4 ms·
I really dislike this dilution of “zero-day” and “supply chain attack”: these are typosquats, not package takeovers. There’s no evidence that they’re widely aff
by woodruffw 4y ago
I really dislike this dilution of “zero-day” and “supply chain attack”: these are typosquats, not package takeovers. There’s no evidence that they’re widely affecting companies or individual developers whatsoever.
In general, you can apply a “repetition” test to these sorts of 0day claims: if the attacker can create infinite “0days” using the exact same technique, it’s not an 0day.
Edit: More generally, otherwise serious security companies should be ashamed to publish dreck like this. It’s one thing to highlight a tool that automatically detects new typosquats (this would be a genuinely useful contribution to most packaging ecosystems!); it’s another thing entirely to breathlessly hype non-existent attacks. This kind of false vigilance breeds exactly the kind of complacency that it’s supposedly intended to prevent.
- mistrial9 4y agotragically, we will get more articles in this genre, as 'security' attracts government funding, and faux security acts are enabled via budgets and megaphones.
- woodruffw 4y agoYep. It bums me out as a contributor to both package indices and someone working on “supply chain” tooling; there’s serious and interesting work to be done here, but it’s general work (universal codesigning, automatic typosquat restrictions in indexes) rather than this kind of lazy blogspam “exploit” whac-a-mole.
- ashishbijlani 4y agoThis. Moreover, such typo-squatting attacks could easily be mitigated by using a private package registry.
- duxup 4y agoI know some folks in the security industry. There is a crazy wide gap between capable security people and services and downright frauds. To some extent that exists everywhere but at least say a developer who is terrible and can’t ship anything gets filtered out at some point. Security land is absurd. All the security people I know are very sensitive about it and have in many situations felt the need to / have quit a job after a fraud was hired. They’re not dogmatic about security but they do care deeply about being productive and a sense that it’s their job to provide quality advice and actions.
- junon 4y agoYep. Seems like the last two years have really given way to spammy or fraudulent security "researchers" who are just trying to get payouts. It's been plaguing a number of projects on GitHub for a while now.
- mistrial9 4y agoGithub itself is building extensive command-test-control mechanisms, along with CI-pipelines and internal security approval lists, for the explicit purpose of billing for all of that, and requiring that opportunistically.
- tetha 4y agoYeah. I've been ranting about a similar thing in the context of jsonwebtoken to our security guy some days ago. The vulnerability pretty much goes "Well if I can inject an object with a toString() method of my choosing into your running program, then you're totally vulnerable". Yeah, if you can inject and execute code.. you have achieved RCE? Kind of the whole pickle-discussion from python. And nontheless, the assumed precondition for the vulnerability allows you to poison the key used to verify web tokens, so if you can inject data there, very big things immediately explode, like the entire authentication of the system collapsing. But anyway, it's going round as a 7.6 with "trivial exploitation" in "JWTs" and OIDC uses those... and now I have scared developers, and POs and customers calling and so on. This makes it quite challenging and honestly somewhat exhausting to attempt to define a somewhat straightforward security process which doesn't cause alert fatigue very quickly.
- infotogivenm 4y agoI saw that vuln categorized as “RCE” and had the same reaction. IIRC it was prototype pollution in an npm package during json deserialization - if you are letting attackers define javascript functions in your nodejs process, you have almost certainly already lost. The details were vague at the time so I had hoped I was just missing context.
- theteapot 4y ago> I really dislike this dilution of “zero-day” and “supply chain attack” Agree, except it's not a matter of like/dislike, it's just plain wrong.
- johnklos 4y agoUnfortunately, it's marketing bull. As long as they can get wider exposure by being factually incorrect, they'll be factually incorrect. There are good technical reasons to make a distinction, like between Trojan and virus, but they don't care. They won't be ashamed, as much as they should be.
- miohtama 4y agoMaybe they did this just to get posted on HackerNews (: