Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Keylogger discovered in image generator extension

old.reddit.com

Post reply on HN
Print view View original

51–60 of 102 posts

Re: Keylogger discovered in image generator extension

#51

Post by redserk »

fbdab103 wrote: post #47
bdlowery wrote: post #35

Earlier quoted context omitted.

I haven’t looked at the source code of a single npm package I’ve installed in the past 5 years. “It takes a few minutes” Dude my web dev projects have like 1,000s of dependencies. I’m not going to check the source code of every package tailwind requires.

Even if you did review it, a motivated attacker is not going to have an exfiltrate_user_data(). The xz backdoor exploit was incredibly sophisticated, and one key of the design was sneaking a "." into a single line of a build test script. A cursory audit of primary dependencies has almost zero chance of catching anything but a brazen exploit.

Yeah. Realistically I think the best course of action is just assume you’re already using a library that can exfiltrate data.

This requires allowlisting egress traffic and possibly even architecting things to prevent any one library from seeing too many things. This approach can be a big pain though and could be difficult to implement practically.

Re: Keylogger discovered in image generator extension

#52

Post by pingou »

uyzstvqs wrote: post #39

I'm curious if it'd be possible to use a Code LLM to scan GitHub repos and detect possible malware hiding in source code.

I'm afraid a few simple tweaks, especially if the hackers themselves have access to the code LLM to try out their code, will be sufficient to evade detection.

Re: Keylogger discovered in image generator extension

#53

Post by LtWorf »

skilled wrote: post #3

Looks like a pretty small project. Only had 40 stars on GitHub before the repo was removed. Was this the main method of GPT4 and Claude integrations for ComfyUI?

Using stars as popularity doesn't work.

I have personally never starred anything that I use. And 90% of the open source that I use isn't on github.

Re: Keylogger discovered in image generator extension

#55

Post by genter »

tamimio wrote: post #28
vvpan wrote: post #27

Earlier quoted context omitted.

Which is everybody in the world except for a handful of people.

Not really, and it takes a few minutes because most of these packages (including npm) are small. You don’t have to read the WireGuard codebase because it’s reputable enough, but for obscure or unknown add-ons/package code, it’s on you to double-check, just like reading the ‘readme’.

Would you have caught the XZ backdoor?

Re: Keylogger discovered in image generator extension

#56

Post by creata »

vvpan wrote: post #27
tamimio wrote: post #25

Lesson for the people who run and execute stuff without looking at the code first.

Which is everybody in the world except for a handful of people.

Most people should only download software from people they trust (to not be evil and also to be competent).

If you download code off some unknown person's GitHub repo, you'd be stupid not to read it very very carefully!

Re: Keylogger discovered in image generator extension

#57

Post by protosam »

CrazyStat wrote: post #41
kibwen wrote: post #36

Earlier quoted context omitted.

Unfortunately, no, because the existence of LLMs that can automatically determine code that is suspicious will be offset by the existence of LLMs that can generate malicious code that bypasses the detection abilities of the aforementioned LLMs.

Generative Adversarial LLMs, let’s go!

Perhaps we could just call these ALLMs (Adversarial Large Language Models). You’re already dropping the N in GAN, I see no need for the G.

As an end result I think someone clever could make a LLaMA pun for the name of a LLaMA based ALLM.

Re: Keylogger discovered in image generator extension

#58

Post by StressedDev »

tamimio wrote: post #25

Lesson for the people who run and execute stuff without looking at the code first.

Everyone runs code they have not inspected. For example, almost no one has read all of the code of in FreeBSD, Linux (kernel), MacOS, Open BSD, or Windows. I also doubt people are reading all of the code in their favorite Linux distribution.

Even inspecting the code is not enough because a lot of security vulnerabilities are not obvious. Basically, security is hard, and often there are not a lot of good solutions.

Here are some tricks I have found which have helped me minimize my risk:

1) Use different machines for different purposes. Basically, you should not use 1 PC (or Mac) for everything. I have one for my finances, one for gaming, and a general-purpose PC. If one gets hacked, the others are still fine.

2) Get software from trustworthy sources. Most of the major software companies are not going to ship malicious code. For open-source software, use software from popular projects which have a good reputation.

3) Ask yourself why is someone providing this software? Is it for money? Are they creating it because they enjoy it? How do they support themselves? For example, Google's business model is building a dossier on people so it can deliver ads they are more likely to click on. When Google gives you something for "free", they will probably use it to track you, or track visitors to your website.

4) Support the people who build the software you use. If its commercial software, pay for it, do not pirate it. If it's open source, donate time or money to the projects you use. Also, thank the people who work on the software, and ALWAYS treat them with respect.

5) Avoid pirated software, software from "free" porn web sites, etc. People who provide illegal software, or sketchy software are probably willing to put back doors in it.

Re: Keylogger discovered in image generator extension

#59

Post by nicce »

pingou wrote: post #52
uyzstvqs wrote: post #39

I'm curious if it'd be possible to use a Code LLM to scan GitHub repos and detect possible malware hiding in source code.

I'm afraid a few simple tweaks, especially if the hackers themselves have access to the code LLM to try out their code, will be sufficient to evade detection.

Endless race like with Anti-Virus software.

Re: Keylogger discovered in image generator extension

#60

Post by nicce »

SoftTalker wrote: post #21
BoredPositron wrote: post #14

That discussion on reddit really is something else so much misinformation and pretend knowledge at work. It's as scary as the malware.

And this is the input for AI training.....

Not just any input, but paid input :-)
Post reply on HN