Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Malicious code added to 35k GitHub repos, leaking user environments

twitter.com

Post reply on HN
Print view View original

61–70 of 79 posts

Re: Malicious code added to 35k GitHub repos, leaking user environments

#61

Post by __alexs »

nicce wrote: post #49
jhugo wrote: post #39

Earlier quoted context omitted.

You may have misunderstood (understandably, because the tweets seem to be deliberately misleading). These are malicious commits in forks of repositories. There is no supply chain attack unless you make a habit of taking random forks of popular projects from GitHub and inserting them into your supply chain.

> There is no supply chain attack Actually yes, this is all about supply chain attacks. Typosquatting is one of the most common methods. It goes under this category.

Spam is not a problem GitHub has ever had to seriously face so far but this sort of attack does seem like it could catch some users casually googling for libraries.

If you impersonated all these real repos, made npm, pypi packages for them etc and also updated the readme I think you could catch some people off guard.

Re: Malicious code added to 35k GitHub repos, leaking user environments

#63

Post by nicce »

__alexs wrote: post #61
nicce wrote: post #49

Earlier quoted context omitted.

> There is no supply chain attack Actually yes, this is all about supply chain attacks. Typosquatting is one of the most common methods. It goes under this category.

Spam is not a problem GitHub has ever had to seriously face so far but this sort of attack does seem like it could catch some users casually googling for libraries. If you impersonated all these real repos, made npm, pypi packages for them etc and also updated the readme I think you could catch some people off guard.

This is a real problem indeed. There have been reports about successful ones.

https://www.theregister.com/2022/07/06/npm_supply_chain_atta...

https://www.idstrong.com/sentinel/npm-packages-info-stolen/

Re: Malicious code added to 35k GitHub repos, leaking user environments

#65

Post by jollybean »

drekipus wrote: post #7

This is that thing where people can put anyone in as the commit author, thus impersonating the original creator right? Seems like the solution is "don't just copy random github urls into your code" ?

What is the difference between a 'random' and 'non random' repo?

The whole point of 'Open Source' is that we can use code which might otherwise be a bit 'random'.

It's not 'Institutionalized Open Source' it's just 'Open Source' i.e. we're not all Torvalds.

So, credibility etc. is a very fickle thing otherwise, this is a serious security issue and we really don't have answers.

We used to think about code as 'logic that works' but now we have other criteria, I wonder if our FOSS models need to adapt bit.

Re: Malicious code added to 35k GitHub repos, leaking user environments

#66

Post by jhugo »

nicce wrote: post #49
jhugo wrote: post #39

Earlier quoted context omitted.

You may have misunderstood (understandably, because the tweets seem to be deliberately misleading). These are malicious commits in forks of repositories. There is no supply chain attack unless you make a habit of taking random forks of popular projects from GitHub and inserting them into your supply chain.

> There is no supply chain attack Actually yes, this is all about supply chain attacks. Typosquatting is one of the most common methods. It goes under this category.

The supply-chain attack is a self-inflicted attack if you're Googling a library and copy-pasting it as a Git dependency without so much as a glance at any of the numerous indicators that are screaming at you that it's untrustworthy.

It seemed pretty clear to me that GGP misunderstood this as malicious code being inserted into existing trusted repositories, which is a common misunderstanding in the rest of the comments, and seems to be encouraged by the poor wording of the tweets.

Re: Malicious code added to 35k GitHub repos, leaking user environments

#67

Post by Karellen »

xrisk wrote: post #43
Karellen wrote: post #36

Earlier quoted context omitted.

> I feel the commit data could be extended to include some metadata that isn’t used to compute the hash. That's not how git works.

I’m somewhat familiar with how git works. In my understanding, a commit is just a blob combining the commit information and a tree blob, hashing them together to create a commit id. This design doesn’t preclude the usage of additional information in the commit blob that isn’t used to compute the hash. (Think for example how file access times do not affect its hash)

If it's not part of the information that's hashed to create the commit id, it's not part of the commit. By definition.

Re: Malicious code added to 35k GitHub repos, leaking user environments

#68

Post by nicce »

jhugo wrote: post #66
nicce wrote: post #49

Earlier quoted context omitted.

> There is no supply chain attack Actually yes, this is all about supply chain attacks. Typosquatting is one of the most common methods. It goes under this category.

The supply-chain attack is a self-inflicted attack if you're Googling a library and copy-pasting it as a Git dependency without so much as a glance at any of the numerous indicators that are screaming at you that it's untrustworthy. It seemed pretty clear to me that GGP misunderstood this as malicious code being inserted into existing trusted repositories, which is a common misunderstanding in the rest of the comment…

> The supply-chain attack is a self-inflicted attack

It is attack regardless. Someone has made something malicious which affects for the process for the end-user acquiring the final software.

> it seemed pretty clear to me that GGP misunderstood this as malicious code being inserted into existing trusted repositories, which is a common misunderstanding in the rest of the comments, and seems to be encouraged by the poor wording of the tweets.

I think the author just wanted to get attention and be sensational. He deliberately did not mention that they are forks. Just rushed to report findings.

Re: Malicious code added to 35k GitHub repos, leaking user environments

#69

Post by jwilk »

sschueller wrote: post #26
jwilk wrote: post #12

> So far found in projects including: crypto, golang, python, js, bash, docker, k8s Huh? What does that mean?

It appears what is infected are forks of those repos but not the originals.

What would make sense for golang, python, docker, k8s; maybe even bash if you squint a bit.

But what's the repo for "crypto" or "js"?

Re: Malicious code added to 35k GitHub repos, leaking user environments

#70

Post by laserlight »

eurasiantiger wrote: post #52
laserlight wrote: post #46

Earlier quoted context omitted.

Considering that only clones are affected, your original tweet is downright wrong. None of the listed projects (python, js, bash, docker, k8s) are affected. Anybody can fork a repository to introduce malware.

js is a project?

You're right. It's not. I just copy-pasted the list from the tweet. I assume that the author meant to write jq.
Post reply on HN