7 ms·

How does one realistically protect against these new attack vectors? It's all become so quick - the malware infects your machine, and seconds later your repos a

How does one realistically protect against these new attack vectors? It's all become so quick - the malware infects your machine, and seconds later your repos are cloned. Most computers are always connected to the internet when they're on, even if they don't necessarily need to be. Airgapping isn't really used outside of very sensitive networks, but I'm starting to think we need to head towards a model of connecting machines only when really needed. Of course the cloud based world doesn't allow for that, and perhaps I'm a luddite, but I increasingly find myself disabling the network connection when I'm working on my PC. Kind of like the dial-up days.

st3fan 9y ago
* How does one realistically protect against these new attack vectors?* Do not install unsigned software is a good start. Does that dialog need a secondary 'Are you really really sure?' absolutely .. but the basic defence in this specific case was in place.
- libeclipse 9y ago
  Yeah, Linux especially I've never downloaded and installed something manually from the internet. I get all of my packages directly from: pacman -S foo Or sometimes maybe: yaourt -S foo tl;dr Use your operating-system's package manager.
  - logicallee 9y ago
    Who downvoted the above, and why - it seems like a genuine reply for how the parent commenter does things, written from the perspective of a user? -- EDIT: to the reply to this, when I posted my comment, the parent was greyed out. (not now.) whoever did it obviously has some opinion, they should just reply with it so it adds to the discussion. (which I'm just reading, didn't contribute anything else to.)
    - gtirloni 9y ago
      How do you know someone downvoted it? It looks the same as others to me (not grayed out).
  - badosu 9y ago
    AUR (Arch User Repository) is a great way to provide user and vendor provided installers IMO: you can check the build script, comment on it, flag outdated ones define and change maintainers while providing a web interface as well.
  - egypturnash 9y ago
    MacOS's package manager is the App Store. Which Handbrake isn't on. It isn't on the Windows store either as far as I can tell. Why, I don't know - maybe nobody involved wants to pay the fees to become an Authorized Developer, maybe there's a Free Software religious argument going on, maybe Apple doesn't want a program whose original function was "ripping DVDs" to be on there because of the many deals they have with the entertainment industry. tl;dr: the program in question ain't in the operating system's package manager.
    - libeclipse 9y ago
      Maybe use operating systems that have proper package managers then. cough Arch cough
    - derimagia 9y ago
      App store has a lot of issues as is, I actively try to avoid the app store. I'm sure it's more secure, but security isn't everything. The issue doesn't have to do with the app store, it's being careful what you are downloading no matter what it's from.
  - Macha 9y ago
    The AUR (Since you mention yaourt) or PPAs are the linux equivalent of downloading random crap off developer homepages though. They have benefits in terms of updates etc. but they're no more secure (And you may want to look at the next PKGBUILD you install and see how many of them are literally just grabbing stuff off third party servers anyway) See for example: * Kivy: https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=python-kivy-git https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=pytho... * Chrome: https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=google-chrome https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=googl... * Vivaldi: https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=vivaldi https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=vival... * Plymouth (over HTTP too!): https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=plymouth https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=plymo... * Oracle JDK (also plaintext HTTP!): https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=jdk https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=jdk
    - floatboth 9y ago
      That's how pretty much all packages in any distribution are built. Note the included hashes — if the file on the server gets replaced, the building process will complain. (Sure the package maintainer will probably just replace the hash :D But if the file changed but the version number didn't change, or there was no release announcement, that's suspicious…)
      - kingosticks 9y ago
        But arch pulls these files and rebuilds every time, right? Compared to most other distros where only the (more) savvy maintainer does these steps. Don't arch end users just assume there's a new version out and the package hasn't been updated, ignore the error and install anyway? Or are they better trained to take notice of this suspicious stuff?
        floatboth 9y ago
        > ignore the error and install anyway I don't remember how Arch does it, but in FreeBSD Ports you need to actively replace the hash in the text file, there's no easy ignore option. (FreeBSD also mirrors the files on the project's servers, which is pretty cool)
  - jackewiehose 9y ago
    I'm using linux for some time and I installed tons of software without my package manager (thats unavoidable because not every package archive has every software). In the end its all about trust. If you trust some web domain you can also trust their software. If that software is compromised you're out of luck. No package manager or walled apple garden can help you with that.
    - clarry 9y ago
      But there is more to trust than just domains (web servers): signatures. If only people used these.
- AnimalMuppet 9y ago
  We had a system that was used to generate television graphics. Our installer for new software was capable of bringing up a system with a new hard drive, so one of the options it had was to format the hard drive. The installer asked three times if you were sure, with increasingly severe warnings about losing all your data. Sure enough, a customer with an existing hard drive ran through all three warnings, formatted their hard drive, and then called customer service to complain about losing all their data. The solution, of course, was to add a fourth question...
  - mark-r 9y ago
    A fourth question obviously isn't going to help. Make them enter "erase my drive" into a text box, that might get them to pause for a moment.
  - strictfp 9y ago
    Well, the probability approaches zero asymptotically as the number of questions approaches infinity...
Kenji 9y ago
Use a packet manager like apt to download and install your software. I think there are also packet managers for Mac OS and Windows.
- pfg 9y ago
  I definitely agree with this advice in general, but as it so happens, users who installed HandBrake via homebrew (a package manager for macOS) were affected by this too because the hash for the latest version of HandBrake was changed to the infected version[1]. Still, package managers definitely make it harder for the attacker in most cases. [1]: https://github.com/caskroom/homebrew-cask/pull/33354 https://github.com/caskroom/homebrew-cask/pull/33354
  - dlandis 9y ago
    Wow, that's a strangely aggressive reply from one of the contributors on that thread. And then he said: > 99% of the time these hash changes are innocent That's actually not very good at all and proves they shouldn't just trust hash changes! Very odd
shubb 9y ago
Have a fun laptop, a work laptop, and maybe banking tablet? As a good corporate drone, this arrangement is kind of forced on me, but a lot of small company / startup folks totally mix the two. Might be a good thing to not do. Sure it doesn't protect you from e.g. a tool you need for work being compromised, but it reduces the attack surface - this guy probably wouldn't have installed handbrake on his work machine. Another thing we do specifically because medical data is, a lot of the time I'm forced to work inside a non internet connected network that I vpn and then remote desktop to. Firewall rules mean the only thing getting in from my laptop is vnc. Some systems also require plugging into a specific physical network. Overkill for most uses but it makes losing laptops fat less scary if you can keep a lot of your stuff on a more secure remote system.
- waz0wski 9y ago
  > Have a fun laptop, a work laptop, and a banking tablet? Try out Qubes: http://qubes-os.org http://qubes-os.org
  - shubb 9y ago
    This is a really good thing, and thank you for showing it to me. Something like this could be good if you wanted to rapidly switch between different compartments on a single device. It would be great for e.g. keeping a 'sensitive data' compartment seperate from a 'emails and paperwork' compartment on a work laptop. Doing something like this is certainly better than using a single device with no seperation or just user accounts. Psychologically, I still think that training people to use different devices for different things is more likely to stick than (account seperation on steroids). This extends to physical security - not leaving a work laptop in your backpack in a nightclub cloakroom like you might a personal device. But in the end with that reason, at a small comapany where you can avoid hiring idiots, it's up to each person to decide what psychological tricks they need to get themselves to do things. I wouldn't trust something like this to keep high security information seperate. When some exploit that escapes Xen or (for a corp) accesses windows systems otherwise securely configured, there is nothing like isolated networks to keep your blood pressure low. For most software a service dev type people you already have this - your data lives in a data center on carefully configured production servers. But for data science type users, you see a lot of people (especially in accademida) doing work with potentially scary datasets on local laptops they probably also watch pirate TV on at home, which is a bit concerning. I guess at least if they were using qubes it would be a bit better though.
waz0wski 9y ago
IF you really want to be pedantic about it, utilize an egress firewall policy, whether on your machine, or your router. For MacOS, LittleSnitch or RadioSilence. For Linux/BSD, setup your firewall of choice to do some filtering. Yes, it will take alot of effort to setup, and some effort to maintain, but it helps.
bm98 9y ago
In cases where I need to download and install unsigned software that's not available via package manager, I run hashes (MD5, SHA1, SHA256, etc.) on the downloaded file and the run Google searches on those hashes. As long as the software has been released for more than a day or two and it has a decent sized user base, the hashes will show up in various places such as fossies.org and will be cached by google. That would have protected against this particular attack. EDIT: But in this case, the software in question is signed, so the (fallback) technique described above is not necessary. The download page [0] contains a GPG signature along with a link to the author's GPG public key. Checking the signature would have prevented the attack. [0] https://handbrake.fr/rotation.php?file=HandBrake-1.0.7.dmg https://handbrake.fr/rotation.php?file=HandBrake-1.0.7.dmg
coldtea 9y ago
>How does one realistically protect against these new attack vectors? It's all become so quick - the malware infects your machine, and seconds later your repos are cloned. 1) Don't install random crap off of the internet: only use the Mac App Store, with sandboxed apps and "System integrity protection" turned on. 2) If you absolutely need to have some non-MAS app, check the checksum, download the DMG, but let it rest, and only install it a month or so later, if no news of breach, malware etc has been announced. 3) Don't give a third party program root privileges -- don't give your credentials when a random program you've downloaded asks for them. 4) Have any sensitive data (e.g. work stuff, etc) on an encrypted .DMG volume or similar, that you only decrypt when you need to check something. Even if your mac is infected, they'll either get just an encrypted image of those, or wont be able to read it at all. 5) Install an application firewall, like Little Snitch. 6) Keep backups.
gangstead 9y ago
Would a passphrase on the SSH key help in this case? Attacker would have the SSH key but need the passphrase to be able to use it. That's how I have my SSH keys.
- cillian64 9y ago
  I believe this malware included a keylogger. Retrieving the correct passphrase would be another step for the attacker but wouldn't stop them if they're determined.

st3fan 9y ago

* How does one realistically protect against these new attack vectors?* Do not install unsigned software is a good start. Does that dialog need a secondary 'Are you really really sure?' absolutely .. but the basic defence in this specific case was in place.

libeclipse 9y ago
Yeah, Linux especially I've never downloaded and installed something manually from the internet. I get all of my packages directly from: pacman -S foo Or sometimes maybe: yaourt -S foo tl;dr Use your operating-system's package manager.
- logicallee 9y ago
  Who downvoted the above, and why - it seems like a genuine reply for how the parent commenter does things, written from the perspective of a user? -- EDIT: to the reply to this, when I posted my comment, the parent was greyed out. (not now.) whoever did it obviously has some opinion, they should just reply with it so it adds to the discussion. (which I'm just reading, didn't contribute anything else to.)
  - gtirloni 9y ago
    How do you know someone downvoted it? It looks the same as others to me (not grayed out).
- badosu 9y ago
  AUR (Arch User Repository) is a great way to provide user and vendor provided installers IMO: you can check the build script, comment on it, flag outdated ones define and change maintainers while providing a web interface as well.
- egypturnash 9y ago
  MacOS's package manager is the App Store. Which Handbrake isn't on. It isn't on the Windows store either as far as I can tell. Why, I don't know - maybe nobody involved wants to pay the fees to become an Authorized Developer, maybe there's a Free Software religious argument going on, maybe Apple doesn't want a program whose original function was "ripping DVDs" to be on there because of the many deals they have with the entertainment industry. tl;dr: the program in question ain't in the operating system's package manager.
  - libeclipse 9y ago
    Maybe use operating systems that have proper package managers then. cough Arch cough
  - derimagia 9y ago
    App store has a lot of issues as is, I actively try to avoid the app store. I'm sure it's more secure, but security isn't everything. The issue doesn't have to do with the app store, it's being careful what you are downloading no matter what it's from.
- Macha 9y ago
  The AUR (Since you mention yaourt) or PPAs are the linux equivalent of downloading random crap off developer homepages though. They have benefits in terms of updates etc. but they're no more secure (And you may want to look at the next PKGBUILD you install and see how many of them are literally just grabbing stuff off third party servers anyway) See for example: * Kivy: https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=python-kivy-git https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=pytho... * Chrome: https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=google-chrome https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=googl... * Vivaldi: https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=vivaldi https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=vival... * Plymouth (over HTTP too!): https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=plymouth https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=plymo... * Oracle JDK (also plaintext HTTP!): https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=jdk https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=jdk
  - floatboth 9y ago
    That's how pretty much all packages in any distribution are built. Note the included hashes — if the file on the server gets replaced, the building process will complain. (Sure the package maintainer will probably just replace the hash :D But if the file changed but the version number didn't change, or there was no release announcement, that's suspicious…)
    - kingosticks 9y ago
      But arch pulls these files and rebuilds every time, right? Compared to most other distros where only the (more) savvy maintainer does these steps. Don't arch end users just assume there's a new version out and the package hasn't been updated, ignore the error and install anyway? Or are they better trained to take notice of this suspicious stuff?
      - floatboth 9y ago
        > ignore the error and install anyway I don't remember how Arch does it, but in FreeBSD Ports you need to actively replace the hash in the text file, there's no easy ignore option. (FreeBSD also mirrors the files on the project's servers, which is pretty cool)
- jackewiehose 9y ago
  I'm using linux for some time and I installed tons of software without my package manager (thats unavoidable because not every package archive has every software). In the end its all about trust. If you trust some web domain you can also trust their software. If that software is compromised you're out of luck. No package manager or walled apple garden can help you with that.
  - clarry 9y ago
    But there is more to trust than just domains (web servers): signatures. If only people used these.
AnimalMuppet 9y ago
We had a system that was used to generate television graphics. Our installer for new software was capable of bringing up a system with a new hard drive, so one of the options it had was to format the hard drive. The installer asked three times if you were sure, with increasingly severe warnings about losing all your data. Sure enough, a customer with an existing hard drive ran through all three warnings, formatted their hard drive, and then called customer service to complain about losing all their data. The solution, of course, was to add a fourth question...
- mark-r 9y ago
  A fourth question obviously isn't going to help. Make them enter "erase my drive" into a text box, that might get them to pause for a moment.
- strictfp 9y ago
  Well, the probability approaches zero asymptotically as the number of questions approaches infinity...

Kenji 9y ago

Use a packet manager like apt to download and install your software. I think there are also packet managers for Mac OS and Windows.

pfg 9y ago
I definitely agree with this advice in general, but as it so happens, users who installed HandBrake via homebrew (a package manager for macOS) were affected by this too because the hash for the latest version of HandBrake was changed to the infected version[1]. Still, package managers definitely make it harder for the attacker in most cases. [1]: https://github.com/caskroom/homebrew-cask/pull/33354 https://github.com/caskroom/homebrew-cask/pull/33354
- dlandis 9y ago
  Wow, that's a strangely aggressive reply from one of the contributors on that thread. And then he said: > 99% of the time these hash changes are innocent That's actually not very good at all and proves they shouldn't just trust hash changes! Very odd

shubb 9y ago

Have a fun laptop, a work laptop, and maybe banking tablet? As a good corporate drone, this arrangement is kind of forced on me, but a lot of small company / startup folks totally mix the two. Might be a good thing to not do. Sure it doesn't protect you from e.g. a tool you need for work being compromised, but it reduces the attack surface - this guy probably wouldn't have installed handbrake on his work machine. Another thing we do specifically because medical data is, a lot of the time I'm forced to work inside a non internet connected network that I vpn and then remote desktop to. Firewall rules mean the only thing getting in from my laptop is vnc. Some systems also require plugging into a specific physical network. Overkill for most uses but it makes losing laptops fat less scary if you can keep a lot of your stuff on a more secure remote system.

waz0wski 9y ago
> Have a fun laptop, a work laptop, and a banking tablet? Try out Qubes: http://qubes-os.org http://qubes-os.org
- shubb 9y ago
  This is a really good thing, and thank you for showing it to me. Something like this could be good if you wanted to rapidly switch between different compartments on a single device. It would be great for e.g. keeping a 'sensitive data' compartment seperate from a 'emails and paperwork' compartment on a work laptop. Doing something like this is certainly better than using a single device with no seperation or just user accounts. Psychologically, I still think that training people to use different devices for different things is more likely to stick than (account seperation on steroids). This extends to physical security - not leaving a work laptop in your backpack in a nightclub cloakroom like you might a personal device. But in the end with that reason, at a small comapany where you can avoid hiring idiots, it's up to each person to decide what psychological tricks they need to get themselves to do things. I wouldn't trust something like this to keep high security information seperate. When some exploit that escapes Xen or (for a corp) accesses windows systems otherwise securely configured, there is nothing like isolated networks to keep your blood pressure low. For most software a service dev type people you already have this - your data lives in a data center on carefully configured production servers. But for data science type users, you see a lot of people (especially in accademida) doing work with potentially scary datasets on local laptops they probably also watch pirate TV on at home, which is a bit concerning. I guess at least if they were using qubes it would be a bit better though.

waz0wski 9y ago

IF you really want to be pedantic about it, utilize an egress firewall policy, whether on your machine, or your router. For MacOS, LittleSnitch or RadioSilence. For Linux/BSD, setup your firewall of choice to do some filtering. Yes, it will take alot of effort to setup, and some effort to maintain, but it helps.

bm98 9y ago

In cases where I need to download and install unsigned software that's not available via package manager, I run hashes (MD5, SHA1, SHA256, etc.) on the downloaded file and the run Google searches on those hashes. As long as the software has been released for more than a day or two and it has a decent sized user base, the hashes will show up in various places such as fossies.org and will be cached by google. That would have protected against this particular attack. EDIT: But in this case, the software in question is signed, so the (fallback) technique described above is not necessary. The download page [0] contains a GPG signature along with a link to the author's GPG public key. Checking the signature would have prevented the attack. [0] https://handbrake.fr/rotation.php?file=HandBrake-1.0.7.dmg https://handbrake.fr/rotation.php?file=HandBrake-1.0.7.dmg

coldtea 9y ago

>How does one realistically protect against these new attack vectors? It's all become so quick - the malware infects your machine, and seconds later your repos are cloned. 1) Don't install random crap off of the internet: only use the Mac App Store, with sandboxed apps and "System integrity protection" turned on. 2) If you absolutely need to have some non-MAS app, check the checksum, download the DMG, but let it rest, and only install it a month or so later, if no news of breach, malware etc has been announced. 3) Don't give a third party program root privileges -- don't give your credentials when a random program you've downloaded asks for them. 4) Have any sensitive data (e.g. work stuff, etc) on an encrypted .DMG volume or similar, that you only decrypt when you need to check something. Even if your mac is infected, they'll either get just an encrypted image of those, or wont be able to read it at all. 5) Install an application firewall, like Little Snitch. 6) Keep backups.

gangstead 9y ago

Would a passphrase on the SSH key help in this case? Attacker would have the SSH key but need the passphrase to be able to use it. That's how I have my SSH keys.

cillian64 9y ago
I believe this malware included a keylogger. Retrieving the correct passphrase would be another step for the attacker but wouldn't stop them if they're determined.