Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to gain code execution on hundreds of millions of people and popular apps

kibty.town

Post reply on HN
Print view View original

51–60 of 350 posts

Re: How to gain code execution on hundreds of millions of people and popular apps

#51

Post by hakaneskici »

Centigonal wrote: post #50
hakaneskici wrote: post #26

Earlier quoted context omitted.

How can -let's say- Cursor users be sure they were not compromised? > No malicious usage was detected Curious to hear about methods used if OK to share, something like STRIDE maybe?

from todesktop's report: > Completed a review of the logs. Confirming all identified activity was from the researcher (verified by IP Address and user agent).

With privileged access, the attackers can tamper with the evidence for repudiation, so although I'd say "nothing in the logs" is acceptable, not everyone may. These two attack vectors are part of the STRIDE threat modeling approach.

Re: How to gain code execution on hundreds of millions of people and popular apps

#52

Post by madeofpalk »

gamedever wrote: post #46
felixrieseberg wrote: post #31

As an Electron maintainer, I'll re-iterate a warning I've told many people before: Your auto-updater and the underlying code-signing and notarization mechanisms are sacred . The recovery mechanisms for the entire system are extremely painful and often require embarrassing emails to customers. A compromised code-sign certificate is close to the top of my personal nightmares. Dave and toDesktop have build a product tha…

And yet, tons of developers install github apps that ask for full permissions to control all repos and can therefore do to same things to every dev usings those services. github should be ashamed this possibility even exists and double ashamed that their permission system and UX is so poorly conceived that it leads apps to ask for all the permissions. IMO, github should spend significant effort so that the default is…

Why spend that effort when any code you run on your machine (such as dependency post-install scripts, or the dependencies themselves!) can just run `gh auth token` can grab a token for all the code you push up.

By design, the gh cli wants write access to everything on github you can access.

Re: How to gain code execution on hundreds of millions of people and popular apps

#53

Post by nightpool »

sky2224 wrote: post #41

This is the second big attack found by this individual in what... 6 months? The previous exploit (which was in Arc browser), also leveraged a poorly configured firebase db: https://kibty.town/blog/arc/ So this is to say, at what point should we start pointing the finger at Google for allowing developers to shoot themselves in the foot so easily? Granted, I don't have much experience with firebase, but to me this just…

I don't think Firebase is really at fault here—the major issue they highlighted is that the deployment pipeline uploaded the compiled artifact to a shared bucket from a container that the user controlled. This doesn't have anything to do with firebase—it would have been just as impactful if the container building the code uploaded it to S3 from the buildbot.

Re: How to gain code execution on hundreds of millions of people and popular apps

#55

Post by fc417fc802 »

TheDong wrote: post #32
mcoliver wrote: post #29

"i wanted to get on the machine where the application gets built and the easiest way to do this would be a postinstall script in package.json, so i did that with a simple reverse shell payload" Just want to make sure I understand this. They made a hello world app and submitted it to todesktop with a post install script that opened a reverse shell on the todesktop build machine? Maybe I missed it but that shouldn't be…

In what world do you have a machine which downloads source code to build it, but doesn't have outbound internet access so it can't download source code or build dependencies? Like, effectively the "build machine" here is a locked down docker container that runs "git clone && npm build", right? How do you do either of those activities without outbound network access? And outbound network access is enough on its own to…

If you don't network isolate your build tooling then how do you have any confidence that your inputs are what you believe them to be? I run my build tools in a network namespace with no connection to the outside world. The dependencies are whatever I explicitly checked into the repo or otherwise placed within the directory tree.

Re: How to gain code execution on hundreds of millions of people and popular apps

#56

Post by 999900000999 »

sky2224 wrote: post #41

This is the second big attack found by this individual in what... 6 months? The previous exploit (which was in Arc browser), also leveraged a poorly configured firebase db: https://kibty.town/blog/arc/ So this is to say, at what point should we start pointing the finger at Google for allowing developers to shoot themselves in the foot so easily? Granted, I don't have much experience with firebase, but to me this just…

Firebase let's anyone get started in 30 seconds.

Details like proper usage, security, etc. Those are often overlooked. Google isn't to blame if you ship a paid product without running a security audit.

I use firebase essentially for hobbyist projects for me and my friends.

If I had to guess these issues come about because developers are rushing to market. Not Google's fault ... What works for a prototype isn't production ready.

Re: How to gain code execution on hundreds of millions of people and popular apps

#58

Post by throitallaway »

luxurytent wrote: post #54

Love the blog aesthetic, and the same goes to all your friends (linked at the bottom).

The lack of capitalization made it difficult for me to quickly read sentences. I had to be much more intentful when scanning the text.

Re: How to gain code execution on hundreds of millions of people and popular apps

#59

Post by mcoliver »

TheDong wrote: post #32
mcoliver wrote: post #29

"i wanted to get on the machine where the application gets built and the easiest way to do this would be a postinstall script in package.json, so i did that with a simple reverse shell payload" Just want to make sure I understand this. They made a hello world app and submitted it to todesktop with a post install script that opened a reverse shell on the todesktop build machine? Maybe I missed it but that shouldn't be…

In what world do you have a machine which downloads source code to build it, but doesn't have outbound internet access so it can't download source code or build dependencies? Like, effectively the "build machine" here is a locked down docker container that runs "git clone && npm build", right? How do you do either of those activities without outbound network access? And outbound network access is enough on its own to…

There are plenty of worlds that take security more seriously and practice defense in depth. Your response could use a little less hubris and a more genuinely inquisitive tone. Looks like others have already chimed in here but to respond to your (what feels like sarcasm) questions:

- You can have a submission process that accepts a package or downloads dependencies, and then passes it to another machine that is on an isolated network for code execution / build which then returns the built package and logs to the network facing machine for consumption.

Now sure if your build machine is still exposing everything on it to the user supplied code (instead of sandboxing the actual npm build/make/etc.. command) you could insert malicious code that zips up the whole filesystem, env vars, etc.. and exfiltrates them through your built app in this case snagging the secrets.

I don't disagree that the secrets on the build machine were the big miss, but I also think designing the build system differently could have helped.

Re: How to gain code execution on hundreds of millions of people and popular apps

#60

Post by fc417fc802 »

selfhoster wrote: post #47
trallnag wrote: post #30

Earlier quoted context omitted.

Isn't it really common for build machines to have outbound internet access? Millions of developers use GitHub Actions for building artifacts and the public runners definitely have outbound internet access

It is and regardless a few other commenters saying or hinting it isn't...it is. An air gapped build machine wouldn't work for most software built today.

Strange. How do things like Nix work then? The nix builders are network isolated. Most (all?) Gentoo packages can also be built without network access. That seems like it should cover a decent proportion of modern software.

Instances where an air gapped build machine doesn't work are examples of developer laziness, not bothering to properly document dependencies.

Post reply on HN