Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We all dodged a bullet

xeiaso.net

Post reply on HN
Print view View original

91–100 of 498 posts

Re: We all dodged a bullet

#91

Post by macintux »

tempestn wrote: post #88
macintux wrote: post #55

Earlier quoted context omitted.

> 1. NEVER EVER login from an email link. I receive Google Doc links periodically via email; fortunately they're almost never important enough for me to actually log in and see what's behind them. My point, though, is that there's no real alternative when someone sends you a doc link. Either you follow the link or you have to reach out to them and ask for some alternative distribution channel. (Or, I suppose, leave y…

Log into Google, then click the link. If you get prompted to log in again, don't.

Good point, I guess this is the obvious answer.

Re: We all dodged a bullet

#92

Post by IncreasePosts »

macintux wrote: post #57
IncreasePosts wrote: post #53

Earlier quoted context omitted.

That seems like a bad idea compared to just having a canonical domain - people might become used to seeing "npm. " and assuming it is legit. And then all it takes is one new TLD where NPM is a little late registering for someone to do something nefarious with the domain.

Just because you buy them doesn't mean that you have to use them. Squatting on them is no more harmful (except financially) than leaving them available for potentially hostile 3rd parties.

Sure, I guess buying up every npm.* you can find and then having a message "never use this, only use npm.com" could work. I thought OP was saying have every npm.* site be a mirror of the canonical site

Re: We all dodged a bullet

#93

Post by JoshTriplett »

bunderbunder wrote: post #69
Groxx wrote: post #51

Earlier quoted context omitted.

I'm rather convinced that the next major language-feature wave will be permissions for libraries. It's painfully clear that we're well past the point where it's needed. I didn't think it'll make things perfect, not by a long shot. But it can make the exploits a lot harder to pull off.

Alternatively, I've long been wondering if automatic package management may have been a mistake. Its primary purpose seems to be to enable this kind of proliferation of micro-dependencies by effectively sweeping the management of these sprawling dependency graphs under the carpet. But the upshot of that is, most changes to your dependency graph, and by extension your primary vector for supply chain attacks, becomes s…

Manual dependency management without a package manager does not lead people to do more auditing.

And at least with a standardized package manager, the packages are in a standard format that makes them easier to analyze, audit, etc.

Re: We all dodged a bullet

#94

Post by macintux »

zargon wrote: post #73
macintux wrote: post #55

Earlier quoted context omitted.

> 1. NEVER EVER login from an email link. I receive Google Doc links periodically via email; fortunately they're almost never important enough for me to actually log in and see what's behind them. My point, though, is that there's no real alternative when someone sends you a doc link. Either you follow the link or you have to reach out to them and ask for some alternative distribution channel. (Or, I suppose, leave y…

> leave yourself logged into the platform all the time Or only log in when you need to open a google link. Or better yet, use a multi-account container for google.

Yeah, this should have occurred to me. I guess for me it's alien to think about logging into Google.

Re: We all dodged a bullet

#96

Post by b112 »

nottorp wrote: post #72
cataflam wrote: post #35

Besides the ecosystem issues, for the phishing part, I'll repost what I responded somewhere in the other related post, for awareness --- I figure you aren't about to get fooled by phishing anytime soon, but based on some of your remarks and remarks of others, a PSA: TRUSTING YOUR OWN SENSES to "check" that a domain is right, or an email is right, or the wording has some urgency or whatever is BOUND TO FAIL often enou…

Urgency is also either phishing (log in now or we'll lock you out of your account in 24 hours) or marketing (take advantage of this promotion! expires in 24 hours!). Just ... don't.

It's funny how it's never "don't" too.

A guy I knew needed a car, found one, I told him to take it to a mechanic first. Later he said he couldn't, the guy had another offer, so he had to buy it right now!!!, or lose the car.

He bought, had a bad cylinder.

False urgency = scam

Re: We all dodged a bullet

#97

Post by sega_sai »

It seems to me that having an email client that simply disables all the links in the email is probably a good idea. Or maybe, there should be explicit white-listing of domains that are allowed to be hyperlinks.

Re: We all dodged a bullet

#98

Post by ryandrake »

bunderbunder wrote: post #69
Groxx wrote: post #51

Earlier quoted context omitted.

I'm rather convinced that the next major language-feature wave will be permissions for libraries. It's painfully clear that we're well past the point where it's needed. I didn't think it'll make things perfect, not by a long shot. But it can make the exploits a lot harder to pull off.

Alternatively, I've long been wondering if automatic package management may have been a mistake. Its primary purpose seems to be to enable this kind of proliferation of micro-dependencies by effectively sweeping the management of these sprawling dependency graphs under the carpet. But the upshot of that is, most changes to your dependency graph, and by extension your primary vector for supply chain attacks, becomes s…

Unpopular opinion these days, but: It should be painful to pull in a dependency. It should require work. It should require scrutiny, and deep understanding of the code you're pulling in. Adding a dependency is such an important decision that can have far reaching effects over your code: performance, security, privacy, quality/defects. You shouldn't be able to casually do it with a single command line.

Re: We all dodged a bullet

#99

Post by quectophoton »

mrbluecoat wrote: post #80

Does the Go ecosystem have a similar security screening process as NPM? This was caught because a company was monitoring a centralized packaging distribution platform, but I worry about all those golang modules spread across GitHub without oversight..

This page has a short explanation of the default way in which Go downloads modules, with links for more details: https://sum.golang.org/

Re: We all dodged a bullet

#100

Post by bobbylarrybobby »

com2kid wrote: post #58
sebstefan wrote: post #48

Dodged a bullet indeed I find it insane that someone would get access to a package like this, then just push a shitty crypto stealer. You're a criminal with a one-in-a-million opportunity. Wouldn't you invest an extra week pushing a more fledged out exploit? You can exfiltrate API keys, add your SSH public key to the server then exfiltrate the server's IP address so you can snoop in there manually, if you're on a dev…

> You're a criminal with a one-in-a-million opportunity. Wouldn't you invest an extra week pushing a more fledged out exploit? Because the way this was pulled off, it was going to be found out right away. It wasn't a subtle insertion, it was a complete account take over. The attacker had only hours before discovery - so the logical thing to do is a hit and run. They asked what is the most money that can be extracted…

If they'd waited a week before using their ill-gotten credentials to update the packages, would they have been detected in that week?
Post reply on HN