3 ms·
Yeah but not just package manager. As a developer or build machine you are just the first potential target and potentially not even the most attractive one. If
by hatchnyc 7y ago
Yeah but not just package manager. As a developer or build machine you are just the first potential target and potentially not even the most attractive one. If you've got a dependency on malicious package that is getting embedded into your code there's near limitless potential downstream harms waiting after the code is deployed.
- staticassertion 7y agoThere's a few different threat models, and different mitigations. We have attackers who: a) Want to run code on package installation b) Want to run code on application execution Restricting packages on installation helps with (a) I disagree that developers are not attractive targets. If I were to target a typical tech company I would absolutely go for a developer. I'd wait for them to SSH to production, hijack their connection, and start moving around. That's a hell of a lot better than if I attack HR and have to start moving laterally in a corporate environment to escalate. As for backdooring production services or applications, ala (b), it's a more complex and bespoke problem to solve I think. I think package managers themselves are not suited to solve this problem and it is up to the OS to restrict programs more by default, like mobile OS's/ Browsers do.