Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Rest-client gem is hijacked

github.com

Post reply on HN
Print view View original

1–10 of 113 posts

Re: Rest-client gem is hijacked

#2

Post by sersi »

I think that rubygems should consider automatically enforcing multifactor authentication for popular gems.

So any gem with more than 50,000 downloads should force to gem maintainer to have MFA set up before they can publish a new version or do anything with that gem.

Because, having MFA is not about protecting gem maintainers, it's about protecting users. So, gem maintainers should not be allowed to be careless with security by not using MFA. It's not their choice to make.

Re: Rest-client gem is hijacked

#5

Post by raesene9 »

sersi wrote: post #2

I think that rubygems should consider automatically enforcing multifactor authentication for popular gems. So any gem with more than 50,000 downloads should force to gem maintainer to have MFA set up before they can publish a new version or do anything with that gem. Because, having MFA is not about protecting gem maintainers, it's about protecting users. So, gem maintainers should not be allowed to be careless with…

It's not just rubygems that has this issue, it's all the other repos too, most of which (AFAIK) don't enforce 2FA

Also worth noting that whilst MFA helps, it's not a panacea as MFA isn't generally compatible with automated CI/CD processes, so API keys will still be required, and can be leaked/lost/stolen.

Re: Rest-client gem is hijacked

#6

Post by raesene9 »

westoque wrote: post #4

Out of curiosity, is there a legal way to go after people that do these? e.g., File a police report?

Unless the attacker had very poor OpSec, it would be hard to track them down, even assuming the relevant police force had the skills/manpower to do so.

Then you get the delight of likely jurisdictional issues, if it turns out the attacker is not a resident of the same country as the victim that reported it.

Re: Rest-client gem is hijacked

#7

Post by raesene9 »

Following closely on from Webmin's compromised CI/CD pipeline, this is another instance of the growing problem of supply chain attacks.

With the software supply chain being as complex as it is, and the large number of moving parts, we're only going to see more of these ...

Re: Rest-client gem is hijacked

#8

Post by cooljacob204 »

raesene9 wrote: post #5
sersi wrote: post #2

I think that rubygems should consider automatically enforcing multifactor authentication for popular gems. So any gem with more than 50,000 downloads should force to gem maintainer to have MFA set up before they can publish a new version or do anything with that gem. Because, having MFA is not about protecting gem maintainers, it's about protecting users. So, gem maintainers should not be allowed to be careless with…

It's not just rubygems that has this issue, it's all the other repos too, most of which (AFAIK) don't enforce 2FA Also worth noting that whilst MFA helps, it's not a panacea as MFA isn't generally compatible with automated CI/CD processes, so API keys will still be required, and can be leaked/lost/stolen.

Why would a CI/CD need to permissions modify and commit code to a repo?

Re: Rest-client gem is hijacked

#10

Post by raesene9 »

cooljacob204 wrote: post #8
raesene9 wrote: post #5

Earlier quoted context omitted.

It's not just rubygems that has this issue, it's all the other repos too, most of which (AFAIK) don't enforce 2FA Also worth noting that whilst MFA helps, it's not a panacea as MFA isn't generally compatible with automated CI/CD processes, so API keys will still be required, and can be leaked/lost/stolen.

Why would a CI/CD need to permissions modify and commit code to a repo?

Say your CI pipeline runs automated tests, builds the gem and pushes to Rubygems, it needs permissions to push to Rubygems.

So if an attacker compromises the API key used by that pipeline, they get the rights to push to Rubygems.

Post reply on HN