6 ms·

There has been a number of cases of installers from trusted developers being infected lately. (For example Transmission being infected twice...) On our side (d

There has been a number of cases of installers from trusted developers being infected lately. (For example Transmission being infected twice...) On our side (developers) we need to be careful with this idea that "we will know" when something is wrong and be more careful when deploying software. It would also be nice if some form of tool could be used to test a binary to make sure it only contains what it should contain (sort of a whitelist of symbol names compared to the source files, idk...) I'm sure something along these lines probably exists for some different purpose.

westoque 9y ago
Binary analysis for each software you install might be too cumbersome for most developers. I suggest you use something like "Little Snitch" for mac which warns you when software makes inside/outside connections. It might not be the best, but it's definitely something that works to mitigate some hacks.
- princekolt 9y ago
  Thing is, you can't even trust little snitch these days[1] :( At least a binary check after compilation+signing (by the developer) should improve security a little bit. [1]: https://objective-see.com/blog/blog_0x21.html https://objective-see.com/blog/blog_0x21.html
- corv 9y ago
  I like to compliment Little Snitch with XFence (formerly known as Little Flocker). You can think of it as a firewall for your filesystem and devices.
  - danieldk 9y ago
    I use Little Snitch too. I had a Little Flocker license, but the rules were quite painful to maintain. Especially if you are also using the Terminal and command-line apps.
mollusk 9y ago
>Transmission being infected twice Could you please elaborate? I only recall one instance of compromised Transmission installer.
- princekolt 9y ago
  https://www.reddit.com/r/torrents/comments/50dm8e/transmission_for_mac_infected_with_malware_again/ https://www.reddit.com/r/torrents/comments/50dm8e/transmissi...
deleted 9y ago
[deleted]
contravariant 9y ago
I'm not sure how exactly these infections work, but one method would be to infect the developers' PCs. In which case you essentially can't trust anything. You'd need some kind of byzantine fault tolerance (mandatory multi-person code review?) to be sure nothing like this ever happens What makes this scary is that, as far as I know, pretty much no software has that kind of security, and there are several pieces of widely used software that always update automatically (sometimes for good reason, sometimes not so much).
- elorant 9y ago
  You can enable AppLocker and have explicit control on what executes and what not by creating rules. I know quite a few companies that enforce its use in their employees' PCs.
  - cyphar 9y ago
    As an aside, AppLocker was trivially bypassable for several years -- there were two different APIs that allowed you to set an "ignore AppLocker" flag. We used to use it in high-school to play games (or in my case, run gvim and some other development tools). I think that there needs to be a more complete solution than just "secure the developers machines". You need to have peer-review, where the developers sign commits to approve them.
- elsjaako 9y ago
  The solution would be code review + reproducable builds. This is how Debian tries to prevent these kinds of attacks.
- isntthatsox 9y ago
  > mandatory multi-person code review? Isn't this pretty much mandatory with SOX compliance anyway?
cm2187 9y ago
That creates an interesting conflict between automatic updates (you want to be patched against the latest security vulnerabilities) and manual, more infrequent updates (you are less exposed to a compromised update directly and automatically infecting your machine).
cyphar 9y ago
First of all, this is why reproducible builds (getting bit-for-bit identical binaries independent of the machine used to build the software) is something we should be putting much more work into. The Debian folks are doing an amazing job there. Another important point is that distributions have already solved effectively all of these problems. We have automated building and signing systems that mean that installation and upgrades are done in ways that are not vulnerable even to fairly sophisticated attacks. You can build packages locally if you want to verify them, and modifying a package after it has been built invalidates the signature that all modern package managers require before installing a package. As part of the openSUSE project we even have a free-to-use (and free as in freedom) build project called the Open Build Service[1] which allows you to build packages (with automated dependency update rebuilds) for many different distributions (Arch Linux, Debian, Ubuntu, Fedora, RHEL and obviously openSUSE and SLES). I get that distributions aren't "sexy" but it's getting quite frustrating seeing all these communities make the same mistakes that distributions made (and learned from) more than 20 years ago. [Disclaimer: I work for SUSE and am an openSUSE community member.] [1]: https://build.opensuse.org/ https://build.opensuse.org/
- cm2187 9y ago
  That's ok for the NSA and a few large enterprises to check certain binaries but you can't ask any start up or small company to recompile themselves every version of every OS / Software / Library that they use. It's not really a practical solution (even assuming everything is open source).
  - cyphar 9y ago
    As I posted above, we have a build service that does this automatically for you. It takes maybe 30 minutes to create a few spec files, and now it's supported by a bunch of different distributions. You can then point your users at the repo (or mirror the repo if you prefer). Also OBS lets you create forks of projects that just inherit the unmodified packages (and said forks can also be cross-host so you don't need to self-host a whole distribution). I agree that doing everything I mentioned manually is hard, that's again why I said that distributions have solved this problem and made it easy.
otakucode 9y ago
My first thought would be a little process running on a server not on your network that pulls the download every so often, say once a day, and texts you if it is different. You'd expect a text after you push your new version, but if you get one out of the blue, then you'd know something was up.
NiveaGeForce 9y ago
> There has been a number of cases of installers from trusted developers being infected lately. Here a few other cases * https://www.pcworld.com/article/3104180/software/pc-nuking-malware-sneakily-replaces-popular-free-software-on-fosshub.html https://www.pcworld.com/article/3104180/software/pc-nuking-m... * https://www.reddit.com/r/Windows10/comments/6hvzzt/psa_my_chrome_extension_chrometana_has_been/ https://www.reddit.com/r/Windows10/comments/6hvzzt/psa_my_ch... * https://lifehacker.com/many-browser-extensions-have-become-adware-or-malware-1505117457 https://lifehacker.com/many-browser-extensions-have-become-a... * http://www.zdnet.com/article/android-malware-in-google-play-racked-up-4-2-million-downloads-so-are-you-a-victim/#ftag=RSSbaffb68 http://www.zdnet.com/article/android-malware-in-google-play-... * https://arstechnica.com/security/2015/04/google-kills-200-ad-injecting-chrome-extensions-says-many-are-malware/ https://arstechnica.com/security/2015/04/google-kills-200-ad... * https://arstechnica.com/security/2017/01/ciscos-webex-chrome-plugin-opens-20-million-users-to-drive-by-attacks/ https://arstechnica.com/security/2017/01/ciscos-webex-chrome...
- NiveaGeForce 9y ago
  Here another high profile case * https://nakedsecurity.sophos.com/2016/02/22/worlds-biggest-linux-distro-infected-with-malware/ https://nakedsecurity.sophos.com/2016/02/22/worlds-biggest-l...

westoque 9y ago

Binary analysis for each software you install might be too cumbersome for most developers. I suggest you use something like "Little Snitch" for mac which warns you when software makes inside/outside connections. It might not be the best, but it's definitely something that works to mitigate some hacks.

princekolt 9y ago
Thing is, you can't even trust little snitch these days[1] :( At least a binary check after compilation+signing (by the developer) should improve security a little bit. [1]: https://objective-see.com/blog/blog_0x21.html https://objective-see.com/blog/blog_0x21.html
corv 9y ago
I like to compliment Little Snitch with XFence (formerly known as Little Flocker). You can think of it as a firewall for your filesystem and devices.
- danieldk 9y ago
  I use Little Snitch too. I had a Little Flocker license, but the rules were quite painful to maintain. Especially if you are also using the Terminal and command-line apps.

mollusk 9y ago

>Transmission being infected twice Could you please elaborate? I only recall one instance of compromised Transmission installer.

princekolt 9y ago
https://www.reddit.com/r/torrents/comments/50dm8e/transmission_for_mac_infected_with_malware_again/ https://www.reddit.com/r/torrents/comments/50dm8e/transmissi...

deleted 9y ago

[deleted]

contravariant 9y ago

I'm not sure how exactly these infections work, but one method would be to infect the developers' PCs. In which case you essentially can't trust anything. You'd need some kind of byzantine fault tolerance (mandatory multi-person code review?) to be sure nothing like this ever happens What makes this scary is that, as far as I know, pretty much no software has that kind of security, and there are several pieces of widely used software that always update automatically (sometimes for good reason, sometimes not so much).

elorant 9y ago
You can enable AppLocker and have explicit control on what executes and what not by creating rules. I know quite a few companies that enforce its use in their employees' PCs.
- cyphar 9y ago
  As an aside, AppLocker was trivially bypassable for several years -- there were two different APIs that allowed you to set an "ignore AppLocker" flag. We used to use it in high-school to play games (or in my case, run gvim and some other development tools). I think that there needs to be a more complete solution than just "secure the developers machines". You need to have peer-review, where the developers sign commits to approve them.
elsjaako 9y ago
The solution would be code review + reproducable builds. This is how Debian tries to prevent these kinds of attacks.
isntthatsox 9y ago
> mandatory multi-person code review? Isn't this pretty much mandatory with SOX compliance anyway?

cm2187 9y ago

That creates an interesting conflict between automatic updates (you want to be patched against the latest security vulnerabilities) and manual, more infrequent updates (you are less exposed to a compromised update directly and automatically infecting your machine).

cyphar 9y ago

First of all, this is why reproducible builds (getting bit-for-bit identical binaries independent of the machine used to build the software) is something we should be putting much more work into. The Debian folks are doing an amazing job there. Another important point is that distributions have already solved effectively all of these problems. We have automated building and signing systems that mean that installation and upgrades are done in ways that are not vulnerable even to fairly sophisticated attacks. You can build packages locally if you want to verify them, and modifying a package after it has been built invalidates the signature that all modern package managers require before installing a package. As part of the openSUSE project we even have a free-to-use (and free as in freedom) build project called the Open Build Service[1] which allows you to build packages (with automated dependency update rebuilds) for many different distributions (Arch Linux, Debian, Ubuntu, Fedora, RHEL and obviously openSUSE and SLES). I get that distributions aren't "sexy" but it's getting quite frustrating seeing all these communities make the same mistakes that distributions made (and learned from) more than 20 years ago. [Disclaimer: I work for SUSE and am an openSUSE community member.] [1]: https://build.opensuse.org/ https://build.opensuse.org/

cm2187 9y ago
That's ok for the NSA and a few large enterprises to check certain binaries but you can't ask any start up or small company to recompile themselves every version of every OS / Software / Library that they use. It's not really a practical solution (even assuming everything is open source).
- cyphar 9y ago
  As I posted above, we have a build service that does this automatically for you. It takes maybe 30 minutes to create a few spec files, and now it's supported by a bunch of different distributions. You can then point your users at the repo (or mirror the repo if you prefer). Also OBS lets you create forks of projects that just inherit the unmodified packages (and said forks can also be cross-host so you don't need to self-host a whole distribution). I agree that doing everything I mentioned manually is hard, that's again why I said that distributions have solved this problem and made it easy.

otakucode 9y ago

My first thought would be a little process running on a server not on your network that pulls the download every so often, say once a day, and texts you if it is different. You'd expect a text after you push your new version, but if you get one out of the blue, then you'd know something was up.

NiveaGeForce 9y ago

> There has been a number of cases of installers from trusted developers being infected lately. Here a few other cases * https://www.pcworld.com/article/3104180/software/pc-nuking-malware-sneakily-replaces-popular-free-software-on-fosshub.html https://www.pcworld.com/article/3104180/software/pc-nuking-m... * https://www.reddit.com/r/Windows10/comments/6hvzzt/psa_my_chrome_extension_chrometana_has_been/ https://www.reddit.com/r/Windows10/comments/6hvzzt/psa_my_ch... * https://lifehacker.com/many-browser-extensions-have-become-adware-or-malware-1505117457 https://lifehacker.com/many-browser-extensions-have-become-a... * http://www.zdnet.com/article/android-malware-in-google-play-racked-up-4-2-million-downloads-so-are-you-a-victim/#ftag=RSSbaffb68 http://www.zdnet.com/article/android-malware-in-google-play-... * https://arstechnica.com/security/2015/04/google-kills-200-ad-injecting-chrome-extensions-says-many-are-malware/ https://arstechnica.com/security/2015/04/google-kills-200-ad... * https://arstechnica.com/security/2017/01/ciscos-webex-chrome-plugin-opens-20-million-users-to-drive-by-attacks/ https://arstechnica.com/security/2017/01/ciscos-webex-chrome...

NiveaGeForce 9y ago
Here another high profile case * https://nakedsecurity.sophos.com/2016/02/22/worlds-biggest-linux-distro-infected-with-malware/ https://nakedsecurity.sophos.com/2016/02/22/worlds-biggest-l...