4 ms·

Here's my hot take: supply chain attacks are a low risk for your organization - they are both low likelihood and low impact. 1) Low likelihood: when popular pa

Here's my hot take: supply chain attacks are a low risk for your organization - they are both low likelihood and low impact. 1) Low likelihood: when popular packages get subverted it is caught quickly due to how widely packages are distributed. After it's caught the problem is also heavily publicized for folks to take action, and registries remove the affected versions immediately so there is a very small exposure window. 2) Low impact: people who write malicious code into these packages don't have a specific target, they are writing dragnet malware, which typically means mining cryptocurrency or ransomware. If you're going to get hacked then that's the best possible outcome (as opposed to, e.g. a data breach). Your security posture would have to be superb if supply chain attacks were anywhere near the top of your list - for the majority of companies they have more basic and targeted issues to worry about.

saagarjha 6y ago
I mean, if they write code that grabs all the cookies on a site as well as traffic they have a fairly decent chance of a data breach…
7373737373 6y ago
This is part of the reason why current languages and operating systems simply do not have security properties that would inhibit or entirely prevent these risks: it never mattered economically enough to implement them. Big corporations insure themselves against these risks financially (if at all), not technologically. The other big reason has been having to maintain backward compatibility, personal computers and programming languages built for them were only networked late compared to some mainframe systems. There have been very interesting historical networked operating systems that were far more secure in their architecture than current contenders: https://github.com/void4/notes/issues/41 https://github.com/void4/notes/issues/41
jakear 6y ago
Eh... I don’t share your cavalier attitude. You assume these attacks aren’t targeted just because we haven’t seen them, but it wouldn’t be hard at all for an attacker to take control of a package through some means (purchase, social engineering, or just solving a problem more efficiently than others do and aggressively asking others to adopt it), then publishing to npm a minified version of the package which includes some targeted exploit that doesn’t activate except in a specific environment. The source on GitHib would ofc not include the exploit, and there’s no push for reproducible builds in the npm world so verifying that npm’s minified JS was built from the GitHub source is nontrivial and not something most shops would bother with.
captn3m0 6y ago
On (2) low impact: A few npm advisories mention packages that were uploading SSH keys and bashrc files. - https://www.npmjs.com/advisories/541 https://www.npmjs.com/advisories/541 (package==coffeescript) - https://www.npmjs.com/advisories/765 https://www.npmjs.com/advisories/765 (package==portionfatty12) There's also been packages that would upload the environment variables (increases impact significantly if this reaches production): - https://blog.npmjs.org/post/163723642530/crossenv-malware-on-the-npm-registry https://blog.npmjs.org/post/163723642530/crossenv-malware-on... (package==crossenv) - https://www.npmjs.com/advisories/486 https://www.npmjs.com/advisories/486 (package==sqlserver)
tao_oat 6y ago
Unfortunately, targeted attacks have been seen in the wild. The `event-stream` attack linked in the post was one example. Alternatively, look at the attack on the Agama cryptocurrency wallet —- the attackers even managed to exfiltrate private wallet keys there: https://komodoplatform.com/update-agama-vulnerability/ https://komodoplatform.com/update-agama-vulnerability/
spullara 6y ago
The only attack I have detailed knowledge of was targeted specifically at a company - Copay: https://thenewstack.io/attackers-up-their-game-with-latest-npm-package-compromise/ https://thenewstack.io/attackers-up-their-game-with-latest-n...

saagarjha 6y ago

I mean, if they write code that grabs all the cookies on a site as well as traffic they have a fairly decent chance of a data breach…

7373737373 6y ago

This is part of the reason why current languages and operating systems simply do not have security properties that would inhibit or entirely prevent these risks: it never mattered economically enough to implement them. Big corporations insure themselves against these risks financially (if at all), not technologically. The other big reason has been having to maintain backward compatibility, personal computers and programming languages built for them were only networked late compared to some mainframe systems. There have been very interesting historical networked operating systems that were far more secure in their architecture than current contenders: https://github.com/void4/notes/issues/41 https://github.com/void4/notes/issues/41

jakear 6y ago

Eh... I don’t share your cavalier attitude. You assume these attacks aren’t targeted just because we haven’t seen them, but it wouldn’t be hard at all for an attacker to take control of a package through some means (purchase, social engineering, or just solving a problem more efficiently than others do and aggressively asking others to adopt it), then publishing to npm a minified version of the package which includes some targeted exploit that doesn’t activate except in a specific environment. The source on GitHib would ofc not include the exploit, and there’s no push for reproducible builds in the npm world so verifying that npm’s minified JS was built from the GitHub source is nontrivial and not something most shops would bother with.

captn3m0 6y ago

On (2) low impact: A few npm advisories mention packages that were uploading SSH keys and bashrc files. - https://www.npmjs.com/advisories/541 https://www.npmjs.com/advisories/541 (package==coffeescript) - https://www.npmjs.com/advisories/765 https://www.npmjs.com/advisories/765 (package==portionfatty12) There's also been packages that would upload the environment variables (increases impact significantly if this reaches production): - https://blog.npmjs.org/post/163723642530/crossenv-malware-on-the-npm-registry https://blog.npmjs.org/post/163723642530/crossenv-malware-on... (package==crossenv) - https://www.npmjs.com/advisories/486 https://www.npmjs.com/advisories/486 (package==sqlserver)

tao_oat 6y ago

Unfortunately, targeted attacks have been seen in the wild. The `event-stream` attack linked in the post was one example. Alternatively, look at the attack on the Agama cryptocurrency wallet —- the attackers even managed to exfiltrate private wallet keys there: https://komodoplatform.com/update-agama-vulnerability/ https://komodoplatform.com/update-agama-vulnerability/

spullara 6y ago

The only attack I have detailed knowledge of was targeted specifically at a company - Copay: https://thenewstack.io/attackers-up-their-game-with-latest-npm-package-compromise/ https://thenewstack.io/attackers-up-their-game-with-latest-n...