5 ms·

This is a gem that checks the strength of a user-submitted password. It has a large number of downloads (37,000 on the legitimate 0.0.6 version). It looks like

This is a gem that checks the strength of a user-submitted password. It has a large number of downloads (37,000 on the legitimate 0.0.6 version). It looks like it's made to be integrated on webservers. The modified gem downloaded and executed code stored in a editable Pastebin, meaning that the code could have changed at any time. Presumably, the malicious code would activate just by browsing any page on the affected site. One version of the Pastebin code would execute any code embedded in a magic cookie sent by a client. Plus, it would ping the attacker's server to let them know your webserver was infected. Nasty, nasty stuff.

djur 7y ago
Good analysis, but I'm not sure about "a large number of downloads". Download counts can be pretty inflated due to CI/deployment processes that reinstall gems from scratch repeatedly. I've seen open-sourced gems that never got any real usage outside their original company get that number of downloads. To add a bit of a sense of scale here, the popular Devise gem that's used for authentication in many Rails apps has 52.7 million total downloads and almost 20k stars on GitHub. strong_password has 247k total downloads and 191 stars. It has three reverse dependencies, none of which I've ever heard of and none of which have any of their own reverse dependencies. This suggests to me that this gem is used by less than 1% of Ruby web apps (probably substantially less) and, more importantly, if you have a dependency on this gem you probably know (because it'd be a direct dependency in your Gemfile, not a dependency of a dependency).
- marcus_holmes 7y ago
  So...we can all ignore how a popular ruby gem was hijacked and used to infect production webservers with malware because (to paraphrase) "it wasn't that popular"? This was caught because the author diligently checked their dependencies line by line. How many ruby devs do that? How many other gems are already hijacked but haven't been discovered because no-one has audited them? That number is almost certainly non-zero. This is on Rubygems.org. They have enough information to warn devs that the gem might be infected (months since the maintainer logged in, gem version release without github repo changes, maintainer email on haveIbeenpwned and no password change since that date, etc).
  - djur 7y ago
    No, I didn't say that, and I would prefer that you not put words in my mouth. I was responding to a single statement in the parent comment that I thought was inaccurate. > a [...] ruby gem was hijacked and used to infect production webservers with malware I wasn't aware of any reports of this being exploited in production. Do you have an example? I agree with the rest of your comment about the need for more active measures on the part of Rubygems.org and the likelihood that other gems -- especially infrequently used, semi-abandoned ones like this -- have been hijacked without anyone detecting.
    - marcus_holmes 7y ago
      fair point, sorry for the implied impugn. no, I don't have any examples, but then, it's not likely we're going to hear of any - anyone affected is probably unaware (until now, maybe). I guess some might come out of the woodwork now. But again, Rubygems should have data on who downloaded this version of this gem, and so should be able to warn them, and even publish that data so we know not to visit their sites until they acknowledge and fix.
pharrington 7y ago
> This is a gem that checks the strength of a user-submitted password Does it, though? https://github.com/bdmac/strong_password/blob/master/lib/strong_password/entropy_calculator.rb https://github.com/bdmac/strong_password/blob/master/lib/str...
- fasterdom 7y ago
  Indeed, replacing this with the list of top 100 passwords would be much more effective.
  - alister 7y ago
    It seems to do that too (comparing against a list of the top 500 passwords): https://github.com/bdmac/strong_password/blob/master/lib/strong_password/dictionary_adjuster.rb https://github.com/bdmac/strong_password/blob/master/lib/str...
  - cyphar 7y ago
    Or, alternatively, switching to the haveibeenpwned API[1] or zxcvbn[2]. [1]: https://haveibeenpwned.com/API/v2 https://haveibeenpwned.com/API/v2 [2]: https://github.com/dropbox/zxcvbn https://github.com/dropbox/zxcvbn
  - senorprogrammer 7y ago
    A long time ago I made a gem that does pretty much this: https://github.com/senorprogrammer/pil https://github.com/senorprogrammer/pil If you want this functionality, I recommend not using it as-is, given the security vuln GitHub is currently reporting. Rather, anyone has my permission to copy the code verbatim into your project. It's a pretty simple gem.
- audience_mem 7y ago
  Could you clarify? Is the algorithm deficient? To me that looks like code that indeed checks the strength, so I must be missing something.
  - 7y ago
deleted 7y ago
[deleted]
michaelcampbell 7y ago
And, only in "production" mode. >:-\

djur 7y ago

Good analysis, but I'm not sure about "a large number of downloads". Download counts can be pretty inflated due to CI/deployment processes that reinstall gems from scratch repeatedly. I've seen open-sourced gems that never got any real usage outside their original company get that number of downloads. To add a bit of a sense of scale here, the popular Devise gem that's used for authentication in many Rails apps has 52.7 million total downloads and almost 20k stars on GitHub. strong_password has 247k total downloads and 191 stars. It has three reverse dependencies, none of which I've ever heard of and none of which have any of their own reverse dependencies. This suggests to me that this gem is used by less than 1% of Ruby web apps (probably substantially less) and, more importantly, if you have a dependency on this gem you probably know (because it'd be a direct dependency in your Gemfile, not a dependency of a dependency).

marcus_holmes 7y ago
So...we can all ignore how a popular ruby gem was hijacked and used to infect production webservers with malware because (to paraphrase) "it wasn't that popular"? This was caught because the author diligently checked their dependencies line by line. How many ruby devs do that? How many other gems are already hijacked but haven't been discovered because no-one has audited them? That number is almost certainly non-zero. This is on Rubygems.org. They have enough information to warn devs that the gem might be infected (months since the maintainer logged in, gem version release without github repo changes, maintainer email on haveIbeenpwned and no password change since that date, etc).
- djur 7y ago
  No, I didn't say that, and I would prefer that you not put words in my mouth. I was responding to a single statement in the parent comment that I thought was inaccurate. > a [...] ruby gem was hijacked and used to infect production webservers with malware I wasn't aware of any reports of this being exploited in production. Do you have an example? I agree with the rest of your comment about the need for more active measures on the part of Rubygems.org and the likelihood that other gems -- especially infrequently used, semi-abandoned ones like this -- have been hijacked without anyone detecting.
  - marcus_holmes 7y ago
    fair point, sorry for the implied impugn. no, I don't have any examples, but then, it's not likely we're going to hear of any - anyone affected is probably unaware (until now, maybe). I guess some might come out of the woodwork now. But again, Rubygems should have data on who downloaded this version of this gem, and so should be able to warn them, and even publish that data so we know not to visit their sites until they acknowledge and fix.

pharrington 7y ago

> This is a gem that checks the strength of a user-submitted password Does it, though? https://github.com/bdmac/strong_password/blob/master/lib/strong_password/entropy_calculator.rb https://github.com/bdmac/strong_password/blob/master/lib/str...

fasterdom 7y ago
Indeed, replacing this with the list of top 100 passwords would be much more effective.
- alister 7y ago
  It seems to do that too (comparing against a list of the top 500 passwords): https://github.com/bdmac/strong_password/blob/master/lib/strong_password/dictionary_adjuster.rb https://github.com/bdmac/strong_password/blob/master/lib/str...
- cyphar 7y ago
  Or, alternatively, switching to the haveibeenpwned API[1] or zxcvbn[2]. [1]: https://haveibeenpwned.com/API/v2 https://haveibeenpwned.com/API/v2 [2]: https://github.com/dropbox/zxcvbn https://github.com/dropbox/zxcvbn
- senorprogrammer 7y ago
  A long time ago I made a gem that does pretty much this: https://github.com/senorprogrammer/pil https://github.com/senorprogrammer/pil If you want this functionality, I recommend not using it as-is, given the security vuln GitHub is currently reporting. Rather, anyone has my permission to copy the code verbatim into your project. It's a pretty simple gem.
audience_mem 7y ago
Could you clarify? Is the algorithm deficient? To me that looks like code that indeed checks the strength, so I must be missing something.
- 7y ago

deleted 7y ago

[deleted]

michaelcampbell 7y ago

And, only in "production" mode. >:-\