository (Maven Central) you first need to show ownership of a particular domain. For example, via a DNS TXT record (example [1]). Would make these kind of attacks a lot more difficult. [1] https://issues.sonatype.org/browse/OSSRH-61509
Or the URL-based model used by Go.
Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies
#59I never understood why these package repositories don't include some (opt-in?) integrity checking option using digital signatures. If I download code that executes on my machine there should be at least the option to establish some level of trust. We have been doing that with linux distro package managers for decades. Seems like common sense to me.
They largely do in various forms. Both npm and yarn, by default, record hashes of the dependencies you're using and check them when redownloading.
I think the issue tends to be more that there's just so many packages (often nested 10+ deep) and it's best practice to keep them as up to date as possible.
When it's fairly typical for a JS project to have thousands of dependencies, there isn't really any practical way to both stay up to date and carefully review everything you pull in.
I think the only viable solution for companies taking this issue really seriously is to keep their numbers of dependencies down and avoid having significant deep/indirect dependencies.
Edit: as an example, in my company's Node stack (for 10 services) - there's >900 dependencies. In our React stack (for 2 sites), more than 1600.
Contrary to what you might think, these are actually pretty small, lightweight systems. So really whatever you might have thought was the worst-case scenario on numbers of deps, the reality is more like 10x that in the modern JS ecosystem.
In many ways, the vast number of tiny dependencies are one of the strongest points of the JS ecosystem. But it doesn't come without caveats.
Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies
#60I never understood why these package repositories don't include some (opt-in?) integrity checking option using digital signatures. If I download code that executes on my machine there should be at least the option to establish some level of trust. We have been doing that with linux distro package managers for decades. Seems like common sense to me.
I was thinking the same thing. Surely PayPal's packages should be signed by a certificate only PayPal has, and they would want to verify that before using their packages?