5 ms·

While people give reasonable counter-arguments here to your point, it gets me thinking - I wonder if we could find a truly benign form of "malicious code" that

While people give reasonable counter-arguments here to your point, it gets me thinking - I wonder if we could find a truly benign form of "malicious code" that "good guys" could use to find attack vectors before the "bad guys" do. Perhaps there could be a website set up to get pinged by "malicious" installers? Perhaps it displays stats of some sort? It could turn into a friendly game.

elliekelly 7y ago
I actually built something like this a few months ago. I called it “OSSassin” (like the game[1]) so devs could sign up & get a unique ID/url to ping with the idea that everyone participating would then try to secretly, and not maliciously, “assassinate” the packages that have agreed to participate by sneaking in code to ping their endpoint. Just as a fun/friendly game to help identify potential vulnerabilities. It has a leaderboard for “kills” but it’s currently empty because I never released it. While I’ve got some experience using packages, I’m still pretty new at software development & have never really been involved maintaining any packages. So I guess what I’m saying is I’m not entirely confident the way I built it made sense until I just saw your comment. I also wanted to add GitHub OAuth as a way to verify/limit who was participating but I never got around to it. I’m on my phone at the moment but if you (or anyone else) has the knowledge/interest in taking a look at what I’ve done I’d love to release it with a partner. [1] https://en.m.wikipedia.org/wiki/Assassin_(game) https://en.m.wikipedia.org/wiki/Assassin_(game)
- dane-pgp 7y ago
  That sounds like a really fun gamification of an aspect of security research that maybe doesn't get much practical exploration. I'm not sure, though, how the game would distinguish between vulnerable code pinging the endpoint, as opposed to a player simulating a successful attack by performing the ping themselves. I feel like the attacker should be able to provide a link to a package on a software repo somewhere and the game should download the package and check for some unique "Player 123456 attacked this package" string. This reminds me of a similar game someone created where they challenged people to add a certain string to any repo that the challenge creator maintained. An ingenious social engineer then pointed out that the rules of this game weren't in an easy to find place, so the challenge creator added a page to their blog, which was under version control... Game over. Unfortunately I can't remember any detail that would allow me to find a citation for this story.
  - pastage 7y ago
    That was a wonderful story, this seems to be the source, but your storytelling makes it better. https://mobile.twitter.com/Sc00bzT/status/730903007014076416 https://mobile.twitter.com/Sc00bzT/status/730903007014076416 https://news.ycombinator.com/item?id=11691798 https://news.ycombinator.com/item?id=11691798
  - elliekelly 7y ago
    > I'm not sure, though, how the game would distinguish between vulnerable code pinging the endpoint, as opposed to a player simulating a successful attack by performing the ping themselves. Yup, you're definitely right. Every time it's pinged I have it download the github repo and then search for the string but your suggestion makes way more sense. If someone managed to get their ID into a popular package the repo would be downloaded & searched again and again and again. I was also playing around with it only using one repo so I hadn't really given any thought as to how it would know which repo to download if there were more than participating. I'll dust it off, make some changes you've suggested and then put it on GitHub so @9dev (and anyone else) can take a look and tell me what else needs improvement. Thanks!
- 9dev 7y ago
  If you're still up for this, publish the source on GitHub. That's an excellent idea and I'd like to participate :) @dane-pgp's suggestion of verifying the hack by checking the source repository is great too. Maybe it'd be easiest to just name the endpoints something like `/ping/github/<handle>/<package>`.
  - elliekelly 7y ago
    Awesome! Thanks, a ton! I haven't touched it in a while but I'll take a look at it now. I'm going to take a stab at fixing it up a bit and then I'll put it on my (currently empty!) github. I'm a bit leery of including my username in an HN comment - I once made the mistake of mentioning my twitter handle here and got some weird selfies in my DMs - so I'll put my github username in my HN profile for a day so you'll know where to look.

elliekelly 7y ago

I actually built something like this a few months ago. I called it “OSSassin” (like the game[1]) so devs could sign up & get a unique ID/url to ping with the idea that everyone participating would then try to secretly, and not maliciously, “assassinate” the packages that have agreed to participate by sneaking in code to ping their endpoint. Just as a fun/friendly game to help identify potential vulnerabilities. It has a leaderboard for “kills” but it’s currently empty because I never released it. While I’ve got some experience using packages, I’m still pretty new at software development & have never really been involved maintaining any packages. So I guess what I’m saying is I’m not entirely confident the way I built it made sense until I just saw your comment. I also wanted to add GitHub OAuth as a way to verify/limit who was participating but I never got around to it. I’m on my phone at the moment but if you (or anyone else) has the knowledge/interest in taking a look at what I’ve done I’d love to release it with a partner. [1] https://en.m.wikipedia.org/wiki/Assassin_(game) https://en.m.wikipedia.org/wiki/Assassin_(game)

dane-pgp 7y ago
That sounds like a really fun gamification of an aspect of security research that maybe doesn't get much practical exploration. I'm not sure, though, how the game would distinguish between vulnerable code pinging the endpoint, as opposed to a player simulating a successful attack by performing the ping themselves. I feel like the attacker should be able to provide a link to a package on a software repo somewhere and the game should download the package and check for some unique "Player 123456 attacked this package" string. This reminds me of a similar game someone created where they challenged people to add a certain string to any repo that the challenge creator maintained. An ingenious social engineer then pointed out that the rules of this game weren't in an easy to find place, so the challenge creator added a page to their blog, which was under version control... Game over. Unfortunately I can't remember any detail that would allow me to find a citation for this story.
- pastage 7y ago
  That was a wonderful story, this seems to be the source, but your storytelling makes it better. https://mobile.twitter.com/Sc00bzT/status/730903007014076416 https://mobile.twitter.com/Sc00bzT/status/730903007014076416 https://news.ycombinator.com/item?id=11691798 https://news.ycombinator.com/item?id=11691798
- elliekelly 7y ago
  > I'm not sure, though, how the game would distinguish between vulnerable code pinging the endpoint, as opposed to a player simulating a successful attack by performing the ping themselves. Yup, you're definitely right. Every time it's pinged I have it download the github repo and then search for the string but your suggestion makes way more sense. If someone managed to get their ID into a popular package the repo would be downloaded & searched again and again and again. I was also playing around with it only using one repo so I hadn't really given any thought as to how it would know which repo to download if there were more than participating. I'll dust it off, make some changes you've suggested and then put it on GitHub so @9dev (and anyone else) can take a look and tell me what else needs improvement. Thanks!
9dev 7y ago
If you're still up for this, publish the source on GitHub. That's an excellent idea and I'd like to participate :) @dane-pgp's suggestion of verifying the hack by checking the source repository is great too. Maybe it'd be easiest to just name the endpoints something like `/ping/github/<handle>/<package>`.
- elliekelly 7y ago
  Awesome! Thanks, a ton! I haven't touched it in a while but I'll take a look at it now. I'm going to take a stab at fixing it up a bit and then I'll put it on my (currently empty!) github. I'm a bit leery of including my username in an HN comment - I once made the mistake of mentioning my twitter handle here and got some weird selfies in my DMs - so I'll put my github username in my HN profile for a day so you'll know where to look.