Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies
1–10 of 412 posts
Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies
#2It won't be just companies. It'll be developers, sysops, etc who npm install a bazillion of packages, because the core language and libaries are not enough. Those people have keys, credentials and access to the internal networks.
Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies
#3Previous discussion: https://news.ycombinator.com/item?id=26081149
Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies
#4I’m cackling at how great this is. This is what happens when you trust the internet forever and just scarf down any old thing at build time. Of course it’ll get exploited! That’s what evil people do.
Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies
#5solution: use nix as your package manager
Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies
#6Package management isn't what I initially think of when I hear "supply chain". Neat hack! It's like left-pad but malicious.
Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies
#7Previous discussion: https://news.ycombinator.com/item?id=26081149
and the link to the original author's post: https://medium.com/@alex.birsan/dependency-confusion-4a5d60f...
Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies
#8solution: use nix as your package manager
Helps in this specific case, but will not eliminate the broader issue. The broader issue is how can you trust 3rd party code to not do anything harmful, and it’s not like we can even perfectly trust our own fingers in that regard.
Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies
#9That is insane that any company allowed this to happen.
""That said, we consider the root cause of this issue to be a design flaw (rather than a bug) in package managers that can be addressed only through reconfiguration," a Microsoft spokesperson said in the email."
No, npm has scopes for a reason, why would that not fix this issue?
Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies
#10I'm flabbergasted by how silly this is. Bump the version and the package manager chooses yours online vs. the private one. Amazing. How silly and how expensive is this going to be as this blatant security issue is going ripple on for the next months to come.