19 ms·
A Case of Stolen Source Code
- artana 9y agohttp://www.webmhs.com/2017/05/prediksi-leicester-city-vs-tottenham.html http://www.webmhs.com/2017/05/prediksi-leicester-city-vs-tot...
- Sidnicious 9y ago> And more importantly, the right people at Apple are now standing by to quickly shut down any stolen/malware-infested versions of our apps that we may discover. The "stolen" part bugs me — even though it would be incredibly shitty to distribute cracked-from-source versions of Panic apps, I hope that Apple wouldn't prevent users from running them. I appreciate the malware protection built into macOS, but this might be an abuse of it.
- Mtinie 9y agoCan you expand on your comment? I don't follow your logic. Isn't Apple legally culpable if they knowingly act as a marketplace for stolen goods?
- lanna 9y ago[deleted]
- khedoros1 9y agoIf someone broke into the KFC vault and wrote down the spice recipe used for the chicken, we'd still call that a "stolen recipe". If part of the value of the source code is its secrecy, then its value decreases when it's made public. Look at an example of one way the word "steal" is used in speech. If I say "Good artists copy; great artists steal", and I saying that great artists break into a building and illegally remove a physical artifact, or am I saying that they copy something for their own benefit? If one can "steal" an idea, then isn't that a "stolen idea"? And if that stolen idea is directly used to create some salable product, then isn't that a "stolen product", in that sense? edit: The comment I responded to made the claim that source code couldn't be stolen, only copied (similar to the standard argument "it's copyright infringement, not theft", often applied to copied media). There was more, but I don't remember the wording, and I don't want to misrepresent the position.
- sillysaurus3 9y agoIf part of the value of the source code is its secrecy, then its value decreases when it's made public. It's not necessarily true that part of the value of source code is its secrecy, though. We'd like to believe that, but it's difficult to come up with evidence to support it. Most instances where source code is leaked result in no damage to the owner, for example.
- nemothekid 9y ago>It's not necessarily true that part of the value of source code is its secrecy, though. Pretty sure the same could be said of KFC's secret spices recipe.
- pcwalton 9y agoI hate to be the person to post this comment, but anyway: We have pretty good evidence that KFC's recipe has been reverse engineered and/or leaked anyway. Doesn't seem to have affected its sales much. https://en.wikipedia.org/wiki/KFC_Original_Recipe#Recipe https://en.wikipedia.org/wiki/KFC_Original_Recipe#Recipe
- eric_h 9y agoIndeed, never underestimate the power of the brand itself.
- khedoros1 9y agoI concede the point. I don't think I can prove that hidden source is always beneficial for the company, and maybe not even that it ever is (although that weaker version of the claim just needs one counter-example ;-) ).
- Sidnicious 9y agoSorry, I wasn't thinking of the App Store. I read the original text as meaning that they might block cracked versions of Panic apps from running on Macs entirely.
- majormajor 9y ago"It would be incredibly shitty to try to harm their business like that, but that's no reason to try to prevent it"?
- Sidnicious 9y agoI don't believe that the role of an OS maintainer includes blocking users from running any software. (It's OK to make malware difficult to run.)
- khedoros1 9y agoI read it more as "I hope this isn't used as an excuse to lock down execution of arbitrary unsigned binaries".
- wlesieutre 9y agoI read that as more Apple being on hand to remove any unauthorized clones from the App Store. Software piracy has been around for years and they've never used their antimalware system to prevent a non-malicious app from launching just because it's pirated.
- randomf1fan 9y agoHow does one realistically protect against these new attack vectors? It's all become so quick - the malware infects your machine, and seconds later your repos are cloned. Most computers are always connected to the internet when they're on, even if they don't necessarily need to be. Airgapping isn't really used outside of very sensitive networks, but I'm starting to think we need to head towards a model of connecting machines only when really needed. Of course the cloud based world doesn't allow for that, and perhaps I'm a luddite, but I increasingly find myself disabling the network connection when I'm working on my PC. Kind of like the dial-up days.
- st3fan 9y ago* How does one realistically protect against these new attack vectors?* Do not install unsigned software is a good start. Does that dialog need a secondary 'Are you really really sure?' absolutely .. but the basic defence in this specific case was in place.
- libeclipse 9y agoYeah, Linux especially I've never downloaded and installed something manually from the internet. I get all of my packages directly from: pacman -S foo Or sometimes maybe: yaourt -S foo tl;dr Use your operating-system's package manager.
- logicallee 9y agoWho downvoted the above, and why - it seems like a genuine reply for how the parent commenter does things, written from the perspective of a user? -- EDIT: to the reply to this, when I posted my comment, the parent was greyed out. (not now.) whoever did it obviously has some opinion, they should just reply with it so it adds to the discussion. (which I'm just reading, didn't contribute anything else to.)
- gtirloni 9y agoHow do you know someone downvoted it? It looks the same as others to me (not grayed out).
- Sidnicious 9y ago> …breeze right through an in-retrospect-sketchy authentication dialog… I can't blame them for this. A surprising number of apps ask for root (inc. Adobe installers and Chrome). As far as I know, it's to make updates more reliable when an admin installs a program for a day-to-day user who can't write to /Applications and /Library. We're long overdue for better sandboxing on desktop (outside of app stores).
- mstade 9y agoTrue story. The status quo unfortunately conditions people into "just answer yes to the stupid questions" which then renders everything from developer certs to elevation warnings moot. "But you got a warning" is little recourse for when your hard drive is encrypted by some ransomware. (I know I'm mixing current events here – cut a fella some slack!)
- thirdsun 9y agoYes. I'm pretty sure WannaCry and its variants could have asked users with a system dialog whether it should proceed encrypting all their data and we still would have seen similar numbers of affected machines (if operated by a human).
- sneak 9y agoI refuse to install Adobe anything on my main partition for this reason. Remember Flash?
- marksomnian 9y agoThat doesn't really work when you're a creative professional who has to use Adobe products for their day job.
- pmiller2 9y agoA lot of those products are now cloud-based.
- briandoll 9y agoOne way to protect against this is to not have SSH keys on your laptop. I've been using Kryptonite https://krypt.co/ https://krypt.co/ lately, which is sort of like two-factor for SSH keys.
- jhugg 9y agoYou can encrypt SSH keys with passwords too.
- hdhzy 9y agoYes, but passwords can be keylogged and SSH keys on a hardware token (like yubikey) can't. Also if you've got touch-to-use enabled on the token you can't even use the key without physically touching the token.
- agrinman 9y agoAny user-level process can actually obtain your decrypted private-key: https://blog.krypt.co/why-store-an-ssh-key-with-kryptonite-9f24c1f983d5#1269 https://blog.krypt.co/why-store-an-ssh-key-with-kryptonite-9...
- clarry 9y agoAddKeysToAgent defaults to no. Ptrace might also be disabled, depending on system. I would be more concerned about keyloggers, or any tricks that result in me running something else than the real ssh client (e.g. custom program somewhere in PATH).
- mintplant 9y agoThis relies on the security of my phone OS, which I trust much less than my desktop's.
- hdhzy 9y agoI wonder why is that? Apps on the phone are by default sandboxed and there is no way to get root (instead of running the exploit).
- ianlevesque 9y ago> I also likely bypassed the Gatekeeper warning without even thinking about it, because I run a handful of apps that are still not signed by their developers. Apple really needs to fix this. In particular open source applications don't sign for whatever reason and it's clear that barring some change they aren't going to start now.
- valleyer 9y agoWhat do you suggest?
- plorkyeran 9y agoNot having to pay $99/year to sign builds of your open-source application would help.
- Gaelan 9y agoWhich means it is cheap to sign your malware.
- marksomnian 9y agoAnd have your cheap malware signature revoked by Apple.
- zeveb 9y agoWhy was he installing Handbrake on a work computer? Maybe he had a business need to transcode videos, in which case no problem, but was he installing Handbrake on a work computer in order to rip DVDs personally? Worse, was he perhaps doing work on a personal computer? Folks, don't mix your business & professional lives. The cost is not worth the benefit!
- packetslave 9y agoWhy do you think that Handbrake is only for ripping DVDs?
- ythn 9y agoBecause that's what OP uses it for...
- zeveb 9y agoI mentioned right there its use for transcoding videos!
- mynameisvlad 9y agoOkay, then was your comment at all necessary? Why assume he was using it for personal DVD ripping when you literally provided a legitimate business use in your own comment?
- zeveb 9y ago> Why assume he was using it for personal DVD ripping when you literally provided a legitimate business use in your own comment? Because IMHO that's the most likely reason for a developer to have Handbrake installed. It's not the only reason, as I noted, but I believe it's the most likely one.
- mynameisvlad 9y agoNo, that's the most likely reason for you to have Handbrake installed. Don't project yourself onto others. As I already said, you provided a valid business case, at which point the rest of your holier-than-thou comment goes out the window because it could very well have been that and the OP has no incentive to say claim otherwise.
- ChuckMcM 9y agoGreat writeup!. I think a lot of developers would do well to understand both the 'right' way to respond to this sort of event, and the tools you need in order to do so. Most importantly being detailed loggging and processes for re-keying everything. I've participated in, and run, exercises where such damage is inflicted on purpose to surface gaps in the the response processes and to fix them. I was inspired by the Google DiRT (disaster recovery) and NetFlix Chaos Monkey exercises. Both of these create not simply review processes but simulation by action, or actually doing the damage to see the process work. Setting up your systems so that you can do that is a really powerful tool.
- jacquesm 9y agoThat actually goes a step further than Chaos Monkey. I wonder how many organizations would survive that approach if it were intense enough from day #1. Better to ramp that up carefully and give people room to breathe and fix things.
- floatboth 9y agoheh, new idea: GitHub Monkey — randomly makes your private repos public
- ythn 9y ago> without stopping to wonder why HandBrake would need admin privileges, or why it would suddenly need them when it hadn’t before Seems like it's completely random that an app needs admin or not. Blender3d? No admin. Unity3d? admin. etc.
- Whitestrake 9y agoArbitrary, rather than random. Most of the time, it's entirely up to the developer. I'm sure the percentage of applications that actually require administrative privileges to perform tasks is in the single digits or lower.
- ythn 9y ago> I'm sure the percentage of applications that actually require administrative privileges to perform tasks is in the single digits or lower. This is probably true. I'm surprised we don't get after companies for unnecessarily requiring admin with their apps.
- nthcolumn 9y agoMeh, should all be on github anyway. Like.. Handbrake!
- nthcolumn 9y agoHandbrake is on github, people put lots of hours into it and it can be downloaded, checked and compiled. handbrake is used to transcode video - often between proprietary formats, people often put a lot of hours into the videos transcoded by handbrake, but this was binary handbrake on a mac, macs are based on unix, people put a lot of hours into unix... people put a lot of hours into the company's source code... but it too was stolen, the world is a cynical place somehow. Maybe if it all was on github the world would not seem such a cynical place and people would realize that the value is in what they themselves bring and not in the thing on github.
- otempomores 9y agoA version controllsystem which would allow the seperate safe versioning of ip central code with merge to build system would be nice.
- masto 9y agoI'm a bit surprised at the "personalized attention" from the attacker: that a human on the other end takes time to poke around individual machines, recognize the developer, and tailor a source code theft + ransom campaign to them. I had assumed that these are bulk compromises of at least thousands of machines and they just blast out scripts to turn them into spam proxies or whatever. Maybe given the limited scale of this one and the obvious interest the attacker has in producing trojaned versions of popular software, this is actually what they were hoping for in the first place.
- wlesieutre 9y agoIt might be as simple as an automated "look for ssh keys" in the malware. If you find an SSH key, pretty good odds it's a developer. Scan for git repos, or check their email address to see where they work and go from there.
- kccqzy 9y agoThis makes me wonder, is it easy enough to write a kernel extension such that whenever any process that tries to open(2) my ssh private key, or any hardlinks or symlinks pointing to it, it checks against a known whitelist, and if the process is not in the whitelist, a dialog pops up and asks me for my permission. Is this easy to implement? Frankly I can only think of a small number of processes that need to automatically access the file: backupd, sshd, and Carbon Copy Cloner. Everything else should require my attention.
- lloeki 9y agoAlternatively, sidestep open(2) by implementing a SSH agent so that you can do creative things like https://krypt.co https://krypt.co does, so the key is not laying right on your main filesystem in the first place (and possibly not even ever on the workstation).
- deleted 9y ago[deleted]
- stillhere 9y agoNo one has time to examine every line of source code in the 3rd party applications that we use. That being said it irks me when people don't at least isolate their sensitive material. There are many solutions available including virtualization and jails to run 3rd party applications with less risk involved.
- floatboth 9y ago> Within 24 hours of the hack, we were on the phone with two important teams: Apple and the FBI. FBI, seriously? Calling the cops, over malware, as a cool independent software company?! I mean, sure, fuck malware, but what happened to "fuck the police"? :D
- deleted 9y ago[deleted]
- tlrobinson 9y agoIt's not particularly hard to add malware to an already compiled binary, without access to the source code, is it?
- sullivanmatt 9y agoYou are correct, but if you actually have the source and can compile a binary from that, it is much easier to evade detection. As you might imagine, the gnarly things you have to do to add malware to existing software often trigger detection mechanisms.
- jlg23 9y agoLesson learned: None. You use the same machine for development of commercial, closed source software and video transcoding for most probably private use. Your postmortem can be summarized as "[advertisement]". I get that real security is too hard for most people. But even a few precautions can make a big difference. In order of effectiveness (least effective first): * Don't have sensitive data mounted automatically (yes, ubuntu, your encrypted home directory is a joke). * Don't have sensitive data on the OS-drive. Even if you are limited by archaic USB2, RAM is cheap and so is a virtual memory backed disk. Pushing your closed source into it won't take more than 30s. * Work hard and party hard. But keep that separated. One computer for fun, one for work. The one for work should not even think about talking to external devices until it's sure the environment is friendly. PS: I do drink my own kool-aid - I always carry 2 laptops that run 4 operating systems. My development and sysop environment is not even capable of playing a movie. Edit: "too hard for most people" may sound harsh, but it is not meant like this. I teach OPSEC to activists in developing countries, work for a non-profit with real privacy concerns in a first world country and make real money doing audits for rather large companies. When I say "for most people" it should probably have been "in most circumstances".
- z3t4 9y agoi think its not too hard. its just not convenient. We need to make security the path of least recistence.
- unlmtd 9y agoThe author thinks he owns ideas. Ahahahahah!
- msravi 9y agoAnd this is why ssh keys need to be encrypted - it's a good 2nd factor that will prevent access to all your important stuff if your laptop is stolen/compromised. ssh-keygen -p -f keyfile
- joshaidan 9y agoI find this story pretty fascinating. First, it's interesting how a broad attack, such as putting malware into software used by a large number of people, suddenly becomes a targeted attack: the attackers grab SSH keys and start cloning git repositories. I'm assuming that there was a significant number of victims in this attack. Were they targeting developers? Or did they just happen to comb through all this data and find what looked to be source code / git repositories. The other thing I find interesting is this comment: > We’re working on the assumption that there’s no point in paying — the attacker has no reason to keep their end of the bargain. If you really want to be successful in exploiting people through cyber attacks, I guess you will need some kind of system to provide guaranteed contracts, i.e. proof that if a victim pays the ransom, then the other end of the bargain will be held. It might seem that there's some incentive for ransom holders to hold up their end of the bargain for the majority of cases if they want their attacks to be profitable.
- kbenson 9y ago> If you really want to be successful in exploiting people through cyber attacks, I guess you will need some kind of system to provide guaranteed contracts, i.e. proof that if a victim pays the ransom, then the other end of the bargain will be held. You're describing a legal system and the rule of law. I'm not sure there's way to guarantee anything like you describe when there is some illegality in the nature of the process. Trade only works when you can trust either the parties involved or the system as a whole to uphold their promises (for the system, that's that involved parties that don't uphold their ends will be punished).
- iEchoic 9y ago> You're describing a legal system and the rule of law. I'm not sure there's way to guarantee anything like you describe when there is some illegality in the nature of the process. Legal systems aren't the only way to give confidence that both ends of a bargain will be held. As one example, some darknet markets have escrow systems for this purpose. It's not too hard to imagine a way to do this with ransomed code. Reputation-based systems also provide incentives for sellers to deliver on their promises.
- MarkMc 9y ago- Do not install unsigned software - Do not install personal software on your work computer
- escapologybb 9y agoSlightly OT: I'm a reasonably competent Mac user, I use them all day and depend on them to control my house as I'm disabled. In the event I were to be compromised, can anyone suggest a logging tool/tools that I might be able to use on my network such that I could work out what the problem was and correct anything that needs correcting please? We are looking at four or five Macs of differing types but all running the latest OS, a number of iPhones, iPads, more Raspberry Pi's than I'm going to admit to and a number of other IoT devices. TIA! Also, I really wish more companies would be this forthcoming when they pwned. I think it's really good when are large company comes out with this type of mea culpa, mea maxima culpa. If professionals can get totally pwned, I really do think it tends to make ordinary users think about their security a little more. Or maybe I'm just hopelessly optimistic!
- alecco 9y agoNetwork syslog and a Raspberry Pi with an external drive should be more than enough.
- escapologybb 9y agoI've been doing some googling and it looks like syslog is something that I run on every machine, and then it passes the results of its logging to the Raspberry Pi for collation and possible inspection later on. Have I got the basic gist of it? Thanks for the answer, greatly appreciated. :-)
- HurrdurrHodor 9y ago"There’s no indication any customer information was obtained by the attacker. Furthermore, there’s no indication Panic Sync data was accessed." Read: The attacker could have accessed all that data but didn't send me an e-mail telling me that he did.
- ScottWhigham 9y agoIt wasn't their production environment that was compromised; it was their source code repository.